Short answer: Microsoft 365 divides into licence families — Business, Enterprise, Education, Frontline (Firstline/Kiosk), Government, and Copilot-specialty — each aimed at a different user type and admin need. Pick the family that matches your user roles, then choose the SKU in that family that supplies the Defender, Purview or Azure AD features you require.
Quick answer and where the answer stops
Direct answer: Choose the licence family that matches who your users are and what they must do. Then pick a SKU inside that family that gives the security, device management and compliance features those users need.
- Business: for small and many mid-sized companies; simple admin and cost-effective bundles. Some Business SKUs include desktop Office; others are web-only.
- Enterprise: for larger organisations or where advanced identity, threat protection and compliance are required. Enterprise SKUs scale beyond Business limits and expose richer Azure AD, Purview and Defender options either in-bundle or as add-ons.
- Education: for faculty, staff and students; pricing and classroom features vary. Staff often get desktop Office; student plans are frequently web-first.
- Frontline / Firstline / Kiosk: low-cost, task-worker plans with limited features, often web- or mobile-first and designed for shared devices.
- Government: Enterprise-like features with procurement and data-residency terms suited to public-sector contracts.
- Copilot-specialty: AI assistant licensing sold as an add-on or included in some higher bundles; it layers on existing Microsoft 365 services.
Boundary: this article explains how to decide and compare features. Exact SKU names, mailbox sizes, OneDrive quotas, Defender bundling and regional availability change over time. Verify current SKU details on Microsoft Docs, the admin console for your tenant or through your reseller before you buy.
Comparison criteria: what matters when choosing a Microsoft 365 licence
Direct answer: Use the same practical checklist to compare SKUs: user and device licensing rules, desktop versus web Office, email limits, storage, device management, endpoint protection, compliance, Azure AD level, and add-on compatibility.
Apply these checks to every SKU you consider.
- User seat and device rules: per-user vs per-device, seat caps, device-only accounts.
- Desktop vs web Office apps: whether downloadable, updateable desktop apps are included or only web/mobile clients.
- Email and mailbox size: Exchange Online inclusion, mailbox quota, archive and retention features.
- Storage: OneDrive per-user quota and SharePoint site storage and retention controls.
- Device management (Intune) and MDM: Intune enrollment rights and depth of endpoint management (corporate device, BYOD, shared device).
- Endpoint protection (Defender family): which Defender products are included and whether they are bundled or require add-ons.
- Compliance and eDiscovery (Purview): basic DLP, legal hold, advanced audit, eDiscovery and insider-risk features.
- Azure AD feature level: Free, P1 or P2 features (Conditional Access, PIM, Identity Protection).
- Add-on compatibility and upgrade paths: whether Phone System, Audio Conferencing, Defender suites, Copilot or advanced Purview require add-ons or a higher SKU.
Why these matter: they affect cost, operations and regulatory fit. Compare SKUs against each criterion and map which users need which capabilities before you buy.
Compact differences: licence families and core feature matrix
Direct answer: This compact table highlights where each family places core features: Office apps, Exchange, Teams, SharePoint/OneDrive, Intune, Defender, Purview, and seat limits. Use it to spot obvious gaps quickly.
| Criterion | Business family | Enterprise family | Education family | Frontline / F3 | Government | Copilot add-ons |
|---|---|---|---|---|---|---|
| Desktop Office apps included | Some Business SKUs include desktop apps; some are web-only | E3/E5 include desktop apps; E1 is web-only | Varies; staff often get desktop apps; student SKUs often web-first | Mostly web/mobile; desktop installs uncommon | Parity with Enterprise but with compliance tailoring | Depends on base SKU |
| Exchange (email) | Included in many Business SKUs; some SKUs exclude Exchange | Included in E1/E3/E5; higher SKUs add archive and retention | Included for staff; student access varies | Often limited or excluded | Included with data-residency controls | Copilot does not replace Exchange |
| Teams | Included across families; advanced telephony varies by SKU | Included; telephony via add-ons or E5 | Included with education policies | Included but feature-limited | Included with compliance options | Copilot integrates with Teams when permitted |
| SharePoint & OneDrive | Basic inclusion; quotas vary by SKU | Full inclusion; larger storage and retention in Enterprise | Education-specific sharing and storage rules | Limited quotas and sharing | Included with government compliance terms | Copilot can surface permitted content |
| Intune / device management | Full Intune in Business Premium only | Available in Microsoft 365 Enterprise bundles | Intune for Education or equivalent bundles | Limited MDM | Enterprise-level MDM with compliance | Copilot does not provide device management |
| Defender / Endpoint protection | Business Premium includes Defender for Business | Defender for Endpoint/Office 365 included or addable; E5 bundles more XDR | Education SKUs include appropriate Defender variants | Minimal endpoint protection | Enterprise-grade Defender with compliance | Defender is separate from Copilot |
| Compliance / Purview | Basic compliance only; advanced Purview generally not included | Advanced Purview, audit and eDiscovery available in E5 or as add-ons | Education compliance variants | Limited compliance tooling | Enhanced compliance for public sector | Copilot is governed by Purview policies |
| Typical seat/device limits | Targets small/mid companies; Business has seat caps historically (verify) | Scales for large orgs without small-seat caps | Tied to eligible faculty/staff and student counts | For task workers; low-cost per user | For government customers with certified controls | Copilot licensed per-user or tenant |
Differences in words: Business keeps costs down but omits many advanced security and compliance features. Enterprise adds identity controls, threat protection and Purview at higher cost. Frontline cuts desktop apps and many management features to lower price. Education and Government adjust eligibility and compliance.
