Stop overpaying for Microsoft 365 & Google Workspace.

Google Workspace storage is pooled, not per-person: every Business Starter license adds 30 GB to one organization-wide pool, and every Business Standard license adds 2 TB to that same pool (Google Workspace Admin Help, “Storage and upload limits for Google Workspace”). So a 20-person team on Starter shares just 600 GB total — Gmail, Drive, and Photos all draw from it — and one person with a big Drive library or years of attachments can eat most of it.

The reflex is to upgrade everyone to Standard, but that doubles the bill: Starter is $7/user/month and Standard is $14/user/month on an annual commitment, so upgrading all 20 seats costs $140/month extra, $1,680/year. Google lets an organization hold multiple editions and assign licenses per user (Google Workspace Help, “If you have multiple Google Workspace editions”), so upgrade only the heavy users: keep 18 people on Starter (540 GB) and move 2 heavy users to Standard (4 TB), for a pool of about 4.5 TB at $154/month — $126/month less than all-Standard, $1,512/year saved. The upgrade is worth it for the whole team only when the team actually needs Standard's other features (Meet recording, Gemini in Docs/Sheets/Meet, eSignature, mail merge) — storage alone is not a reason to double the bill.

The math (USD, annual commitment)

The decision rule

• Total org storage under the Starter pool and no need for Standard features → stay on Starter.
• A few heavy users push the pool over → upgrade only those users to Standard.
• Whole team needs Meet recording, Gemini across Docs/Sheets/Meet, or eSignature → all-Standard is the honest buy, not a storage play.

Step by step

1. Check actual usage first: Google Admin console → Storage shows the organization's total use against the pool. Upgrade nothing until you know the real number.
2. Find the heavy users: Admin console storage reporting shows per-user usage — the top two or three accounts usually hold most of the pool.
3. Buy Standard seats for just those users and assign them in Admin console → Directory → Users → Assign licenses (automatic license assignment covers only one edition, so assign the second edition's seats manually).
4. Re-check the pool after the change: 18 Starter seats plus 2 Standard seats is about 4.5 TB, and each further heavy user you upgrade adds another 2 TB.
5. Watch the caveat: Business editions cap at 300 users, and if storage keeps climbing past the mixed pool, Google also sells Additional Storage subscriptions (100 GB, 1 TB, 10 TB) — compare that against another Standard seat before upgrading everyone.

Prices verified October 27, 2026: Business Starter $7/user/month and Business Standard $14/user/month on an annual commitment (flexible month-to-month terms cost $8.40 and $16.80), per Google's Workspace pricing page; pooled storage of 30 GB per Starter user and 2 TB per Standard user, and per-user license assignment across multiple editions, per Google Workspace Admin Help. Monthly-commitment terms cost more than annual commitment.

Editorial note: pooled storage is the rare case where the per-user price comparison misleads — the pool is what you buy, so buy the pool you need, not the tier you assume.

Business Premium ($22/user/month, paid yearly) is Microsoft's security bundle for small business: everything in Business Standard, plus Defender for Business (endpoint detection and response), Intune device management, Entra ID P1 (Conditional Access), and Defender for Office 365 Plan 1. It's the right buy when you need that whole stack. But plenty of companies upgrade to Premium for exactly one reason: endpoint protection. If Defender for Business is the only Premium feature your team actually uses — no Intune-managed devices, no Conditional Access policies, no advanced email-threat policies — you can buy it on its own. Microsoft Defender for Business is available standalone at $3/user/month (paid yearly) for organizations up to 300 users, and it runs on the same detection engine as the enterprise Defender for Endpoint product. Business Standard ($14/user/month, paid yearly) plus standalone Defender for Business ($3/user/month) is $17/user/month — $5 less per user per month than Premium's $22, for the same desktop apps, mailbox, and endpoint protection.

The math (USD, annual commitment, with Teams)

The decision rule

• Need endpoint protection only → Standard + standalone Defender at $17.
• Need Intune device management, Conditional Access, or full Defender for Office 365 Plan 1 as well → Premium at $22 is the better buy, because those three bought separately cost far more than the $5 gap.
• Already on Premium? Check whether Defender for Business is actually onboarded before buying any third-party endpoint product — many Premium tenants pay for it and never deploy it.

