Microsoft 365 Licensing Demystified: What You're Actually Paying For

The problem no one talks about

Microsoft 365 is the most widely deployed productivity platform in ASEAN business. Most organisations have it. Very few know what they actually have.

The licensing structure has expanded significantly over the past decade. What began as Office in the cloud is now a layered ecosystem of productivity tools, device management, security controls, compliance infrastructure, and AI capability, all bundled differently depending on which plan sits on your invoice each month.

The result is predictable. Businesses on Business Basic assume they have desktop Office. They don't. Businesses on Business Standard assume their devices are managed. They're not. Businesses on Business Premium are paying for a full endpoint security suite, and running Trend Micro alongside it because nobody told them they already had Defender.

This guide covers the four plans most relevant to ASEAN businesses, Basic, Standard, Premium, and E3, and what actually differentiates them. Not the marketing copy. The features that determine whether your business has the security, compliance, and productivity capability it needs.

The four plans that matter for ASEAN businesses

Microsoft organises its plans into Business (capped at 300 users) and Enterprise (no cap). For most ASEAN businesses in the S$5M–S$100M revenue range, the relevant decision is across these four:

All USD prices post-July 2026 at annual commitment. SGD conversion at S$1.35/USD, actual SGD pricing via local CSP resellers may vary. All prices exclude GST.

The plans nobody talks about: F1, F3, and F5 for frontline workers

If your business has a shop floor, a warehouse, a restaurant kitchen, a hotel front desk, or field engineers, you almost certainly have two kinds of workers using Microsoft 365 under the same licence. That's one of the most consistent and expensive mistakes in ASEAN licensing.

A retail associate in a Singapore shopping mall does not need what a finance manager in the same company needs. She needs to check her shift schedule, swap a shift with a colleague, send a quick message to the floor supervisor, and maybe log a stock issue. Giving her a Business Standard licence at $14/month to do that is paying $11 more per user per month than necessary. Across 80 shop floor staff, that's S$14,000 a year in pure overspend.

Microsoft has a set of plans built specifically for this cohort: F1, F3, and the F5 security add-on. They're marketed as "frontline worker" plans and they're chronically under-used in ASEAN, partly because local CSP partners don't always surface them, and partly because customers don't know to ask.

F5 is an add-on to F1 or F3, not a standalone plan. F5 Security ($17) and F5 Compliance are available separately. Total cost: F1 + F5 = $20/user/mo; F3 + F5 = $27/user/mo.

What F1 actually gives you

F1 is designed for deskless workers who live on a mobile device or a shared terminal. The core use case is Teams: messaging, calling, the Shifts app for scheduling, Walkie Talkie (push-to-talk over internet), and Task management via Microsoft Planner. SharePoint is read-only. There are no desktop Office apps. Importantly, F1 does not include an Exchange Online mailbox by default. If your frontline workers don't need email at all (shift workers often don't), this is fine. If they do, F3 is the right step.

What F3 adds and when you need it

F3 at $10/month adds an email mailbox, full web and mobile Office apps, full SharePoint access, and a richer Teams experience. The right trigger for F3 over F1 is straightforward: does this person need to send and receive business email? If yes, F3. Field service engineers reporting to managers, healthcare support staff communicating with clinic admin, hotel supervisors coordinating with other departments. All F3.

The F5 add-on: when frontline workers need enterprise security

The F5 Security and Compliance add-on exists because the security gap for frontline workers is real and often overlooked. Shared tablets in a retail store. Kiosks in a logistics hub. Mobile phones used across multiple shifts. These are exactly the environments where device management, endpoint security, and access controls matter most, and they're the environments where they're most often absent.

F5 adds Defender for Endpoint (EDR on shared devices), Defender for Office 365 Plan 2 (safe links and attachments), Microsoft Intune (device management for shared and BYOD), Purview compliance features, and elements of Entra ID P2 for risk-based access. For regulated environments like healthcare or financial services with frontline staff, F3 + F5 at $27/month is typically the right configuration. Without F5, shared device environments have no MDM, no device compliance policy, and no way to enforce a wipe if a tablet goes missing.

