With Copilot and AI agents arriving in every department, the licence question has changed. It is no longer only about productivity apps; it is about whether your security and data governance can keep up with AI. Here is how the three enterprise plans compare.
| Capability | E3 | E5 | E7 |
|---|---|---|---|
| Microsoft 365 apps | Included | Included | Included |
| Microsoft Copilot | Add-on | Add-on | Included |
| Identity and security | Entra ID P1, basic threat protection | Entra ID P2, full Defender XDR | E5 plus the full Entra Suite and agent security |
| Compliance and data governance | Core Purview | Advanced Purview | E5 plus agent-focused governance |
| Security Copilot | Not included | Included for eligible customers | Included for eligible customers |
| Microsoft Agent 365 | Not included | Not included | Included |
What the differences mean in practice
- Oversharing: SharePoint Advanced Management, the main tool for cleaning up overshared content before Copilot, comes with the Copilot licence, so E7 includes it.
- Data protection: E3 offers manual sensitivity labels and core DLP; E5 adds automatic labelling and broader DLP; E7 extends these controls to Copilot and agents.
- Audit and insider risk: E5 brings advanced audit with long retention, Insider Risk Management and Communication Compliance; E7 adds visibility of Copilot and agent activity.
- Agents at scale: only E7 includes Agent 365 for centralised agent governance, access and lifecycle.
A simple rule of thumb
If you only need productivity, E3 still works. If you handle regulated or sensitive data, E5 is the security baseline. If you plan to roll out Copilot widely and build agents, E7 is designed for exactly that.
How Regulus can help
We review your current licences and usage and model the cost of E3, E5 and E7 options against your AI roadmap, so you buy what you will actually use.