Step by step

1. Check what Premium features you actually use: Microsoft 365 admin center — check Intune enrollment, Entra Conditional Access policies, and Defender portal activity. If only endpoint protection shows up, you're a Standard-plus-Defender candidate.
2. Buy Defender for Business standalone ($3/user/month) for the users who need endpoint protection — it covers up to 5 devices per user.
3. Move those users from Premium to Standard at renewal (or ask your CSP about credit/coterming — annual-commitment licenses don't automatically refund mid-term).
4. Onboard the devices in the Microsoft Defender portal and confirm the agents report in before you drop any third-party antivirus.
5. Watch the caveat: servers need separate licensing — Defender for Business user licenses don't cover servers, so budget for Defender for Servers if you have any.

Prices verified October 26, 2026: Business Standard ($14/user/month) and Business Premium ($22/user/month), paid yearly, and Microsoft Defender for Business standalone ($3/user/month, paid yearly), per Microsoft's own Microsoft 365 business pricing pages (microsoft.com). Business Standard does not include Defender for Business; Business Premium includes Defender for Business, Intune Plan 1, and advanced Entra ID. Monthly-commitment terms cost more than annual commitment.

Editorial note: this is the rare case where NOT buying the bundle wins — but only if endpoint protection is genuinely the one Premium feature in use. The moment you need Intune or Conditional Access, the $5 gap flips and Premium is the bargain.

Business Basic ($7/user/month, paid yearly) gives web and mobile Office apps, custom business email, Teams, SharePoint, and 1 TB of OneDrive — but no desktop apps. Microsoft 365 Apps for Business ($10/user/month, paid yearly) gives the desktop versions of Word, Excel, PowerPoint, and Outlook plus 1 TB of storage — but no Exchange email, no Teams, and no SharePoint. Companies that buy both for the same person to cover "email plus desktop apps" pay $7 + $10 = $17/user/month. Business Standard ($14/user/month, paid yearly) is everything in Basic plus the desktop apps, plus Loop, Clipchamp, Bookings, and Teams webinar hosting. So the stack costs $3/user/month more than the single license that covers the same needs and more.

The math (USD, annual commitment, with Teams)

The decision rule

• Needs company email AND desktop apps → Business Standard, full stop.
• Needs desktop apps but genuinely no company mailbox, Teams, or SharePoint (for example a contractor who works in their own email) → Apps for Business alone at $10 beats Standard by $4/user/month.
• Needs only web and mobile apps → stay on Basic at $7 and skip the desktop add-on entirely.

Step by step

1. Find the stack: Microsoft 365 admin center → Billing → Licenses, and look for users assigned both Business Basic and Microsoft 365 Apps for Business.
2. Check whether each of those users actually uses the company mailbox and Teams — if yes, they are Standard candidates; if no, they may be Apps-alone candidates.
3. Switch the license assignment to Business Standard (or to Apps alone where email is genuinely unused) and remove the stacked licenses.
4. Time the switch at renewal or ask your CSP about credit/coterming — annual-commitment licenses do not automatically refund mid-term, so do not assume the saving starts the day you click.
5. Verify after the switch: desktop apps still activate and the mailbox is untouched, since Standard includes the same Exchange Plan 1 mailbox.

Prices verified October 25, 2026: Business Basic $7/user/month and Microsoft 365 Apps for Business $10/user/month, paid yearly, per Microsoft's own pricing pages; Business Standard $14/user/month (with Teams) per Microsoft's July 1, 2026 list prices. Monthly-commitment terms cost more than annual commitment.

Editorial note: Apps for Business carries no Exchange, Teams, or SharePoint entitlement — that gap is exactly why the stack exists, and exactly why Standard wins whenever company email is in play.

Microsoft 365 Business plans (Basic, Standard, Premium) share one tenant-wide cap: at most 300 provisioned seats total across the whole Business family — not 300 per plan. Microsoft Learn's Business Premium FAQ states organizations may only provision up to 300 seats total across Business Basic, Business Standard, and Business Premium, gives the example that 250 Premium seats leave room for only 50 more Business seats in total, and says Microsoft reserves the right to enforce the 300-seat tenant limit.