Copilot Business: AI for the rest of us

Microsoft 365 Copilot has been positioned as an enterprise product since it launched in 2023 at $30 per user per month. That price point put it out of reach for most ASEAN SMEs without a serious conversation about ROI, which most businesses weren't having. That changed in 2026.

Microsoft 365 Copilot Business is the SMB version. It's an add-on for Business plan customers, priced at $21 per user per month (with a promotional rate of $18 through December 2026). And from July 2026, Microsoft made bundled SKUs permanent, so you can now buy a plan that includes Copilot from day one rather than bolting it on later.

Copilot Business ($21) and Enterprise Copilot ($30) are different SKUs with different eligibility requirements. Business plan customers cannot purchase the $30 Enterprise version. Enterprise plan customers cannot purchase Copilot Business at $21. Promotional pricing subject to change.

What Copilot actually does day to day

The honest answer: it's an AI assistant built into the apps your team already uses. Not a separate product to log into, not a chatbot window on the side. It's in Word, Excel, Outlook, Teams, and PowerPoint, and it works with your actual company data in Microsoft 365 rather than the public internet.

In Outlook, it drafts emails from bullet points, summarises long threads, and adjusts tone. In Teams, it captures meeting notes and action items even if you weren't in the call. In Word, it turns rough notes into a first draft. In Excel, it answers data questions in plain English. These aren't capabilities that require you to change how you work. They layer on top of what people are already doing and reduce the time each task takes.

Microsoft's internal research puts average time saving at around 1.2 hours per week per user. For a 50-person team that's meaningful. For a 200-person organisation it starts to look significant on a cost basis. Whether that holds in your specific context depends heavily on how much of your team's time goes to the kinds of tasks Copilot accelerates: email, meetings, document drafting, and data summarisation.

How to actually evaluate it without wasting money

Buying Copilot for your entire team on day one is the wrong approach and most businesses who did it regretted the spend. The right approach is a structured pilot. Pick 10 to 15 people whose jobs involve the highest volume of email and meetings. Run it for 60 days. Track the time they spend on specific tasks before and after. If it's not saving them meaningful time, you'll know quickly and you haven't committed 200 seats.

The add-on model supports this: you can buy Copilot Business for a subset of users without changing everyone's base licence. That's the right starting point.

What each plan actually includes

The table below covers the features that matter most to ASEAN businesses, not every SKU detail, but the capabilities that drive real decisions around security, compliance, and productivity.

What you're already paying for but probably not using

Microsoft 365 is one of the most feature-rich platforms in enterprise software. It is also one of the most consistently underutilised. Most organisations activate email and Teams on day one, and the rest of the platform sits dormant while they pay for competing tools that do the same thing.

The pattern repeats across ASEAN at every company size: a business on Business Standard at $14 per user per month pays $168 per user per year while running Calendly, Zoom, Zapier, Miro, and a separate file sharing service. Each of those tools costs money. Every one of them has a direct equivalent already in the licence.

• 📅
  Microsoft Bookings

  Already in Standard+ · commonly replaced by Calendly or Doodle
  Standard+
• 🎥
  Microsoft Teams Meetings + Webinars

  All plans · commonly replaced by Zoom (Teams webinars with registration from Standard+)
  All plans
• 📁
  OneDrive (1TB per user) + SharePoint

  All plans · commonly replaced by Dropbox Business ($15/user/mo) or Google Drive
  All plans
• 📋
  Microsoft Forms

  All plans · commonly replaced by SurveyMonkey or Typeform
  All plans
• ⚡
  Power Automate (basic connectors)

  All plans · commonly replaced by Zapier or Make
  All plans
• 🤍
  Microsoft Whiteboard

  All plans · commonly replaced by Miro (from $10/user/mo)
  All plans
• 🔄
  Microsoft Loop

  Standard+ · collaborative workspace commonly replaced by Notion
  Standard+
• 🎬
  Clipchamp (video editor)

