Microsoft 365 E3 vs E5: the three cliff edges that actually justify the uplift

The E3 to E5 conversation is usually had backwards. People compare feature lists, decide E5 looks better, and then discover the uplift was justified by two capabilities they could have bought as a much cheaper add-on. Work from the cliff edges instead.

What E3 already covers

More than most people assume, which is why the uplift often fails to pay for itself. On the compliance side alone, E3 covers Audit (Standard), manual sensitivity labelling, retention label creation, and retention policies scoped organisation-wide, location-wide, or with include and exclude lists.

If your compliance requirement is “retain mail for seven years and be able to search it”, E3 does that. No uplift required.

The three cliff edges that actually justify E5

These are the points where E3 genuinely stops rather than merely doing less.

Where the money usually is, and it is not the uplift

One line in Microsoft’s service description is worth more than most licensing reviews. For shared locations such as SharePoint sites, Microsoft 365 Groups and Teams channel messages, users holding owner or member roles need the licence. Users with visitor or view-only roles do not.

In an estate with a large read-only population, that single distinction is often larger than the E3 to E5 delta you were arguing about.

Two things that fail without telling you

Most licensing gaps present as a blocked button. These two do not, which is why they survive licensing reviews.

Customer Key reverts to default encryption. Data encryption policies apply at tenant level, so the tenant needs at least as many Customer Key licences as it has users assigned Exchange or Teams licences, whichever is greater, with SharePoint counted separately. Microsoft validates periodically. If you are short, encryption quietly falls back to the default service encryption while the configuration stays exactly where you left it.

Shared and resource mailboxes need licences to receive several features, despite nobody signing into them. Inactive mailboxes do not. Estates that lean on shared mailboxes accumulate silent non-coverage this way.

Auditing what you already own

Do this before any renewal conversation. SKU display names are unreliable and marketing names change; service plan names do not.

1# Requires Microsoft.Graph.Identity.DirectoryManagement.
2Connect-MgGraph -Scopes ‘Organization.Read.All’
3
4Get-MgSubscribedSku -All |
5    Select-Object SkuPartNumber,
6                  @{ n = ‘Purchased’; e = { $_.PrepaidUnits.Enabled } },
7                  ConsumedUnits,
8                  @{ n = ‘Unused’;    e = { $_.PrepaidUnits.Enabled – $_.ConsumedUnits } },
9                  @{ n = ‘Waste%’;    e = {
10                        if ($_.PrepaidUnits.Enabled -gt 0) {
11                            [math]::Round( (($_.PrepaidUnits.Enabled – $_.ConsumedUnits) / $_.PrepaidUnits.Enabled) * 100, 1 )
12                        } else { 0 }
13                  } } |
14    Sort-Object Waste% -Descending |
15    Format-Table -AutoSize

Anything above roughly 10 per cent unused is either a migration remnant or a renewal nobody questioned. Fix that before you argue about tiers.

What I would do

Write down the three capabilities you will genuinely operate in the next six months. Find each one in Microsoft’s service description and read the exact plan column rather than a comparison chart. Two of the three are usually already covered by E3.

If the third is a compliance capability, price Purview Suite against E5 before committing. If it is Defender P2 or Entra ID P2, E5 is probably the cleaner answer. Either way, run the headroom script first, because unused licences are found money and they do not require a negotiation.