The same FAQ confirms you can combine Business Premium with other subscription offerings, and that not everyone in the organization is required to hold Business Premium. Mixing Business and Enterprise licenses in one tenant is supported: a tenant can keep 300 Business Premium seats and license the users beyond that on E3 or E5.

So the day the company hires past seat 300, the reflex — migrate everyone to E3 — is also the expensive answer. The cap only binds the seats past it.

The math (USD, annual commitment)

The decision rule

• At the cap, buy Enterprise seats only for the overflow cohort — and choose that cohort by need (users who actually gain from E3: Windows Enterprise, Intune Plan 2, deeper compliance), not by whoever happens to be hired next.
• If the whole company genuinely needs E3's enterprise features, migrate on purpose and negotiate it. Don't let seat 301 make the decision for you.

Step by step

1. Count provisioned Business seats, not just active users. Microsoft 365 admin center → Billing → Your products, and add up provisioned Basic + Standard + Premium seats — the cap counts the whole family combined, so 250 Premium plus 50 Standard already fills it.
2. Pick the E3 cohort by role and need, not by hire order.
3. Buy E3 seats only for the overflow (through your CSP or the admin center) and assign them to that cohort; leave the existing 300 Business seats untouched.
4. Check endpoint coverage per cohort. Premium users sit under Defender for Business while E3 users sit under Defender for Endpoint Plan 1, so verify both baselines rather than assuming one policy covers everyone.
5. Line up the E3 purchase before you hit the wall. Once the cap binds, a new hire cannot be put on a Business plan, so onboarding waits on a purchase you haven't made.

Prices verified October 24, 2026: Business Premium $22/user/month and Microsoft 365 E3 $39/user/month (annual commitment; E3's list price took effect July 1, 2026). The 300-seat family-wide cap, the combination rule, and the 250-plus-50 example per Microsoft Learn's Microsoft 365 Business Premium FAQ; mixed Business/Enterprise tenants supported per Microsoft's Q&A guidance.

Editorial note: the cap counts provisioned seats, so unassigned Business licenses still eat the 300 — clean those up before you buy Enterprise seats you may not need.

When legal or compliance says "put a litigation hold on these mailboxes" — or when a user's archive is about to hit its ceiling — the reflex in most tenants is to upgrade those users to E3. At $39 per user per month on Microsoft's current list, that's a $468-per-seat-per-year reflex for a need that costs $3.

Microsoft's own licensing docs draw a much narrower line than most admins assume. To place an Exchange Online mailbox on litigation hold, Microsoft Learn requires either Exchange Online Plan 2 — or Exchange Online Plan 1 plus the Exchange Online Archiving add-on. That same combination unlocks auto-expanding archive storage up to 1.5 TB per user. The add-on is $3.00 per user per month, paid yearly, and it stacks onto the user's existing license — including the mail entitlement in Business Standard.

So the 15 or 20 people who need hold or big-archive coverage — executives, legal, finance — don't need E3's Intune, Defender, and Windows Enterprise riding along at $39 a head. They need a $3 line item.

The math (USD)

The decision rule, per user

• Needs hold/archive and already uses E3's Intune, Defender, or Windows Enterprise → keep E3.
• Needs hold/archive and nothing else from E3 → $3 add-on.
• Hold coverage needed for 100+ users with no E3 usage → the add-on still wins at list (100 users: $3,600/yr vs $46,800/yr) — but get a CSP quote; real pricing can change the shape of this.
• The compliance program needs auto-labeling, eDiscovery Premium, or insider risk → those are E5-side; don't let a $3 saving become a coverage gap.

Step by step

1. Buy the add-on. Microsoft 365 admin center → Billing → Purchase services → search "Exchange Online Archiving" → buy one seat per hold/archive user on annual commitment ($3/user/mo).
2. Assign it. Users → select the users → Licenses and apps → check the Exchange Online Archiving add-on. It stacks onto their existing license; nothing else changes.
3. Enable the archive mailbox. Exchange admin center → Recipients → Mailboxes → select the user → Others → Manage mailbox archive → enable. Or in Exchange Online PowerShell: Enable-Mailbox -Identity [email protected] -Archive.
4. Turn on auto-expanding. Per user: Enable-Mailbox -Identity [email protected] -AutoExpandingArchive. Whole organization: Set-OrganizationConfig -AutoExpandingArchive. Verify with Get-Mailbox [email protected] | Format-List AutoExpandingArchiveEnabled.
5. Place the litigation hold. Microsoft Purview compliance portal → Data lifecycle management → Exchange (legacy) → create the hold on the mailboxes. (Or the Exchange admin center for mailbox-level hold.)
6. Keep the license on. Holds and archives need the license continuously — audit license assignments at renewal before cleaning up "unused" seats.