  Standard+ · light video editing commonly done in Canva or Adobe
  Standard+
• 🛡️
  Microsoft Defender for Business (endpoint security)

  Premium only · commonly duplicated by Trend Micro, Kaspersky, Sophos, Bitdefender
  Premium only
• 📱
  Microsoft Intune (device management)

  Premium only · commonly replaced by Jamf (Mac), or absent entirely for BYOD
  Premium only

Where ASEAN businesses are over-licensed

Over-licensing is common and takes several predictable forms. Research from CoreView suggests 56% of enterprise Microsoft 365 licences are inactive, oversized, or unassigned. The patterns in ASEAN SMEs are similar, and tend to cluster around a handful of causes.

Where the real risks hide

Under-licensing is less visible than over-licensing and considerably more consequential. The organisation believes it has a security or compliance capability that its licence does not actually provide.

The ASEAN compliance context

Microsoft 365 licensing decisions in ASEAN carry compliance dimensions that are not always reflected in generic global guidance. The relevant frameworks differ by country and sector, but the licensing gaps that create compliance risk are consistent.

Singapore PDPA

The Personal Data Protection Act requires organisations to implement reasonable security arrangements to protect personal data. Where the PDPA has teeth in the licensing context: the absence of DLP policies (not available below Business Premium), sensitivity labels to classify personal data (not available below Premium), and audit trails to demonstrate appropriate access controls (90 days only on Basic/Standard) creates a gap between policy commitment and technical capability. An organisation with a data protection policy but no DLP, no classification, and no meaningful audit trail is making a promise it has no mechanism to keep.

MAS Technology Risk Management Guidelines

For Singapore financial institutions, MAS TRM requirements include specific expectations around access control (Conditional Access is relevant here), software patch management (Intune is relevant here), monitoring and audit logging (extended audit in E3 is relevant here), and data protection. Financial services entities on Business Standard are typically not meeting the technical control expectations of MAS TRM without supplementary tooling, and often are not aware of it.

The multi-country ASEAN dimension

ASEAN businesses with staff across Singapore, Malaysia, Indonesia, and the Philippines face varying data residency requirements. Malaysia's PDPA 2010 imposes similar personal data obligations to Singapore's. Indonesia's Peraturan Pemerintah Nomor 71/2019 imposes data residency requirements for certain categories of data. E3 provides more granular Microsoft Purview controls for managing cross-border data flow. Business Standard has none of these controls.

Matching the licence to the role

The most significant cost optimisation in most ASEAN organisations is not moving everyone up, it's moving some users down while moving the right users up. The role-based model below applies the right plan to each use case.

Why Business Premium is the most under-deployed plan in ASEAN

Business Premium deserves specific attention because it represents the clearest case of a plan whose value is systematically misunderstood.

At $22 per user per month, Business Premium costs 57% more than Business Standard. That premium buys three capabilities that Standard does not have: Microsoft Intune for device management, Microsoft Defender for Business for endpoint security, and Entra ID P1 with Conditional Access for identity and access policy enforcement.

In the context of what organisations typically spend separately on those three capabilities, enterprise MDM solutions, endpoint security software, and identity management, the bundled cost in Premium is consistently lower. A 50-person organisation running separate Jamf ($10/device), Trend Micro ($5/user), and no dedicated Conditional Access tooling is spending more on those three products than the cost difference between Standard and Premium across the whole user base.

Microsoft held Business Premium's price unchanged in the July 2026 restructure, while Basic and Standard both increased. The effective gap between Standard and Premium narrowed from $9.50/month to $8/month. The security capability included in Premium is now, in relative terms, the best it has ever been compared to what you pay for Standard.

Extending Business Premium with add-ons: Purview and Defender suites

One of the more significant changes in 2025 is that Business Premium customers no longer have to jump to E3 to get serious compliance capability. Microsoft released two SMB-specific add-on suites that can be layered on top of Business Premium.

