From the blog

Microsoft 365 E5 vs E3 vs F3: How to Know If Your Users Have the Right License

May 2026• 10 min read•By Michel Martins de Araujo

The most expensive mistake in Microsoft 365 licensing isn't buying too many licenses. It's buying the wrong licenses — and then not realising it for twelve to thirty-six months, until the Enterprise Agreement comes up for renewal and someone finally asks why the bill is what it is.

License rightsizing is the process of matching the license tier to actual user need. In theory, it's straightforward. In practice, it's one of the most consistently mismanaged areas of IT cost management in multinational organizations — not because IT teams don't care, but because the tools to do it properly don't exist natively in Microsoft 365, and the process of doing it manually doesn't scale.

This article gives you the practical framework for rightsizing Microsoft 365 licenses across E5, E3, Business Premium, E1, and F3 — including how to identify which users are in the wrong tier, what the financial impact looks like at scale, and how to build a review process that doesn't require a consultant every time the question comes up.

Why Rightsizing Is Harder Than It Sounds

The standard advice for license rightsizing is simple: look at what features each user actually uses, and assign the minimum license that covers those features. If a user only uses Outlook and Teams, they don't need E5. Give them E1. Save money.

The problem with this advice is that it ignores three realities of enterprise IT.

Reality 1: You don't have easy visibility into per-user feature usage.

Microsoft provides usage analytics — the Microsoft 365 Usage Reports in the Admin Center, and the more detailed data available via the Graph API. These reports show aggregate usage patterns across your tenant, and per-user activity data for specific workloads. But interpreting that data in the context of license tier decisions requires knowing not just what users are currently using, but what they might need, what their role requires, and whether low usage reflects the license being unnecessary or the feature being underutilised but valuable.

Reality 2: License decisions are rarely made based on individual user need.

In most organizations, licenses are assigned by role or department, not by individual. Everyone in Sales gets E3. Everyone in Operations gets E1. Senior leadership gets E5 because someone decided that's appropriate for their level. These categorical decisions make administration easier but create systematic over-licensing for large portions of the user base.

Reality 3: License tiers include overlapping features in non-obvious ways.

Microsoft's licensing structure is genuinely complex. E5 includes everything in E3 plus additional security, compliance, and analytics features. E3 includes everything in E1 plus desktop Office apps and additional compliance features. F3 is a separate track designed for frontline workers, with different access patterns and lower cost. Business Premium overlaps with E3 in some areas and not others, depending on organisation size.

Understanding where the value difference between tiers actually lies — for your specific user population — requires deeper knowledge of the Microsoft licensing stack than most IT managers have time to develop.

The Microsoft 365 License Tiers Explained for Rightsizing

Before examining who belongs in which tier, here's the practical breakdown of what each tier actually provides — focused on the features that drive real usage decisions, not the full marketing comparison.

Microsoft 365 F3 (formerly F1) — €8.00/user/month*

Designed for frontline workers: retail staff, warehouse workers, field technicians, healthcare workers without a primary desk.

What it includes that matters:

Teams (mobile-first, no persistent chat on shared devices)
Exchange Online (2GB mailbox — limited but functional for basic email)
SharePoint and OneDrive (limited storage)
Office mobile apps (view and edit on mobile devices)
Intune (device management)

What it does NOT include:

Desktop Office applications (Word, Excel, PowerPoint installed on PC)
Full Exchange mailbox (50GB)
Yammer, Stream, advanced compliance

Who belongs here: Users who work primarily from mobile devices, shared workstations, or don't need full desktop Office. Retail assistants, warehouse staff, field technicians, reception staff.

Who doesn't belong here despite being assigned here: Any user who regularly works from a PC and needs desktop Office applications. This is a common over-downgrade — organizations trying to save costs by putting desktop workers on F3, then having to deal with the consequences.

Microsoft 365 E1 — €8.80/user/month*

The entry-level cloud-only plan for knowledge workers.

What it includes that matters:

Teams (full functionality)
Exchange Online (50GB mailbox)
SharePoint and OneDrive
Office web apps (browser-only — no desktop installation)
Intune (device management)
Basic compliance features

What it does NOT include:

Desktop Office applications (this is the key differentiator from E3)
Advanced eDiscovery and compliance
Azure AD Premium P1 (conditional access, group-based licensing)
Information protection features

Who belongs here: Users who work entirely in the browser, don't need desktop Office, and don't require advanced security or compliance features. Typically: contractors, temporary staff, users in regulated roles where BYOD with web-only access is acceptable.

The practical question: Does this user need to work offline? Does this user need to use Office features that aren't available in the web apps (complex macros, advanced Excel functions, full Word track changes)? If yes, they need E3, not E1.

Microsoft 365 E3 — €36.00/user/month*

The standard enterprise plan for knowledge workers.

