Microsoft 365 E3 EEA (no Teams)

Advanced identity and access management: Conditional Access, group-based access management, and self-service password reset with on-premises write-back.

Enforce sign-in rules (require MFA, block legacy auth, require a compliant device, restrict by location) based on user, app, and risk signals.

Requires a second sign-in verification step (phone call, SMS, or app notification) in addition to a password.

Advanced identity and access management: Conditional Access, group-based access management, and self-service password reset with on-premises write-back.

Let users reset or unlock their own account without a help desk call. Basic cloud-only SSPR is available broadly; on-premises writeback (syncing the reset back to Active Directory) requires Entra ID P1.

Cloud-based mobile device and application management — enroll, configure, and enforce compliance policies on company and personal devices.

Enroll, configure, and manage Windows, iOS, Android, and macOS devices: compliance policies, app deployment, and remote wipe.

Cloud-based mobile device and application management — enroll, configure, and enforce compliance policies on company and personal devices.

Provision and configure new Windows devices out of the box, straight from the cloud, with no imaging. Autopilot itself has no separate license line item — it’s an Intune-dependent deployment workflow, mapped here to Intune Plan 1 as the plan that actually enables managing the enrolled device afterward.

Cloud-based mobile device and application management — enroll, configure, and enforce compliance policies on company and personal devices.

Centrally enforce BitLocker drive encryption policy and escrow recovery keys. BitLocker itself ships with Windows Pro/Enterprise; cloud-based policy and key escrow specifically need Intune, mapped here as the enabling plan since there’s no dedicated BitLocker-management license line item.

Cloud-based print management that lets users print to registered printers without on-premises print servers.

Cloud-based print management — no print servers, printer drivers pushed and managed centrally, permissions via Entra ID.

The Windows 10/11 Enterprise operating-system upgrade entitlement bundled with qualifying Microsoft 365 plans.

Upgrade rights to the Enterprise edition of Windows (advanced security features like Credential Guard, and virtual desktop/VDA rights), on top of a device’s underlying Windows Pro license.

Manual sensitivity labeling for Office documents and email to classify and protect content.

Classify and protect content (encryption, watermarking, access restriction) by applying labels users pick or that get applied for them. Manual, user-applied labeling is the base tier; automatic labeling (content is scanned and labeled without user action) needs the higher tier.

Reporting on sensitivity-label usage and information-protection activity across the tenant.

Visibility into where labeled/sensitive content actually lives and how it moves (Content Explorer, Activity Explorer) — distinct from Sensitivity Labels itself, which covers creating and applying the labels; this is the reporting/analytics layer on top.

Online appointment scheduling and calendar management for customer-facing bookings.

A public-facing, self-service appointment-scheduling page synced to staff calendars — common for clinics, salons, and internal 1:1 scheduling.

A browser-based video editor for trimming, combining, and exporting video content.

Browser-based video editor for quick marketing, training, and social clips — templates, stock media, and text-to-speech built in.

Task and project management with boards, buckets, and assignments for team-based work tracking.

Kanban-style task boards for team work, integrated with Teams and Microsoft 365 Groups.

A seeded entitlement for building and running custom low-code business apps within Microsoft 365.

The Power Apps and Power Automate usage rights included at no extra cost with most Microsoft 365/Office 365 plans — enough to build apps and flows against Microsoft 365 data. Premium connectors, per-app/per-user plans, and Dataverse capacity are separate, purchasable Power Platform licenses not covered here.

The core Viva Engage (formerly Yammer) community and communication experience integrated into Microsoft 365.

The employee-experience platform surfacing engagement, community, and knowledge-sharing (Viva Engage, the modernized Yammer) inside Microsoft 365. Viva has several separately licensed modules (Insights, Learning, Goals, Glint) beyond this core.