Microsoft 365 E7

Advanced identity and access management: Conditional Access, group-based access management, and self-service password reset with on-premises write-back.

Enforce sign-in rules (require MFA, block legacy auth, require a compliant device, restrict by location) based on user, app, and risk signals.

Adds Identity Protection risk-based Conditional Access and Privileged Identity Management on top of Entra ID P1.

Automatically detect and respond to compromised credentials and risky sign-ins, and build Conditional Access policies that key off Microsoft’s calculated user/sign-in risk score.

Requires a second sign-in verification step (phone call, SMS, or app notification) in addition to a password.

Advanced identity and access management: Conditional Access, group-based access management, and self-service password reset with on-premises write-back.

Let users reset or unlock their own account without a help desk call. Basic cloud-only SSPR is available broadly; on-premises writeback (syncing the reset back to Active Directory) requires Entra ID P1.

Adds Identity Protection risk-based Conditional Access and Privileged Identity Management on top of Entra ID P1.

Grant admin roles just-in-time (time-bound, approval-gated activation) instead of standing access, with full activation audit history. A core Entra ID P2 entitlement, also obtainable via the standalone Entra ID Governance add-on.

Adds Identity Protection risk-based Conditional Access and Privileged Identity Management on top of Entra ID P1.

Periodically require an owner or the user themselves to re-certify continued need for group membership, app access, or a role assignment — access that’s no longer needed gets removed automatically.

Adds Identity Protection risk-based Conditional Access and Privileged Identity Management on top of Entra ID P1.

Bundle groups, apps, and SharePoint sites into a requestable "access package" with approval workflow and automatic expiration — including for external/guest users.

Cloud-based mobile device and application management — enroll, configure, and enforce compliance policies on company and personal devices.

Enroll, configure, and manage Windows, iOS, Android, and macOS devices: compliance policies, app deployment, and remote wipe.

Cloud-based mobile device and application management — enroll, configure, and enforce compliance policies on company and personal devices.

Provision and configure new Windows devices out of the box, straight from the cloud, with no imaging. Autopilot itself has no separate license line item — it’s an Intune-dependent deployment workflow, mapped here to Intune Plan 1 as the plan that actually enables managing the enrolled device afterward.

Cloud-based mobile device and application management — enroll, configure, and enforce compliance policies on company and personal devices.

Centrally enforce BitLocker drive encryption policy and escrow recovery keys. BitLocker itself ships with Windows Pro/Enterprise; cloud-based policy and key escrow specifically need Intune, mapped here as the enabling plan since there’s no dedicated BitLocker-management license line item.

Cloud-based print management that lets users print to registered printers without on-premises print servers.

Cloud-based print management — no print servers, printer drivers pushed and managed centrally, permissions via Entra ID.

The Windows 10/11 Enterprise operating-system upgrade entitlement bundled with qualifying Microsoft 365 plans.

Upgrade rights to the Enterprise edition of Windows (advanced security features like Credential Guard, and virtual desktop/VDA rights), on top of a device’s underlying Windows Pro license.

Endpoint detection and response, threat and vulnerability management, and attack surface reduction for Windows, macOS, Linux, iOS, and Android devices.

Endpoint detection and response: attack surface reduction, behavioral monitoring, and automated investigation/remediation for Windows, macOS, Linux, iOS, and Android devices.

Protects email and collaboration content from phishing, malware, and malicious links via Safe Links and Safe Attachments.

Protects mail and collaboration content from phishing and malware: Safe Links, Safe Attachments, and anti-phishing at Plan 1; adds automated investigation/response, attack simulation, and threat hunting at Plan 2.

Monitors on-premises Active Directory signals to detect compromised identities and malicious insider actions.

Monitors on-premises Active Directory signals (via a lightweight sensor on domain controllers) to detect compromised identities and lateral-movement/privilege-escalation attacks.

A lighter-weight cloud app discovery and control capability bundled into Office 365 E5 — a subset of the standalone Microsoft Defender for Cloud Apps.

A cloud access security broker (CASB): discovers shadow IT, and applies session/access policies across sanctioned SaaS apps. The Office 365-scoped tier only covers Microsoft 365 activity; the full product extends that policy control to third-party cloud apps.

Retention labels and policies that keep content an organization needs and delete content it doesn't, on a defined schedule.

Keep or delete content on a schedule, org-wide or by label, across Exchange, SharePoint, OneDrive, and Teams — for regulatory retention requirements or simply to reduce stale-data risk.