When Business Premium is not enough: the case for E3

E3 at $39/month is not an upgrade from Premium on security, for organisations under 300 users, their security capability is now broadly comparable. The differentiator is compliance depth, and the seat cap.

The cases where E3 makes sense over Premium are specific:

The organisation is approaching or has exceeded 300 users. Business plans are hard-capped. At 300 seats you cannot add a single additional Business Plan licence. The migration to Enterprise plans becomes necessary regardless of any other consideration.

The organisation operates under regulatory requirements that mandate email archiving, eDiscovery, or advanced DLP. MAS-regulated financial institutions, legal firms subject to Singapore Law Society guidelines, and healthcare providers under the National Electronic Health Record framework typically need capabilities that only E3 provides: unlimited email archive, legal hold, eDiscovery search and export, and advanced retention policies under Microsoft Purview.

The organisation needs extended audit log retention beyond 90 days. E3 extends to 180 days or more. For regulatory reporting and incident investigation, 90 days is frequently insufficient.

Business plans vs Enterprise plans: the structural decision

The choice between the Business plan stack (Basic, Standard, Premium) and the Enterprise plan stack (E1, E3, E5) is commonly framed as a seat count decision. The 300-user cap forces organisations past that threshold to migrate regardless of any other consideration. But the more important dimension is architectural: what compliance platform, identity stack, and security operations capability does the organisation actually need?

Business plans are designed for simplicity. Fixed feature sets, straightforward admin, no volume licensing complexity. Microsoft 365 Apps for Business (the Office suite included in Standard and Premium) is licensed per user and tied to the Business plan family. The admin experience is intentionally simplified. For an organisation of 20 to 150 staff without dedicated IT and without complex regulatory obligations, Business plans are the right fit, and Business Premium, at $22/month, covers the security baseline adequately for most of that cohort.

Enterprise plans offer structural flexibility that Business plans do not. You can mix licences across your user base, some users on E1 for basic access, most on E3, executives or finance staff on E5, and manage this through a single tenant. Enterprise plans also unlock Microsoft 365 Copilot eligibility, the full Microsoft Purview compliance platform, Microsoft Viva, and Microsoft Defender XDR. These are not available on Business plans regardless of price.

When E3 is not enough: the case for E5

Microsoft 365 E5 at $60 per user per month is not an incremental upgrade from E3. It is a different category of capability, one built for organisations that need a full security operations platform, deep insider risk controls, or advanced identity protection. E7 exists above E5 (covered in the next section) but is designed specifically for organisations deploying AI at scale, E5 remains the right enterprise ceiling for organisations not yet at that stage.

The capabilities E5 adds over E3 that matter most to ASEAN businesses fall into three areas.

Advanced security operations

Defender for Office 365 Plan 2 (included in E5) adds attack simulation training, automated investigation and response (AIR), threat hunting, and threat intelligence feeds. This is relevant for organisations running a security operations function, or wanting to. Defender for Identity monitors on-premises Active Directory for lateral movement, privilege escalation, pass-the-hash, and Kerberoasting attacks. Microsoft Defender XDR provides unified extended detection and response across identity, endpoints, email, and cloud apps in a single console. At E3 level, these capabilities are absent; the security posture is defensive but not active.

Advanced identity protection

Entra ID P2 (included in E5, not in E3) introduces two capabilities that move identity security from reactive to proactive. Privileged Identity Management (PIM) implements just-in-time admin access, admin roles are not permanently assigned but activated on demand with approval workflows and time limits. This eliminates persistent privileged accounts, which are the primary target in the majority of enterprise breaches. Entra ID Protection (also P2) adds risk-based Conditional Access: sign-ins are scored for risk in real time and automatically challenged, stepped up, or blocked based on that score.

Advanced compliance and insider risk

E5 or the E5 Compliance add-on ($12/user/month on top of E3) unlocks Insider Risk Management, Communication Compliance, Advanced eDiscovery with predictive coding and review sets, and Advanced Audit with one-year log retention and critical event logging. These are discussed in detail in the Purview section below.