What it includes that matters:

Everything in E1, plus:
Desktop Office applications (full installation on up to 5 devices)
Exchange Online (100GB mailbox)
Azure AD Premium P1 (conditional access, MFA, group-based licensing)
Microsoft Purview Information Protection (sensitivity labels, DLP)
Advanced compliance features (eDiscovery, legal hold)
Windows 11 Enterprise (through Microsoft 365 Apps for Enterprise licensing)

What it does NOT include:

Advanced security analytics (Defender for Endpoint P2, Defender for Identity)
Power BI Pro (separate license required)
Microsoft Defender for Cloud Apps (formerly MCAS)
Advanced compliance (Communication Compliance, Insider Risk Management)
Audio Conferencing (for Teams meetings with phone dial-in)

Who belongs here: The majority of knowledge workers in most organizations. Users who work at desks, need desktop Office, send and receive significant email volume, and whose roles don't require advanced security analytics or compliance features.

Microsoft 365 E5 — €57.20/user/month*

The premium plan, designed for users who need advanced security, compliance, or analytics.

What it includes that matters beyond E3:

Microsoft Defender for Endpoint P2 (advanced threat detection)
Microsoft Defender for Identity (hybrid environment protection)
Microsoft Defender for Cloud Apps (cloud app security)
Azure AD Premium P2 (identity protection, privileged identity management)
Microsoft Purview advanced compliance suite
Power BI Pro (included — this is the most frequently overlooked inclusion)
Audio Conferencing
Phone System (with appropriate calling plans)
Microsoft Viva Insights

Who genuinely belongs here: Security team members who use Defender actively. Legal and compliance staff who use advanced eDiscovery and communication compliance. Senior executives whose accounts are higher-risk targets. IT administrators who manage security infrastructure.

Who is wrongly assigned here: Everyone else. This is the most expensive tier, and in most organizations, the majority of E5 users don't use the features that differentiate E5 from E3.

Prices approximate as of 2026. Microsoft adjusts pricing periodically — verify current pricing at microsoft.com/en-us/microsoft-365/business/compare-all-plans.

The Financial Reality of Systematic Over-Licensing

The cost difference between E5 and E3 is €21.20 per user per month. Between E3 and E1, it's €27.20 per user per month. Between E3 and F3, it's €28.00 per user per month.

These differences accumulate quickly.

Scenario: 1,000-user organization, current assignment

800 users on E3 (standard knowledge workers)
150 users on E5 (mixed — some legitimate, many not)
50 users on F3 (frontline)

Monthly license cost: (800 × €36) + (150 × €57.20) + (50 × €8.00) = €28,800 + €8,580 + €400 = €37,780/month

After rightsizing analysis:

600 users remain on E3 (genuinely need desktop Office and E3 features)
200 users move to E1 (knowledge workers who use only cloud applications)
80 users remain on E5 (security team, compliance, senior leadership — genuinely justified)
70 users move from E5 to E3 (were on E5 without justification)
50 users remain on F3

Monthly license cost after rightsizing: (600 × €36) + (200 × €8.80) + (80 × €57.20) + (70 × €36) + (50 × €8.00) = €21,600 + €1,760 + €4,576 + €2,520 + €400 = €30,856/month

Monthly saving: €6,924. Annual saving: €83,088.

This is a conservative example. In organizations that have been assigning licenses categorically by department or seniority without individual justification, the over-licensing rate is frequently higher — and the savings are proportionally larger.

How to Identify Rightsizing Opportunities

Without dedicated tooling, the rightsizing analysis is a multi-step manual process. Here's the framework:

Step 1: Export current assignments

From the Microsoft 365 Admin Center, export the list of all active users with their current license assignments. This gives you the baseline.

Step 2: Pull usage data by workload

Microsoft 365 Usage Reports (in the Admin Center under Reports → Usage) provide activity data for Teams, Exchange, SharePoint, OneDrive, and the Office apps. The user-level activity reports show last activity date per workload.

Key data points for rightsizing:

Office desktop app usage: If a user on E3 or E5 hasn't used desktop Office apps in 90 days, they may be candidates for E1.
Teams usage: Relevant for F3 vs E1/E3 decisions.
Exchange activity: Low email volume may indicate a shared or secondary account that doesn't need a full plan.
Last sign-in date: Users who haven't signed in recently are candidates for license reclamation entirely, before rightsizing questions arise.

Step 3: Map E5 users against E5-specific feature usage

This is the most valuable step for most organizations, because E5 is where the cost is. For each E5 user, the question is: are they using any feature that isn't available in E3?

The features to check:

Microsoft Defender for Endpoint P2: Active alert review, threat hunting. If the user isn't in the security operations team, they almost certainly aren't using this.
Microsoft Defender for Identity: Only relevant for hybrid environments and only for administrators managing identity infrastructure.
Azure AD P2 features: Identity Protection, Privileged Identity Management. Relevant for security and IT admins, not for general users.
Power BI Pro: Checked via the Power BI admin portal, not the M365 Admin Center. This is the most frequently missed inclusion in E5.
Advanced compliance features: Communication Compliance, Insider Risk Management. Relevant for compliance officers, legal, and specific regulated roles.

If a user on E5 is not actively using any of these — and most general knowledge workers aren't — they belong on E3, not E5.

Step 4: Cross-reference with role and department

Usage data alone isn't sufficient. A user who hasn't used Defender for Endpoint in the last 30 days might be in a role where they'll need it next month. The rightsizing analysis should be done in collaboration with department heads, not purely from technical usage data.