Prices verified October 23, 2026: Exchange Online Archiving ($3.00/user/month, paid yearly) and Microsoft 365 E3 ($39.00/user/month, paid yearly, annual commitment) on Microsoft's pricing pages — E3's list price took effect July 1, 2026. Litigation-hold and auto-expanding-archiving licensing rules (Plan 2, or Plan 1 + Archiving add-on; 1.5 TB ceiling) per Microsoft Learn's Exchange Online limits and litigation-hold documentation. List prices are annual-commitment; monthly terms cost more.

Editorial note: two gotchas to avoid. First, removing the add-on disables the archive — so don't let a tidy-up pass at true-up remove licenses from mailboxes that have holds or archives attached. Second, the add-on expands archive storage, not the primary mailbox — if the primary mailbox itself is the problem, that's a different license conversation.

Microsoft 365 Copilot costs $30 per user per month, paid yearly. Most tenants bought it like an all-or-nothing benefit: everyone gets a seat or nobody does. But Microsoft sells a second way to pay for AI that most of those seats never needed.

Every eligible Microsoft 365 subscription already includes Microsoft 365 Copilot Chat at no additional charge — a web-grounded AI assistant with enterprise data protection. For occasional users — someone who asks AI a few questions a week, not someone drafting documents inside Word all day — that's the whole experience they actually use.

The in-between tier is the meter. Custom agents your organization builds (the HR policy bot in Teams, the IT helpdesk agent) bill for users without a Copilot seat on pay-as-you-go at $0.01 per Copilot Credit, billed through an Azure-linked billing policy. A typical lightweight agent run — a couple of classic and generative answers — costs a handful of credits, pennies per conversation.

The math (USD)

The decision rule, per user

• Lives in Word/Excel/Outlook/Teams with Copilot embedded daily → $30 seat.
• Occasional chat + the odd internal agent → Copilot Chat ($0) + PAYG meter.
• User's metered consumption approaching 3,000 credits/month → upgrade to the seat.
• Agents open to customers, the public, or unlicensed staff touching SharePoint data → always metered; budget it separately (prepaid 25,000-credit pack at $200/mo beats PAYG once tenant usage passes ~20,000 credits/mo).

Step by step

1. Segment your Copilot users. In the Microsoft 365 admin center, Copilot → Analytics shows who's actually using the seat daily vs occasionally.
2. Shrink the seat count. Keep seats for daily embedded users. Move occasional users to Copilot Chat — it's already included in their M365 subscription; sign in with the work account.
3. Set up the meter once. Admin center → Copilot → Cost management: create the billing policy (links your Azure subscription) that metered agent usage for Chat users bills through.
4. Set your own limit before users do. Spending policies ship with a preset limit — check it and set a threshold alert at a number you'd consider cheap, not painful. A limit of zero keeps the seat while disabling metered agent access.
5. Watch monthly. Anyone trending toward 3,000 credits/month gets promoted to a seat; anyone at a few hundred stays on the meter.

Prices verified October 22, 2026: Microsoft 365 Copilot add-on ($30/user/month, paid yearly) and Copilot Chat (included at no additional charge with eligible Microsoft 365 plans; custom org agents bill on a metered basis) on Microsoft's pricing pages. Pay-as-you-go at $0.01 per message/credit and the $200/month 25,000-message prepaid pack per Microsoft's Copilot Studio billing and licensing documentation.

