Microsoft 365 E3 vs E5: what's the difference for email security?

Microsoft 365 E3 and E5 are Microsoft's main enterprise plans, and for years the email security gap between them was large: E3 had only the built-in filtering, E5 had all of Defender for Office 365. That changed on July 1, 2026, when Microsoft added Defender for Office 365 Plan 1 to E3. This guide explains what each plan now includes for email, what E5 still adds, and when the upgrade is worth it, using Microsoft's own service descriptions. Plan contents are as published at the time of writing (November 2026); confirm on the linked Microsoft pages before you buy.

What email security do E3 and E5 both include?

Both plans include Microsoft's built-in protection for cloud mailboxes and, since July 1, 2026, Defender for Office 365 Plan 1. Microsoft's Defender for Office 365 service description says Plan 1 is "included in Microsoft 365 Business Premium and, effective July 1, 2026, in Office 365 E3 and Microsoft 365 E3", and that this "adds Plan 1 protection (Safe Links, Safe Attachments, anti-phishing, real-time detections); it doesn't include Plan 2 capabilities."

So an E3 mailbox now has:

• Built-in filtering: anti-spam, anti-malware, spoofing protection, quarantine and zero-hour auto purge (ZAP), which removes malicious mail after delivery. See what Exchange Online Protection includes.
• Safe Links and Safe Attachments, which check links at the time of click and open attachments in a sandbox before delivery. See Safe Links and Safe Attachments.
• Impersonation protection, where you list the executives and partner domains attackers are likely to fake.
• Real-time detections, a search view for finding and investigating threats.

Outside Defender, both plans also include Microsoft Entra ID P1 with Conditional Access, Purview Data Loss Prevention for Exchange, Purview Message Encryption, Audit (Standard), eDiscovery (Standard) and an archive mailbox of up to 1.5 TB, according to Microsoft's Entra licensing page and Purview service description.

How do E3 and E5 compare for email security?

The table lists only features that touch email or mailbox accounts.

Sources: the Defender for Office 365 service description, Microsoft's Plan 1 vs Plan 2 page, the Purview and Defender service descriptions, and Entra licensing.

What changed for E3 in July 2026?

Microsoft's 2026 packaging update added "Microsoft Defender for Office Plan 1" to both Office 365 E3 and Microsoft 365 E3, with price changes effective July 1, 2026. Microsoft says the packaging updates began rolling out in June 2026. The same update gave Microsoft 365 E3 Intune Plan 2, Intune Remote Help and Intune Advanced Analytics, and gave E5 Microsoft Security Copilot, Intune Endpoint Privilege Management, Microsoft Cloud PKI and Intune Enterprise Application Management.

The practical effect is that some protection probably switched on without anyone touching a setting. Microsoft says the Built-in protection preset security policy "provides Safe Links protection in e-mail messages, Microsoft Teams, and files in supported Office apps to all recipients for customers that have at least one Defender for Office 365 license" (Microsoft Learn), for users not covered by other Safe Links policies. If your E3 tenant now has Plan 1, users may see Safe Links warning pages for the first time. The Built-in protection preset doesn't rewrite URLs: Microsoft's recommended settings show it checks links via the Safe Links API only, while the Standard and Strict presets rewrite them. Expect a few help desk questions, and check whether a filtering service in front of Microsoft 365 also rewrites links, because Microsoft warns that wrapping links with another service first "might prevent Safe Links from processing links".

What does E5 add for email security?

E5 adds investigation, response and identity features. Most of them help a security team act faster after an attack starts, rather than stopping more mail at the door.

Defender for Office 365 Plan 2

Microsoft describes Plan 2 as adding "phishing simulations, post-breach investigation, hunting, and response, and automation" (Microsoft Learn). The main additions are:

• Threat Explorer, which replaces Real-time detections with a fuller hunting view. Our Threat Explorer and Real-time detections guide shows the difference.
• Automated investigation and response (AIR), including AIR for compromised users. See automated investigation and response.
• Attack simulation training, for phishing simulations and assigned training. See attack simulation training.
• Priority account protection for executives and other high-value users, and Threat Trackers and Campaigns views.
• Defender XDR integration, with incidents, alerts and advanced hunting across Microsoft's security products.

A quick check: in the Defender portal under Email & collaboration, Plan 1 tenants see Real-time detections and Plan 2 tenants see Explorer. For the full feature split, read Defender for Office 365 Plan 1 vs Plan 2.

Safe Documents

Safe Documents scans Office files opened in Protected View using Microsoft Defender for Endpoint's cloud back end. Microsoft lists it for Microsoft 365 A5, E5, G5 and the Microsoft Defender Suite, and says "Safe Documents isn't included in Microsoft Defender for Office 365 Plan 1 or Plan 2" (Microsoft Learn). You turn it on under Safe Attachments > Global settings in the Defender portal.

Entra ID P2: risk-based sign-in protection

E5 includes Microsoft Entra ID P2. Microsoft says "risk-based policies require access to Microsoft Entra ID Protection, which is a Microsoft Entra ID P2 feature" (Microsoft Learn). For email, this means you can require a password change or block a sign-in when Microsoft rates the sign-in or user as risky, which helps when a phished password is used from an unfamiliar place. E3's P1 gives you Conditional Access, but not the risk signals. P2 also includes Privileged Identity Management, which limits standing admin rights.

Audit (Premium), eDiscovery (Premium) and Advanced Message Encryption

Microsoft says Audit (Premium) "provides up to one-year retention of audit logs" and logs crucial events for investigations (Microsoft Learn). That matters because business email compromise is often found months later. E3 still has the MailItemsAccessed audit event, which Microsoft says is part of Audit (Standard) and on by default for E3 and E5 users. Our audit log investigation guide explains how to use it.