Advanced eDiscovery search, review, and analysis tools, including machine-learning-assisted review, for legal and compliance investigations.

Search, hold, and export content across mailboxes, SharePoint, OneDrive, and Teams for a legal or investigative matter. Standard covers search/export; Premium adds review sets, custodian management, and analytics (near-duplicate detection, email threading, predictive coding).

Manual sensitivity labeling for Office documents and email to classify and protect content.

Classify and protect content (encryption, watermarking, access restriction) by applying labels users pick or that get applied for them. Manual, user-applied labeling is the base tier; automatic labeling (content is scanned and labeled without user action) needs the higher tier.

Extends Microsoft Purview Audit with a longer retention window and additional high-value audit log events for forensic investigations.

A searchable log of user and admin activity across Microsoft 365. Standard covers 180 days of retention and core events; Premium extends retention to a year (with add-ons to 10 years), adds high-value crucial events (mailbox access, mail-forwarding-rule changes), and higher log bandwidth for faster forensic investigation.

Detects and helps investigate risky user activity such as data theft or policy violations, using signals from across Microsoft 365.

Detect and act on risky user activity (data theft before resignation, policy violations, security-control evasion) using signals across Microsoft 365, correlated into investigable alerts.

Reporting on sensitivity-label usage and information-protection activity across the tenant.

Visibility into where labeled/sensitive content actually lives and how it moves (Content Explorer, Activity Explorer) — distinct from Sensitivity Labels itself, which covers creating and applying the labels; this is the reporting/analytics layer on top.

Manages regulatory, legal, and business-critical records through their full retention and disposition lifecycle.

Classify content as an official business record with a defensible retention/disposition schedule, event-based retention, and disposition review before deletion.

Scans internal and external communications for policy violations such as harassment, regulatory breaches, or sensitive-data sharing.

Scans internal and external communications (Teams, Exchange, third-party connectors) for policy violations — harassment, regulatory/insider-trading language, sensitive-data sharing — and routes matches to reviewers.

Lets an organization supply and control its own encryption keys for Microsoft 365 data at rest.

Supply and control your own encryption keys for Microsoft 365’s at-rest data encryption layer, so Microsoft can’t access your content without your key.

Requires explicit customer approval before a Microsoft engineer can access content to resolve a support request.

Online appointment scheduling and calendar management for customer-facing bookings.

A public-facing, self-service appointment-scheduling page synced to staff calendars — common for clinics, salons, and internal 1:1 scheduling.

A browser-based video editor for trimming, combining, and exporting video content.

Browser-based video editor for quick marketing, training, and social clips — templates, stock media, and text-to-speech built in.

Portable, collaborative components and workspaces that stay in sync everywhere they are shared across Microsoft 365 apps.

Portable, live-synced content blocks (Loop components) that stay updated everywhere they’re shared — in Teams chat, Outlook, or a Loop workspace.

Task and project management with boards, buckets, and assignments for team-based work tracking.

Kanban-style task boards for team work, integrated with Teams and Microsoft 365 Groups.

A seeded entitlement for building and running custom low-code business apps, bundled into qualifying Plan 3-tier subscriptions.

The Power Apps and Power Automate usage rights included at no extra cost with most Microsoft 365/Office 365 plans — enough to build apps and flows against Microsoft 365 data. Premium connectors, per-app/per-user plans, and Dataverse capacity are separate, purchasable Power Platform licenses not covered here.

The core Viva Engage (formerly Yammer) community and communication experience integrated into Microsoft 365.

The employee-experience platform surfacing engagement, community, and knowledge-sharing (Viva Engage, the modernized Yammer) inside Microsoft 365. Viva has several separately licensed modules (Insights, Learning, Goals, Glint) beyond this core.

Lets meeting participants dial in by phone instead of connecting over the internet.

Cloud-based call control (hold, transfer, forward, voicemail) that turns Microsoft Teams into a phone system — external calling requires a calling plan or an existing telephony connection.

Make and receive PSTN phone calls, transfer, and hold directly inside Teams — replacing a traditional PBX. Needs a calling plan or Direct Routing/Operator Connect to actually reach the phone network.

Create, share, and collaborate on Power BI reports and dashboards with other Pro-licensed users.

Publish, share, and collaborate on Power BI reports and dashboards org-wide (free/per-user Power BI can view and build but not share without Pro or Premium capacity).