Microsoft 365 E7: the Frontier Suite and the agentic AI era

Microsoft 365 E7, also called the Frontier Suite, became generally available on 1 May 2026. At $99 per user per month it is the biggest change to the Microsoft 365 licensing stack since E5 launched in 2015, and it is built around a fundamentally different premise. E5 was built for the cloud era. E7 is built for what Microsoft calls the agentic AI era: a world where AI agents work alongside people, taking actions, managing tasks, and running multi-step workflows autonomously.

For most ASEAN organisations, E7 is not a near-term decision. For large enterprises, financial institutions, conglomerates, professional services firms above 500 users, it warrants serious evaluation at the next EA renewal.

What E7 adds over E5

E7 is not a new platform. It is a bundle of existing products, plus one genuinely new component, all wrapped into a single SKU at a price lower than buying the parts separately.

The bundle saves $18 per user per month versus buying all components separately. At 1,000 users that is $216,000 per year, relevant at enterprise scale, less meaningful when evaluating whether individual business units need the full stack.

Agent 365: the genuinely new component

Agent 365 is the one component in E7 that does not exist in any other plan. It is a unified control plane for managing AI agents, the automated processes that can book meetings, process requests, triage communications, and execute multi-step workflows without human involvement at each step.

As organisations deploy more of these agents, through Microsoft Copilot Studio, Power Automate, or third-party AI platforms integrated with Microsoft Graph, IT and security teams need a way to manage them with the same rigour applied to human users. Agent 365 provides identity management for agents (they get Entra identities and access policies), governance (what data can an agent access, under what conditions), and compliance guardrails (Purview policies applied to agent-generated content and communications).

Microsoft's stated position is that AI agents should be licensed and managed like employees: they need identities, access controls, and audit trails. Agent 365 is the commercial mechanism that makes that governance framework operational.

The Entra Suite additions in E7

E5 includes Entra ID P2. E7 includes the full Entra Suite, which adds five capabilities that matter at enterprise scale:

• 🔐
  Entra Private Access

  Zero Trust Network Access (ZTNA) for on-premises applications. Replaces legacy VPN with Conditional Access-controlled application tunnels. No code changes to existing apps required.
• 🌐
  Entra Internet Access

  Cloud-delivered Secure Service Edge (SSE). Routes traffic through Microsoft's global network with web content filtering, threat protection, and Conditional Access integration. Complements or replaces legacy web proxies.
• 🔄
  Entra ID Governance

  Automates joiner, mover, and leaver identity lifecycle. Handles provisioning workflows, access reviews, and prevents over-permissioning. Reduces manual IT overhead in organisations with high staff movement across roles and entities.
• 🛡️
  Entra ID Protection (extended)

  ML-based risk detection with deeper integration for hybrid Active Directory environments. Extends the leaked credential and sign-in risk capabilities in P2 with broader signal correlation.
• 🪪
  Face Check with Verified ID

  Decentralised identity verification using Microsoft Authenticator and live camera verification against government-issued IDs. Relevant for high-assurance onboarding and privileged access scenarios.

Who should consider E7

Microsoft Purview: the compliance platform most organisations ignore

Microsoft Purview is the umbrella platform for data governance, compliance, and risk management within Microsoft 365. It replaced the old Microsoft 365 Compliance Center and Azure Purview branding in 2022, and is now the single surface where information protection, regulatory compliance, data lifecycle management, and insider risk all live.

For most ASEAN businesses on Business Standard or even Business Premium, Purview is a name on a slide deck and nothing more. The capabilities are either unlocked by the licence or they're not, and if they're not configured, they deliver nothing regardless of what's technically available. Understanding what Purview includes at each tier, and why the higher tiers exist, changes how you think about the E3-to-E5 decision.

What Purview includes by licence tier

Dark web monitoring and identity risk: what M365 actually provides

Dark web monitoring is a term commonly used by security vendors to describe the practice of watching breach databases, paste sites, and criminal forums for stolen credentials belonging to your domain. It is also a capability that many organisations pay for separately through third-party services, while the same function is already available within their Microsoft 365 stack, if they have the right licence.

