Feature matrix
Every capability, every plan.
The full Microsoft 365 security feature matrix across identity, device, data and AI, mapped to Business Basic through E7. Hover any tick for the licence detail.
| Capability | Biz Basic | Biz Standard | Biz Premium | E3 | E5 | E7 |
|---|---|---|---|---|---|---|
| Identity | ||||||
| Multi-factor authentication | ||||||
| Conditional AccessEntra ID P1 — Business Premium, E3, E5 | — | — | ||||
| Self-service password reset + writebackEntra ID P1 | — | — | ||||
| Passwordless & passkeys (FIDO2)Included with Entra ID (all plans) | ||||||
| Identity Protection (risk detection)Entra ID P2 — E5 or the P2 add-on | — | — | — | — | ||
| Privileged Identity Management (PIM)Entra ID P2 — E5 or the P2 add-on | — | — | — | — | ||
| Access reviews & entitlement managementEntra ID P2 | — | — | — | — | ||
| Entra ID Governance (lifecycle workflows)Entra ID Governance add-on, or E7 | — | — | — | — | — | |
| Zero-trust access for BYOD / contractors (ZTNA)Entra Suite add-on (on P2), or E7 | — | — | — | — | — | |
| Device | ||||||
| Intune MDM & MAMIntune — Business Premium, E3, E5 or EMS | — | — | ||||
| Windows Autopilot & managed SOEIntune | — | — | ||||
| Compliance policies + Conditional AccessIntune + Entra ID P1 | — | — | ||||
| App protection / BYOD MAMIntune | — | — | ||||
| Next-gen AV & attack surface reductionE3, or Defender for Business on Premium | — | — | ||||
| Defender for Endpoint EDR (P2)E5, Defender for Endpoint P2 add-on, or Defender for Business (≤300) | — | — | — | |||
| Application control (WDAC / App Control for Business)Built into Windows (no licence) | — | |||||
| Endpoint Privilege Management (EPM)Intune Suite add-on (or EPM standalone), included in E7 | — | — | — | — | — | |
| Update rings & patch governanceIntune | — | — | ||||
| Data | ||||||
| Sensitivity labels (manual)Business Premium / E3 | — | — | ||||
| Automatic & default labellingE5 or the E5 Compliance add-on | — | — | — | — | ||
| DLP for Exchange, SharePoint, OneDrive, TeamsBusiness Premium / E3 | — | — | ||||
| Endpoint DLPE5 or the E5 Compliance add-on | — | — | — | — | ||
| Insider Risk ManagementE5 or the E5 Compliance add-on | — | — | — | — | ||
| Communication ComplianceE5 or the E5 Compliance add-on | — | — | — | — | ||
| Purview Privileged Access ManagementE5 or the E5 Compliance add-on | — | — | — | — | ||
| Retention, records & eDiscoveryStandard from E3 | — | — | ||||
| Cloud & Apps | ||||||
| Defender for Office 365 P1 (Safe Links / Attachments)Business Premium or E5 (P1 add-on on E3) | — | — | — | |||
| Defender for Office 365 P2 (Explorer, attack simulation, AIR)E5 or the Defender for Office 365 P2 add-on | — | — | — | — | ||
| Defender for Cloud Apps (CASB)E5, E5 Security, or the MDCA add-on | — | — | — | — | ||
| App governance (OAuth app risk)Defender for Cloud Apps (E5 / MDCA add-on) | — | — | — | — | ||
| SaaS security posture (SSPM)Defender for Cloud Apps (E5 / MDCA add-on) | — | — | — | — | ||
| Defender for Cloud (CSPM / workload protection)Azure consumption-billed — not in the Microsoft 365 plan ladder | — | — | — | — | — | — |
| AI & Copilot | ||||||
| Microsoft 365 CopilotCopilot add-on (on a qualifying base), included in E7 | — | — | — | — | — | |
| Copilot data-security foundationE5 or the E5 Compliance add-on | — | — | — | — | ||
| DSPM for AI (Purview AI Hub)E5 or the E5 Compliance add-on | — | — | — | — | ||
| Agent 365 — AI agent governanceBundled in the E7 step-up | — | — | — | — | — | |
Included in plan — Needs a step-up or add-on
Indicative mapping of Microsoft 365 commercial plans, simplified for planning. Microsoft changes packaging and naming frequently and exact entitlements depend on your agreement and region. A dash often means the capability is still reachable via an add-on, see the licensing selector for the exact step-up, or the cost calculator to price it. Not licensing advice; we confirm specifics in a Microsoft 365 health check.