Microsoft 365 E5 Compliance

A cloud access security broker (CASB) that discovers shadow IT and applies access and session controls to third-party cloud apps.

A cloud access security broker (CASB): discovers shadow IT, and applies session/access policies across sanctioned SaaS apps. The Office 365-scoped tier only covers Microsoft 365 activity; the full product extends that policy control to third-party cloud apps.

Retention labels and policies that keep content an organization needs and delete content it doesn't, on a defined schedule.

Keep or delete content on a schedule, org-wide or by label, across Exchange, SharePoint, OneDrive, and Teams — for regulatory retention requirements or simply to reduce stale-data risk.

Advanced eDiscovery search, review, and analysis tools, including machine-learning-assisted review, for legal and compliance investigations.

Search, hold, and export content across mailboxes, SharePoint, OneDrive, and Teams for a legal or investigative matter. Standard covers search/export; Premium adds review sets, custodian management, and analytics (near-duplicate detection, email threading, predictive coding).

Adds automatic and recommended sensitivity labeling on top of Information Protection for Office 365 Standard's manual labeling.

Classify and protect content (encryption, watermarking, access restriction) by applying labels users pick or that get applied for them. Manual, user-applied labeling is the base tier; automatic labeling (content is scanned and labeled without user action) needs the higher tier.

Extends Microsoft Purview Audit with a longer retention window and additional high-value audit log events for forensic investigations.

A searchable log of user and admin activity across Microsoft 365. Standard covers 180 days of retention and core events; Premium extends retention to a year (with add-ons to 10 years), adds high-value crucial events (mailbox access, mail-forwarding-rule changes), and higher log bandwidth for faster forensic investigation.

Detects and helps investigate risky user activity such as data theft or policy violations, using signals from across Microsoft 365.

Detect and act on risky user activity (data theft before resignation, policy violations, security-control evasion) using signals across Microsoft 365, correlated into investigable alerts.

Reporting on sensitivity-label usage and information-protection activity across the tenant.

Visibility into where labeled/sensitive content actually lives and how it moves (Content Explorer, Activity Explorer) — distinct from Sensitivity Labels itself, which covers creating and applying the labels; this is the reporting/analytics layer on top.

Manages regulatory, legal, and business-critical records through their full retention and disposition lifecycle.

Classify content as an official business record with a defensible retention/disposition schedule, event-based retention, and disposition review before deletion.

Scans internal and external communications for policy violations such as harassment, regulatory breaches, or sensitive-data sharing.

Scans internal and external communications (Teams, Exchange, third-party connectors) for policy violations — harassment, regulatory/insider-trading language, sensitive-data sharing — and routes matches to reviewers.

Lets an organization supply and control its own encryption keys for Microsoft 365 data at rest.

Supply and control your own encryption keys for Microsoft 365’s at-rest data encryption layer, so Microsoft can’t access your content without your key.

Requires explicit customer approval before a Microsoft engineer can access content to resolve a support request.