E5 also adds eDiscovery (Premium) and Advanced Message Encryption, which Microsoft says lets admins expire or revoke access to encrypted mail sent outside the organization.

Defender for Cloud Apps

Microsoft lists Defender for Cloud Apps, including app governance for OAuth apps, in Microsoft 365 E5 (Microsoft Learn). App governance helps you spot malicious apps that users granted access to their mailbox, a technique covered in OAuth consent phishing.

Is Office 365 E5 the same as Microsoft 365 E5 for email?

For mail filtering, nearly. Microsoft's Defender service description lists both Microsoft 365 E5 and Office 365 E5 among the licenses that grant Defender for Office 365 Plan 2. So Threat Explorer, AIR, attack simulation training and priority account protection come with either one. The Purview service description also lists Office 365 E5 for Audit (Premium) and Advanced Message Encryption.

The gap is everything around the mailbox. Office 365 E5 is an apps-and-services suite, while Microsoft 365 E5 adds identity, device and cloud app security. Microsoft's Entra licensing page lists Microsoft 365 E5, not Office 365 E5, for Entra ID P2, so risk-based Conditional Access isn't part of Office 365 E5. Microsoft lists Defender for Endpoint Plan 2 and Defender for Cloud Apps, including app governance, under Microsoft 365 E5, and Safe Documents for Microsoft 365 E5 but not Office 365 E5.

The same split applies lower down. Microsoft's 2026 packaging update added Defender for Office 365 Plan 1 to Office 365 E3 as well as Microsoft 365 E3, so both E3 suites now get Safe Links, Safe Attachments and impersonation protection. For Office 365 E5, the update lists only Copilot Chat changes. If someone in your organization says "E5", check which suite they mean before you compare features.

Is Microsoft 365 E5 worth it for email security alone?

Usually not, now that E3 includes Plan 1. Plan 1 holds the prevention features that stop most phishing and malware: Safe Links, Safe Attachments and impersonation protection. E5's email additions mainly help you investigate and respond, and they pay off only if someone uses them every week.

E5 is worth it when at least one of these is true:

• You have a security team, or a managed security provider, that will work in Threat Explorer, AIR and Defender XDR incidents.
• You want risk-based Conditional Access and Privileged Identity Management for identities, not just email.
• You need a year of audit logs, eDiscovery (Premium) or Advanced Message Encryption for legal or regulatory reasons. Ask your counsel what applies to you.
• You want endpoint and cloud app protection from the same vendor, through Defender for Endpoint Plan 2 and Defender for Cloud Apps.

If none of those apply, spend the effort on configuring Plan 1 well. Many E3 tenants still leave Defender at its defaults.

Can you get E5 email features without buying E5?

Yes, in two common ways. Microsoft's Defender service description lists "Microsoft Defender for Office 365 Plan 2 standalone" and the "Microsoft Defender Suite" (formerly Microsoft 365 E5 Security) among the licenses that grant Plan 2. Microsoft's Entra page says the Defender Suite also includes Entra ID P2. Microsoft also sells the Purview Suite for the compliance side, which includes Audit (Premium).

Remember the licensing rule. Microsoft says licenses are needed for "any user that accesses a mailbox that benefits from Defender for Office 365 protections" and for shared mailboxes that benefit. Because Defender features are enabled at the tenant level by default, scope Plan 2-only policies to licensed users if you don't license everyone.

Which plan should you choose?

1. Mostly prevention, small IT team, no dedicated security staff: Microsoft 365 E3. Assign the Standard or Strict preset security policy and add impersonation protection for executives and key suppliers.
2. E3 plus a security analyst or managed provider who investigates phishing: E3 with Plan 2 add-ons for the investigators' scope, or the Defender Suite if you also want Entra ID P2 and endpoint protection.
3. Regulated data, long investigations, legal holds: E5, or E3 with the Purview Suite. Confirm requirements with counsel.
4. Fewer than 300 users: compare against Business Premium first; see the Microsoft 365 business plans comparison.

How do you check what your E3 tenant has now?

1. In the Microsoft 365 admin center, open Billing > Your products and confirm the plan and any add-ons.
2. In the Defender portal, open Email & collaboration. Real-time detections means Plan 1; Explorer means Plan 2.
3. Go to Email & collaboration > Policies & rules > Threat policies > Preset security policies. Assign Standard or Strict to your users so they get more than the Built-in protection preset. See preset security policies.
4. In the anti-phishing policy, add your executives as protected users and your main partner domains as protected domains. See anti-phishing policy settings.
5. Send a test message with a link from an outside account to a user in the Standard or Strict preset, and confirm, by hovering, that Safe Links wraps it. Users covered only by Built-in protection won't see rewritten links.

Does a gateway still make sense with E3 or E5?

Defender works inside Microsoft 365, after delivery and in Teams, SharePoint and OneDrive, which an MX-level gateway can't do. A gateway filters inbound mail before it reaches Microsoft. It's useful when you want an independent first layer, a quarantine digest for every user, mail held during an outage, or one policy across several platforms. If you run both, avoid double link wrapping, and set up Enhanced Filtering for Connectors so Microsoft sees the real sender. Our Defender for Office 365 vs email gateway comparison covers the trade-offs.

Next steps

• Confirm in the Defender portal whether your E3 tenant now shows Real-time detections.
• Apply the Standard or Strict preset policy and impersonation protection before you consider E5.
• Price E5 against Plan 2 or Defender Suite add-ons for only the users who need them.
• Check your domain's MX, SPF and DMARC with the free Email Health Check, and see how a filter in front fits on the Microsoft 365 platform page.