Editorial note: The gotcha to avoid. Since October 2026 Microsoft is switching usage-based billing ON by default for new Microsoft 365 Copilot Business purchases (direct purchases from October 19; reseller/CSP purchases from December 1, 2026, per Microsoft's Partner Center announcements). The default spending limit is 4,000 credits per user per month — up to $40 per user per month at the $0.01 rate, on top of the seat — and the "auto-apply new services" setting is on, so future metered services join the policy without approval. Visit Copilot → Cost management before the next seat purchase, and set a limit you chose.

Every certified Teams Rooms system needs its own room license — and most organizations default to Teams Rooms Pro on all of them at $40 per room per month. But Microsoft ships a free tier, Teams Rooms Basic, that covers the core meeting experience: one-touch join, wireless content sharing, and the shared digital whiteboard. It costs $0, with a cap of 25 Basic-licensed rooms per organization.

Pro's $480 per room per year buys what Basic doesn't: intelligent audio/video like IntelliFrame, inclusive layouts like Front Row, and enterprise-grade management — remote configuration, device analytics, alerting, and ITSM integration. The question is whether your six-person huddle room, which just joins calls and shares screens, needs any of that. Usually, no.

The math (per room/month, USD, annual commitment)

The decision rule, per room

• Room only does one-touch join, wireless share, and whiteboarding → Basic, $0.
• Room needs Front Row, dual screens, or IntelliFrame intelligent video → Pro.
• You need remote config changes, alerts, peripheral health, or device analytics → Pro.
• Org total over 25 Teams Rooms → Basic caps at 25; plan the extra Pro seats.
• Teams panels → Pro (Basic can't be assigned to Teams panels).
• Never license the room device with a per-user E3/E5. Microsoft's licensing guidance says enterprise per-user suites aren't authorized for shared meeting devices — the room account gets Basic or Pro.

Step by step

1. List every Teams Rooms system. The Teams Rooms Pro Management portal shows the device list; cross-check against Billing → Licenses → Teams Rooms Pro in the admin center.
2. Tag rooms by function. Flagship boardrooms keep Pro; huddle rooms and phone booths that only join calls and share screens are Basic candidates.
3. Check Basic eligibility. Certified Teams Rooms device required, organization total at or under 25 rooms, and not a Teams panel.
4. Weigh monitoring needs. Since September 30, 2026, Teams device management lives in the Pro Management portal — Basic only gets the device list and automatic updates there. Rooms you never touch are fine; rooms that can't be down at 9 AM keep Pro.
5. Reassign at renewal. Move downgraded rooms to Basic, remove the Pro seats, and confirm the seat count drops at renewal.
6. Sweep quarterly. Decommissioned or renovated rooms keep billing if nobody removes the license — add license removal to the facilities closure checklist.

Prices verified October 21, 2026: Teams Rooms Basic (free, requires a certified Teams device, limited to 25 rooms per organization) and Teams Rooms Pro ($40/room/month, paid yearly) on Microsoft's Teams Rooms Plans and Pricing page. Pro features (AI-powered audio/video including IntelliFrame, inclusive video layouts including Front Row, remote configuration, device analytics, alerting, ITSM integration) from the same Microsoft page. Basic excludes Teams panels, and per-user enterprise suites are not authorized for shared meeting devices, per Microsoft's licensing guidance as analyzed by partner sources.

Editorial note: The two gotchas to avoid. (1) Basic's free tier is capped at 25 rooms per organization — room 26 needs Pro — and Basic can't be assigned to Teams panels. (2) Management moved on September 30, 2026: the Teams admin center no longer manages Teams devices; everything lives in the Teams Rooms Pro Management portal, where Basic only gets the device list and automatic updates. If a room breaking before a board meeting is your nightmare, that room keeps Pro.

An email address doesn't need a person behind it. But walk through most Microsoft 365 tenants and you'll find info@, careers@, billing@, events@ — even alert@ — each parked on a licensed account. Every one of those is a mailbox license with nobody sitting in the chair.

Microsoft's rule is refreshingly simple: a shared mailbox stores up to 50 GB with no license at all, and there's no cap on how many you can create. The people opening it still need their own Exchange Online license — the mailbox is free; the readers aren't.