Tradeoffs: what each family gives up
Direct answer: Each family reduces or omits some capabilities to meet price or scope goals. Know the tradeoffs so you map licences to user needs.
Business family tradeoffs:
- Gives up advanced Purview, Azure AD P2 and some Defender XDR capabilities unless you buy add-ons or move to Enterprise.
Enterprise family tradeoffs:
- Costs more and requires more admin effort; it supplies full identity, compliance and Defender toolsets.
Education family tradeoffs:
- Offers special pricing and classroom tools but may restrict desktop apps or advanced compliance without higher SKUs.
Frontline family tradeoffs:
- Limits desktop Office, device management and compliance tooling to keep per-user cost low. Assign higher-tier licences to managers and knowledge workers.
Government family tradeoffs:
- Matches Enterprise features but adds procurement and compliance steps that can slow deployment.
Copilot tradeoffs:
- Adds AI assistance but requires a base licence that grants access to tenant content and appropriate compliance controls. Copilot does not replace Defender or Purview and is subject to your governance settings.
Decision section: who should pick which option and why
Direct answer: Match the minimal licence family to each scenario’s security, device management and compliance needs. If you need E5-class security or advanced Purview, start at E3 and add E5 security or upgrade to E5.
- Small office, 5–50 knowledge workers — Business Standard or Business Premium.
- Why: Business Standard gives desktop Office, Exchange, Teams and SharePoint. Choose Business Premium for Intune and Defender for Business.
- Growing midmarket, 50–1,000 users needing stronger security — E3 or Microsoft 365 E3; add E5 security or move to E5.
- Why: E3 adds identity and compliance controls. Add Defender or Purview features or upgrade to E5 for bundled XDR and advanced compliance.
- Regulated industries (healthcare, finance) — Microsoft 365 E5 or E3 plus E5 security/compliance add-ons.
- Why: Regulated organisations often require advanced Purview, advanced audit and Defender XDR; E5 bundles these. Adding E5 security to E3 stages costs.
- Education institution — Education SKUs (A1/A3/A5 or equivalents).
- Why: Education SKUs match school pricing and roles. Assign faculty/admin higher SKUs for desktop apps and compliance; students can use web-first plans.
- Frontline/retail staff on shared devices — Frontline / F3 or Kiosk.
- Why: Lower-cost, web/mobile-first access with lightweight management. Give managers and knowledge workers higher licences.
- Organisations adding Copilot — Keep an Enterprise or appropriate Business base licence and add Copilot per-user or tenant.
- Why: Copilot needs base services and permission to surface tenant content. Validate compatibility and governance before purchase.
If you need Azure AD P2 (Conditional Access, Identity Protection, PIM), make sure your SKU includes it or buy Azure AD P2 separately.
Map common scenarios to recommended licence families and SKUs
Direct answer: Use the minimal family that meets your scenario’s needs. If you require E5 security or advanced Purview, plan from E3 and add or upgrade to E5.
- Small office (5–50 knowledge workers): Business Standard or Business Premium.
- Recommendation: Business Standard for desktop Office and core services; Business Premium if you need Intune and Defender for Business.
- Growing midmarket (50–1,000): E3 or Microsoft 365 E3, step to E5 or buy E5 security add-ons.
- Recommendation: E3 baseline; add Defender for Endpoint/Office 365 or move to E5 for bundled XDR and Purview.
- Regulated healthcare or finance: Microsoft 365 E5 or E3 + E5 security/compliance add-ons.