The question to ask department heads: "For someone in this role, which of these specific features do they use or need access to?" followed by a plain-language explanation of what E5 provides beyond E3.

Step 5: Document the decision

For every user whose tier is changed, document the justification. This creates the audit trail that protects you if the decision is questioned later — and it creates the baseline for future reviews.

The SKU Inclusion Problem

Before making rightsizing decisions, there's a critical factor that many organizations miss: SKU inclusions.

Microsoft 365 E5 includes Power BI Pro. If you have E5 users who also have Power BI Pro assigned as a standalone license, you're paying €8.80/user/month for a license that's already covered. This is an inconsistency — a redundant assignment — that exists completely separately from the rightsizing question.

The same issue applies to Audio Conferencing (included in E5 but sometimes assigned separately), and various other add-on SKUs that are included in higher-tier plans.

Before rightsizing users down from E5 to E3, audit for these redundant assignments. Remove the standalones from E5 users first — that's pure savings with no downgrade risk. Then evaluate whether the remaining E5 features justify the tier for each user.

At scale, the redundant SKU problem alone can generate significant savings without any tier changes. A 150-user E5 population with 60% having Power BI Pro assigned separately generates €7,920/year in redundant assignments — and removing those standalones takes hours, not weeks.

Building a Rightsizing Process That Scales

A one-time rightsizing exercise recovers the immediate cost. A repeatable process prevents the drift from happening again.

The core of a scalable rightsizing process is making license tier decisions explicit at assignment time, not auditing them retrospectively.

Assignment rules by role: Define which license tier is appropriate for each role category in your organization. Document these rules. When a new user is onboarded, the tier is determined by role, not by whoever processes the request. When someone changes roles, the license is reviewed as part of the transition.

Quarterly usage reviews: For E5 specifically, a quarterly review of whether users in that tier are actively using E5-specific features catches drift before it compounds. This doesn't need to be a full audit — a targeted review of E5 users who haven't generated any security alerts or compliance activity in the past 90 days identifies the candidates for review.

Annual rightsizing audit: Before each Enterprise Agreement renewal, a full rightsizing analysis ensures that the license quantities you're committing to for the next term reflect actual need, not historical assignment patterns. This is where the largest single-event savings typically come from.

License tier as part of offboarding: When someone leaves, the license is reclaimed. When someone's role changes, the license is reviewed. These are process integrations, not separate audits.

The Governance Layer That Makes This Manageable

Manual rightsizing is possible. At 50 users, it's a spreadsheet exercise. At 500 users across five countries, it's a significant project. At 2,000 users across ten countries, with different regional admins, different role structures, and license assignments made through multiple channels, it requires tooling.

The governance layer that supports rightsizing at scale does three things:

It maintains current assignment data in real time, not in monthly exports. Every sync cycle updates the picture so rightsizing analysis always reflects the current state, not last month's snapshot.

It surfaces inconsistencies — redundant SKU assignments — automatically, so the "remove standalones from E5 users" step happens continuously rather than requiring a dedicated audit project.

It tracks the history of license assignments by user, so when a rightsizing question comes up, you can see not just what someone is assigned today but what they've been assigned over time and whether changes were made through your process or directly in the Admin Center.

This is the foundation that makes the quarterly review and annual rightsizing audit manageable rather than overwhelming.

The Conversation With Finance

When you've completed a rightsizing analysis and you have a number — say, €83,088 in potential annual savings — the conversation with Finance is straightforward.

The challenge is that the savings are potential, not guaranteed. Finance will ask how confident you are in the number. The honest answer is that it depends on the quality of the usage data you're working with and whether the role assessments are accurate.

The way to make the number credible is to show your methodology. Here's the usage data. Here's the role analysis. Here's the justification for each tier change. Here's the risk assessment — users who might be moved down but could need the higher tier. Here's the conservative estimate that accounts for that risk.

A rightsizing analysis with documented methodology and explicit risk accounting is credible to a CFO. A headline number without supporting data isn't.

The governance layer helps here too — because it generates the supporting data automatically, continuously, and in a format that can be exported and presented without manual compilation.

About Portalliz

Portalliz surfaces license inconsistencies — including redundant SKU assignments like E5 + Power BI Pro — automatically on every Graph sync. It doesn't perform rightsizing analysis directly, but it eliminates the redundancy problem that masks the true cost of each tier, making the rightsizing exercise more accurate and the savings more actionable.

The inconsistency engine is one of six core capabilities in Portalliz, alongside regional license quotas, monthly reservation cycles, out-of-band detection, Graph sync, and analytics.

Try it yourself: portalliz.com/download — demo includes sample inconsistency flags showing redundant assignments with monthly cost impact.

Request a pilot: portalliz.com/contact — 90 days free, no credit card, no commitment.

Microsoft 365 pricing referenced is approximate as of 2026 and subject to change. Verify current pricing at microsoft.com. Microsoft 365 is a trademark of Microsoft Corporation. Portalliz is an independent product and is not affiliated with or endorsed by Microsoft.