The math (per user/month, USD, annual commitment)

The decision rule, per inbox

• Address belongs to no person and sends/receives → shared mailbox, $0.
• Mailbox already over 50GB → license it (Exchange Online Plan 2 at $8/mo raises the cap to 100GB).
• Litigation hold, in-place archive, or retention policies on it → license it appropriately (Plan 2, or Plan 1 plus the Exchange Online Archiving add-on).
• Someone signs in to it directly → that's a user mailbox and it needs a user license — keep access delegate-only.

Step by step

1. Find the ghost seats. In the admin center, go to Billing → Licenses and list every account with no real person behind it (info@, careers@, billing@, events@, noreply@, alert@).
2. Size each mailbox. Anything under 50GB converts cleanly; over 50GB, price Plan 2 or slim the mailbox first.
3. Create the shared mailbox (or convert the licensed account — Microsoft's own recommended pattern for leavers' mailboxes too).
4. Grant Full Access and Send As to the people who work the inbox.
5. Keep it delegate-only. Microsoft blocks direct sign-in on shared mailboxes by default; leave it blocked.
6. Remove the license from the old account and verify the seat count drops at renewal.

Prices verified October 20, 2026: Exchange Online Plan 1 ($4) and Plan 2 ($8) per user/month, annual commitment, on Microsoft's Exchange plans pricing page. Shared mailbox rules (50GB free without a license; Plan 2 for 100GB; Plan 2 or Plan 1 + archiving add-on for litigation hold/in-place archive; no direct sign-in; accessing users need their own license) from Microsoft Learn 'About shared mailboxes in Microsoft 365'.

Editorial note: The two traps to avoid: (1) converting a mailbox that's under litigation hold or a retention policy — license it instead and move deliberately; a license is cheap, losing the hold is not. (2) Letting someone log straight into the shared account — that's direct sign-in, which makes it a user mailbox again and it needs a license. Delegate access only.

If a slice of your workforce never sits at a desk — warehouse pickers, retail floor, drivers, manufacturing lines, clinical staff on the move — paying for their Microsoft 365 E3 seats is a tax, not a feature. Microsoft 365 F3, the frontline plan, is $10/user/month on annual commitment versus E3 at $39. That's a $29/month gap — $348 per worker per year — for people who don't open desktop apps.

What F3 actually covers (per Microsoft's own frontline plan comparison): full Teams chat/meetings/calls, Word/Excel/PowerPoint/OneNote for web and mobile (no desktop installs), a 2GB Exchange Kiosk mailbox, 2GB OneDrive, SharePoint access, Microsoft Shifts and Bookings, plus the IT wins that matter on shared devices — Intune device management, Entra ID P1, and Windows 11 Enterprise E3 upgrade rights.

The math (per user/month, USD, annual commitment, paid yearly)

The decision rule, per role

• Role never needs desktop Office, a big mailbox, or big OneDrive → F3.
• Needs email + document editing on phone/web → F3.
• Never sends email and only reads docs in Teams → F1 at $3 is even cheaper.
• Needs desktop Office or 50GB+ mailboxes → stay on E3 (or Business Standard for sub-300-seat orgs).

Step by step

1. Tag every seat “desk” vs “deskless.” Export your licensed-user list from the Microsoft 365 admin center and tag every seat “desk” vs “deskless.”
2. Run the F3 fit check on the deskless cohort. Confirm they pass: no desktop Office need, email volume fits a 2GB mailbox, files live in SharePoint not OneDrive. Note the screen-size rule: F3's mobile Office apps are licensed for devices with integrated screens of 10.9 inches or smaller — a laptop is outside scope.
3. Price it per cohort. Deskless seats at $10 (F3) vs $39 (E3), and run the annual total. Also check the $3 F1 for read-only roles with no real email need.
4. Reassign in the admin center. Microsoft allows mixing E3 and F3 inside one tenant — the license follows the worker, not the org chart.
5. Check scope compliance. F3 is licensed for frontline/qualified workers under Microsoft's licensing terms — it's a defined audience, not just “the cheap plan.” Document the roles you've classified.
6. Rerun at every renewal. July 1, 2026 raised F3 from $8 to $10 (a 25% jump — the steepest percentage move in the price change), so the E3–F3 gap is now $29 instead of $28. Still enormous.

