Enterprise Mobility + Security pricing options
Choose the version that best suits your organization.
Take your business further with Microsoft 365 Enterprise
Microsoft 365 brings together Microsoft 365 apps, Windows 11, and Enterprise Mobility + Security. It combines best-in-class productivity apps with intelligent cloud services to transform the way you work.
| ||
| Enterprise Mobility + Security E3 | Enterprise Mobility + Security E5 | |
|---|---|---|
| ||
| Identity and access management |  |  |
| Simplified access management and security | | |
| Multifactor authentication | | |
| Conditional access | | |
| Advanced security reporting | | |
| Windows Server Client Access License (CAL)** | | |
| Risk-based conditional access | | |
| Privileged identity management | | |
| Endpoint management | | |
| Mobile application management | | |
| Advanced Microsoft 365 data protection | | |
| Integrated PC management | | |
| Integrated on-premises management | | |
| Remote help-desk support | | |
| Advanced endpoint analytics | | |
| Secure per-app mobile VPN | | |
| Specialty device management | | |
| Firmware-over-the-air updates | | |
| Information protection | | |
| Persistent data protection | | |
| Document tracking and revocation | | |
| Encryption key management per regulatory needs | | |
| Intelligent data classification and labeling | | |
| Identity-driven security | | |
| Microsoft Advanced Threat Analytics2 | | |
| Microsoft Defender for Cloud Apps | | |
| Microsoft Defender for Identity | | |
Frequently asked questions
-
Enterprise Mobility + Security E5 includes advanced identity, security, and information protection capabilities as part of Microsoft’s comprehensive approach to securing the modern enterprise. Some E5 capabilities were previously available only as standalone products, such as Microsoft Cloud App Security, Microsoft Entra ID Protection, Microsoft Entra Privileged Identity Management, and Microsoft Purview Information Protection.
Note: Advanced Microsoft Intune Suite capabilities — including Endpoint Privilege Management (EPM), Cloud PKI, and Enterprise App Management — are included with Microsoft 365 E5, not Enterprise Mobility + Security E5. -
No, Microsoft doesn't offer an E5 discount for existing E3 customers.
-
Both technologies assist in the goal of data loss prevention and are complementary. Microsoft Purview Information Protection helps ensure that data you are working on is classified, labelled, and protected based on business data policies. Microsoft 365 offers similar capabilities, but from within Microsoft 365 services: Microsoft Exchange and Microsoft SharePoint. Use these technologies together to achieve combined, significant levels of data protection.
-
Microsoft Intune, included with Enterprise Mobility + Security, lets you manage Microsoft 365 mobile apps so you can maintain the rich, productive Microsoft 365 user experience while Intune helps keep your corporate data secure. Additionally, Microsoft Entra ID, used by Microsoft 365, enhances Enterprise Mobility + Security by including features like self-service password reset, group membership, and advanced machine learning-based security and usage reporting.
-
Intune provides mobile device and application management across popular platforms: Windows, Mac OS X, Windows Phone, iOS, and Android. When Intune is connected with Microsoft Intune Configuration Manager in a hybrid configuration, you can also manage Macs, Unix and Linux servers, and Windows Server machines from a single management console.
EMS E3 and E5 also include advanced endpoint management capabilities — Remote Help for secure help-desk sessions, Advanced Analytics for proactive device insights, and Intune Plan 2 (includes Microsoft Tunnel for MAM, specialty device management, and firmware-over-the-air updates) — helping IT scale operations, strengthen Zero Trust, and protect end-user productivity.
-
Some Enterprise Mobility + Security E5 components are available for purchase separately, including Microsoft Entra ID and Intune. The Microsoft Intune Suite and its individual components (such as Endpoint Privilege Management, Cloud PKI, and Enterprise Application Management) also remain available as add-ons. As of July 1, 2026, Intune Advanced Analytics, Remote Help, and Intune Plan 2 are included in EMS E3 and E5 at no additional cost. The components are designed to work together, and purchasing the suite represents a better value compared to purchasing individual components.
- [1] Once your paid subscription begins, cancellation policies vary based on your status as a new customer and your product and domain selections on Microsoft. Learn more. Cancel your Microsoft 365 subscription any time by going to the Microsoft 365 admin center. When a subscription is canceled, all associated data will be deleted. Learn more about data retention, deletion, and destruction in Microsoft 365.
- [2] Microsoft Advanced Threat Analytics (ATA) ended mainstream support on January 12, 2021. Extended Support will continue until January 2026. Find additional information here.
- [*] Open estimated retail per-month pricing. Pricing is in US dollars and can vary by country. Volume discounts are also available. To receive a quote, contact your partner or Microsoft representative.
- [**] Customers purchasing Windows Server CAL agreements, Microsoft Configuration Manager, System Center Endpoint Protection, Microsoft Active Directory Rights Management Services CALs via the Microsoft Enterprise volume licensing agreements may purchase the Enterprise Mobility + Security add-on offer.
Follow Microsoft 365