Microsoft's implementation sits within Entra ID Protection, which is part of Entra ID P2. Entra ID P2 is included in Microsoft 365 E5, or available as a standalone add-on at approximately $6 per user per month. It is not included in E3 or in any Business plan.

How Entra ID Protection works

Entra ID Protection continuously evaluates sign-in risk and user risk using a combination of signals. Leaked credential detection is one of those signals: Microsoft operates a global threat intelligence operation that aggregates compromised credential data from breach datasets, criminal marketplaces, and security research. When a user's credentials appear in these sources, their account is flagged as high-risk in Entra ID Protection.

The response to that flagged risk is automatic and configurable. With Entra ID P2 and appropriate Conditional Access policies in place, a high-risk user is forced to change their password immediately on next sign-in, or their access is blocked pending remediation. The organisation does not need to manually monitor a dashboard, the risk-based policy handles it.

The full identity risk stack by licence

Third-party dark web monitoring services

Products marketed specifically as "dark web monitoring", HaveIBeenPwned for Business, BreachWatch (Keeper Security), SpyCloud, and similar, monitor breach databases for your domain and alert when credentials appear. These are useful standalone tools for organisations without E5 or Entra ID P2, and some provide more granular reporting than Entra ID Protection's default dashboard. However, they typically do not close the loop automatically: they alert, and a human must take action. Entra ID Protection with risk-based Conditional Access closes the loop automatically, compromised credentials trigger enforced remediation without manual intervention.

For organisations on Business Premium or E3 that want dark web credential monitoring without moving to E5, the Entra ID P2 standalone add-on at approximately $6 per user per month is the most direct route. It adds leaked credential detection, risk-based Conditional Access, and PIM in one licence addition, without requiring a full E5 migration.

How to audit your current position

The Microsoft 365 Admin Centre provides usage data that makes a licence audit straightforward in principle, and consistently avoided in practice. The information that matters most:

Checklist: before your next renewal

• Know your renewal date and the NCE commitment window. Microsoft's New Commerce Experience locks annual subscriptions. Downgrades or tier changes mid-term carry cancellation limitations. Any audit needs to conclude before your next annual renewal.
• Pull your 90-day usage report from Microsoft Admin Centre. Flag every user with zero activity across email, Teams, and SharePoint. Inactive licences are the lowest-effort cost reduction available.
• Verify Conditional Access is enforced, not just enabled. If you are on Business Premium, check that Conditional Access policies are active in Entra ID. Buying Premium and leaving CA policies unconfigured is common and leaves the most valuable security control unused.
• Check which security features are active vs. available. Defender for Business deployed to endpoints? Intune compliance policies configured? DLP policies created and active? A Premium licence with none of these configured is paying for security theatre.
• Map every third-party tool against your M365 entitlements. Zoom, Dropbox, Calendly, Zapier, Miro, Trend Micro, Jamf, Mimecast, check each against what your current plan provides before next renewal.
• Segment your user population by role, not by organisation. Not everyone needs the same plan. Identify your light users, your frontline workers, and your high-risk roles. Right-size each segment.
• Assess compliance obligations against your current plan. Finance, Legal, and HR functions handling regulated data should be on Premium at minimum, and E3 if email archiving or eDiscovery is required. Check this against MAS TRM, PDPA, and any sector-specific requirements.
• Review DLP policy coverage. On Premium, confirm DLP policies cover email, SharePoint, and OneDrive for your most sensitive data categories, employee personal data, customer PII, financial records. On Standard or Basic, acknowledge this gap exists and document the risk or plan to address it.
• Confirm licence ownership for Meraki-managed environments. If using a CSP partner, confirm that licences are registered to your organisation's tenant, not the partner's. A change of CSP partner should not require a licence migration.
• Evaluate Business Premium seriously before moving to E3. For organisations under 300 users whose primary driver is security rather than compliance archiving, Premium at $22 delivers comparable security to E3 at $39. Run the cost comparison with your specific user mix before defaulting to E3.