Microsoft 365 has grown into a sprawling SKU family — frontline tiers, knowledge worker tiers, security and compliance add-ons, Teams Premium, Power Platform extensions, Copilot, Defender and Purview overlays. Most enterprises pay for SKUs they do not use and miss SKUs that would replace add-ons they buy separately. The cost difference between a well-mapped M365 estate and a default-stacked one is typically 18–28% per user. Here is the map and the right-sizing pattern.
M365 F1 ($2.25 per user per month) and M365 F3 ($8 per user per month) are designed for frontline workers — retail, manufacturing, healthcare frontline, field operations. The distinction: F1 provides Teams, SharePoint, OneDrive, Exchange Online Kiosk (no full mailbox) and limited Office web access. F3 adds a 2GB mailbox, web/mobile Office apps, mobile device management, basic security. Neither tier includes desktop Office. Both tiers cap the user storage at materially lower limits than knowledge worker SKUs.
Frontline SKUs have an explicit usage definition: the user must spend significant work time away from a dedicated desktop, in a non-knowledge-worker role. Microsoft has historically not aggressively audited the frontline assignment rule, but the 2024 contract language strengthened it; the SAM team should validate the assignment against role definitions to avoid an audit exposure.
The right-sizing exercise that consistently delivers value is reviewing the user base for frontline-eligibility. In our experience, 8–15% of mid-size enterprise user bases are E3-licensed when F3 would meet the actual usage pattern. At a cost differential of approximately $30 per user per month, the rebalance produces meaningful annual savings on a 10,000-user base — often $300K–$540K per year — with no functional impact on the user.
The frontline-vs-knowledge-worker split is the highest-leverage M365 optimisation move at most enterprises.
M365 E3 ($36 per user per month) is the standard knowledge worker SKU — desktop Office, Teams, Exchange (50GB mailbox), SharePoint, OneDrive (1TB), Intune device management, Windows Enterprise, basic Information Protection. M365 E5 ($57 per user per month) adds advanced security (Defender for Endpoint Plan 2, Defender for Office Plan 2, Defender for Identity, Defender for Cloud Apps), advanced compliance (Purview eDiscovery, Records Management, Insider Risk), Power BI Pro, Audio Conferencing, Phone System.
The $21 per user uplift from E3 to E5 is justified for organisations that would otherwise buy the equivalent products separately. The standard analysis: if the customer is buying Defender for Endpoint, Defender for Office, Power BI Pro, or eDiscovery Premium as standalone SKUs, the E5 uplift is often net-positive. If those overlay products are NOT in scope, the E5 uplift typically does not pay back.
Microsoft permits customers to add specific E5 components onto an E3 base — E5 Security ($12 per user per month), E5 Compliance ($12 per user per month), or E5 individual products. The pattern works when a subset of users needs full E5 (typically 15–25% of the enterprise) and the broader base is well-served by E3. Mixing E3 and E5 + add-ons is licensed cleanly under EA, with proper user grouping; under NCE it is administratively complex but technically supported.
The E3/E5/Copilot stack analysis, the value-by-persona model and the add-on-vs-upgrade decision framework.
The 2025–2026 M365 SKU expansion has been concentrated in overlays. Teams Premium adds intelligent meeting capabilities, advanced webinar tooling and Town Hall — $10 per user per month. Defender XDR, Defender for Cloud Apps and Defender for Endpoint Plan 2 layer on top of E3 estates as upgrade paths. Purview eDiscovery Premium, Compliance Manager Premium and Insider Risk Management overlay the compliance stack. Each is sold individually, sold as part of E5, or sold as part of mid-tier bundles.
The add-on stacking pattern that consistently overspends: customers add overlays without removing the equivalent third-party tool. Defender for Endpoint replaces the prior endpoint protection; the prior contract should be cancelled. Purview eDiscovery replaces the prior eDiscovery platform. Teams Premium replaces the prior webinar tool. The remediation pattern is structured rationalisation — for every M365 overlay added, the corresponding third-party contract should be evaluated for sunset.
The "did we cancel the thing this replaces" check is the single most valuable five-minute exercise in the M365 cycle.
For M365 spend above $1M annually, independent SKU mapping typically captures 12–22% cost reduction within the existing user base. That right-sizing is the foundation of a sustained license cost reduction programme across the Microsoft estate, not a one-off renewal exercise.
We have run M365 SKU mappings across more than 180 enterprise estates.
Weekly compliance intelligence for IT leaders.