$12 Instead of $60: What the E5 Security Add-On Actually Buys Business Premium Tenants

For years, the licensing jump from Microsoft 365 Business Premium to E5 forced an awkward conversation: pay roughly five times more, or live without the advanced security stack. Earlier in 2025, Microsoft made the E5 Security add-on available for Business Premium subscribers (opens in new tab) and removed that dilemma. For $12 per user per month, against $60 for full E5, Business Premium tenants get the security features without the rest of the E5 bundle.

We think this is one of the most consequential SMB licensing moves Microsoft has made. Here is what is inside, and the six scenarios where the value shows up.

Five products in one SKU#

The add-on is made up of five standalone products. Entra ID P2 alone carries a large share of the value, and combined with the other plans the offer becomes hard to ignore.

With full E5 costing $60 per user per month, getting the security features for $12 is the headline. And the standard comparison charts still undersell it:

There is a long list of identity protections, PIM, Access Packages, and more, that do not even appear in the comparison above.

Where the add-on earns its $12: six scenarios#

1. Attacks get disrupted without a human in the loop#

There is a fundamental thesis here: when you layer many different security tools, you get siloed signals you have to stitch together yourself to understand a broader attack.

Typical attack chains flow through multiple domains: email, endpoints, identities. The attacker plans movement across systems to reach an outcome, whether that is ransom, wire fraud, or data exfiltration.

E5 Security correlates signals across email, devices, and users, and then takes automated action to break the attack with no human involvement: blocking user accounts, resetting passwords, rotating sessions, isolating devices from the network, and ZAPing emails out of user inboxes.

2. Conditional Access starts reacting to risk#

Entra ID P2 extends Conditional Access to act on detected risk. If a user or sign-in is flagged at high risk, the policy can automatically block the account, force a password reset, or re-prompt for MFA. P2 also includes many more risk signals as part of its identity protection features, so detections fire on activity that lower tiers never see.

3. Access gets governed instead of granted forever#

Entra ID P2 includes Access Packages, entitlement workflows, and access reviews, which streamline access controls across groups, apps, and roles, and can automate common tasks like user onboarding and offboarding. PIM (Privileged Identity Management) is included too, bringing just-in-time admin access for roles like Global Administrator instead of standing privilege.

4. Email and Teams threats investigate themselves#

Defender for Office 365 Plan 2 includes Automated Investigation and Response (AIR), and those capabilities extend to suspicious or malicious behavior in Teams. That matters because Teams phishing is a rising threat as of 2025, and most SMB security programs still treat email as the only phishing channel.

5. Shadow IT and AI tools become visible, then blockable#

Defender for Cloud Apps is Microsoft's CASB (cloud app security broker). Combined with Defender for Endpoint, it detects applications on workstations and in the browser, automatically cataloging the app list by category. That makes it trivial to see, for example, exactly which AI apps users have adopted. As an admin you label apps sanctioned or unsanctioned, and unsanctioned apps are immediately blocked in the browser.

6. On-premises AD gets the same coverage#

Customers running hybrid environments can use Defender for Identity to extend protections to local Active Directory, with alerts triaged centrally in the Defender admin center alongside everything else.

What to do with this#

If you manage Business Premium tenants, the E5 Security add-on changes the upsell math: the TCO story of consolidating third-party point tools into the Microsoft stack now works at SMB pricing. We will break these features down further in future posts, including how to position the add-on as an upsell to your customers.

The full presentation deck on enhancing Business Premium with E5 Security is available here: Enhance-Business-Premium-with-E5-Security (opens in new tab)