- Recommendation: Prefer E5 where advanced Purview and Defender integration are mandatory.
- Education (students, faculty, admin): Education SKUs (A1/A3/A5 equivalents).
- Recommendation: Faculty/admin A3/A5 for desktop apps and compliance; students often use A1 web-first.
- Frontline/retail staff with shared devices: Frontline / F3 or Kiosk.
- Recommendation: Use frontline licences for task workers and assign managers E3/E5 as needed.
- Hybrid org wanting Copilot: Keep E3/Microsoft 365 E3 or appropriate Business SKU and add Copilot per-user/tenant.
- Recommendation: Validate Copilot compatibility with your base SKU and your Purview governance settings before purchase.
These are starting points. Confirm Azure AD P2 needs and device-enrolment plans before finalising licences.
Add-ons and step-up/upgrade paths: what to buy when
Direct answer: Buy add-ons for specific gaps: Defender for Office 365, Defender for Endpoint, Azure AD Premium, Purview features, Phone System, Audio Conferencing, and Copilot. Use trials to validate before committing.
Common add-ons and when to use them:
- Defender for Office 365: add for advanced phishing, safe attachments and safe links beyond standard filtering.
- Defender for Endpoint: add for advanced XDR/EDR and automated response on managed devices.
- Azure AD Premium P1/P2: add for Conditional Access, Identity Protection or PIM when not included.
- Microsoft Purview / Compliance add-ons: add for advanced eDiscovery, insider risk or advanced audit needs.
- Phone System and Audio Conferencing: add for PSTN calling features if not included.
- Microsoft 365 Copilot: buy per-user or tenant when users need AI drafting and knowledge work and governance is confirmed.
Step-up and upgrade paths:
- From Business to Enterprise: move users to E3/E5 when seat counts or advanced needs exceed Business capabilities.
- From E3 to E5: add E5 security/compliance or upgrade to E5 for bundled billing and parity.
- Trials: use trial tenants to validate identity integration, mail migration and policy behavior before wide purchase.
Buyer's checklist and common pitfalls to avoid
Direct answer: Before purchase, verify current SKU names and features, check regional availability and seat limits, map who needs desktop Office, confirm Intune rights, document Defender and Purview needs, run trials, and automate license reclamation.
Checklist before purchase:
- Verify current SKU names and exact feature lists on Microsoft Docs or your tenant admin console.
- Confirm regional availability, data residency and procurement rules for Government SKUs.
- Check seat and device limits for Business SKUs; if you expect growth, consider Enterprise early.
- Map which users need desktop Office versus web-only and plan license assignment rules.
- Confirm Intune/MDM enrollment rights if you plan device management; some Business SKUs lack full Intune.
- Decide Defender and Purview needs early; adding E5 features later can cost more per-user than consolidating on E5.
- Test sample users in a trial tenant to surface identity and migration issues.
- Audit inactive accounts and automate license reclamation to avoid paying for unused seats.
- Validate telephony needs; Phone System and Audio Conferencing may be add-ons.
Common pitfalls:
- Buying a lower-cost SKU that lacks required Intune or Defender features.
- Underestimating compliance add-on costs for regulated workloads.
- Assuming Copilot or other premium features are included with base SKUs.
- Mixing many SKU families without clear assignment rules, increasing operational overhead.
Frequently Asked Questions
Do Business SKUs ever include Defender or Intune?
Direct answer: Yes, some Business SKUs include limited Defender features and Business Premium includes device-management rights such as Intune. Full Intune and the enterprise Defender suites are typically part of Enterprise licences or sold as separate add-ons. Confirm the current inclusions on Microsoft Docs or your tenant admin console.
Can I mix Business and Enterprise licences in the same tenant?
Direct answer: Yes. You can mix licence families in a single tenant, but doing so raises administrative complexity and can create policy gaps. Define allocation rules, test Conditional Access and group-based licensing, and document who gets which licence before you deploy widely.
When should I choose E5 instead of E3 plus add-ons?
Direct answer: Choose E5 when you need the full bundled set of advanced security, analytics and compliance features—advanced Purview, unified Defender XDR and Azure AD P2. E5 can simplify billing and sometimes costs less than buying multiple separate add-ons. Do a current cost comparison against Microsoft pricing for your seat counts.
Where should I verify current SKU inclusions and pricing?
Direct answer: Verify SKU contents, regional availability and pricing on Microsoft Docs product pages, the admin console for your tenant, or through your Microsoft partner or reseller. Microsoft changes SKU packaging and availability, so always confirm live information before purchasing.