Prices verified October 19, 2026: Microsoft 365 F3 ($10) and F1 ($3) per user/month, annual commitment paid yearly, on Microsoft's own frontline plans pricing page; E3 ($39) on Microsoft's enterprise plans pricing page. Feature inclusions (F3: web/mobile Office only, 2GB Exchange Kiosk mailbox, 2GB OneDrive, Teams, Intune, Entra ID P1, Windows 11 Enterprise E3 rights) from Microsoft's frontline plan comparison table. July 1, 2026 price changes (F1 $2.25→$3, F3 $8→$10, E3 $36→$39) corroborated by multiple partner analyses of Microsoft's announcement.

Editorial note: F3 is the biggest discount in the Microsoft catalog — a 74% cut — and that should make you check the fit twice, not skip the check. The 2GB mailbox and 2GB OneDrive are real ceilings; a deskless worker who emails like an office worker needs E3, not F3. And don't swing the other way: F1 at $3 is read-only Office and no real mailbox. Mis-assigning costs you a helpdesk ticket and a license swap, not money.

If your Microsoft 365 E3 tenant needs the premium security stack — risk-based identity, advanced email investigation, and endpoint EDR — the instinct is to buy each piece as an add-on. Run the October 2026 list prices and the stack prices itself out:

The stack, priced (per user/month, USD, annual commitment)

For $0.80 more per seat than the three-add-on stack, E5 adds Defender for Identity, Defender for Cloud Apps, Power BI Pro, Teams Phone, and the Purview premium tier (Insider Risk Management, eDiscovery Premium, Communication Compliance). Any one of those extras is worth more than eighty cents.

The decision rule, per user group

• One add-on needed → buy the add-on. $44–$49 vs. $60: no contest.
• Two add-ons needed → borderline. $54 vs. $60 — add-ons stay cheaper, but if the missing third capability is Defender for Endpoint P2, you're one threat away from buying it anyway.
• Three add-ons needed → E5 wins outright. The stack is $59.20; the suite is $60 and carries five more products.

And the honest footnote: none of this means upgrading everyone. The cheapest structure is almost always mixed licensing — E5 for admins, execs, and high-risk users; E3 (plus targeted add-ons) for the rest. Don't let a renewal quote put 300 people on E5 for a need that 40 people have.

Step by step

1. Inventory who actually needs what. In the Microsoft 365 admin center, list the real audiences: who needs risk-based Conditional Access and PIM (usually admins and execs — Entra P2), who needs Threat Explorer and automated investigation (security team and high-phishing-risk users — Defender for Office 365 P2), and how many devices need full EDR vs. basic protection (Defender for Endpoint P2).
2. Count capabilities per group, not per company. Most tenants have a "three-capability" cohort and a much larger "zero or one" cohort. That's the whole game.
3. Price each group both ways. E3 $39 + the add-ons its cohort actually needs vs. E5 $60 — per group, per user, per month. Annual commitment prices; monthly terms run ~20% higher.
4. Assign per user. Microsoft lets you mix E3 and E5 (and add-ons) inside one tenant. The license follows the need, not the org chart.
5. Rerun this at every renewal. Microsoft raised commercial list prices on July 1, 2026 (E3 $36→$39, E5 $57→$60, Entra P2 $9→$10). The E3–E5 gap held at $21, but the three-add-on stack got $4 more expensive while E5 rose only $3 — so any add-on-vs-suite math you did before July is stale.

Prices verified October 18, 2026: Microsoft 365 E3 ($39) and E5 ($60) list prices confirmed on Microsoft's own enterprise plans pricing page (annual commitment, paid yearly). Standalone add-on prices — Entra ID P2 ($10), Defender for Office 365 Plan 2 ($5), Defender for Endpoint Plan 2 ($5.20) — cross-checked against multiple October 2026 NCE price-list sources (o365hq, redresscompliance, trustedtechteam, G2). Feature inclusions (E5 bundles all three P2 products plus Defender for Identity and Defender for Cloud Apps) confirmed in Microsoft's own licensing FAQs. Your reseller or regional pricing may differ.

Editorial note: the suite is only a deal when the capabilities are used. If your "three-add-on cohort" is really one person with EDR needs and a security team that lives in Threat Explorer, buy two add-ons for a few seats and stay on E3 for the rest. The bundle math only favors E5 for users who genuinely need the stack.