> For the complete documentation index, see [llms.txt](https://msdocs.aohwv.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://msdocs.aohwv.com/secure-and-measure/get-more-from-your-microsoft-licenses.md). # Get More From your Microsoft Licenses Most organizations use only a small part of the security features they already pay for. This page explains what your licenses include, starting with **Identity (Entra ID)** and then **threat protection (Defender)**, and gives a quick first step for each feature. ### Your Microsoft 365 plan at a glance | Feature | E3 | E5 | E7 | | ----------------------------------------------- | -------------------- | ---------------------------------- | ---------------------------------- | | **Entra ID** (identity) | P1 | P2 | P2 | | **Entra Suite** (network access and governance) | — | — | ✅ | | **Defender for Endpoint** | Plan 1 | Plan 2 | Plan 2 | | **Defender for Office 365** | Plan 1 | Plan 2 | Plan 2 | | **Defender for Identity** | — | ✅ | ✅ | | **Defender for Cloud Apps** | Discovery only | ✅ | ✅ | | **Intune** (device management) | Plan 1 | Plan 1 + Enterprise App Management | Plan 1 + Enterprise App Management | | **Purview Data Loss Prevention** | Email and files only | ✅ | ✅ | | **Purview Insider Risk Management** | — | ✅ | ✅ | | **Security Copilot** | — | ✅ | ✅ | | **Microsoft 365 Copilot** | Add-on | Add-on | ✅ | | **Agent 365** | — | Add-on | ✅ | **E7 = E5 + Microsoft 365 Copilot + Agent 365 + Entra Suite.** {% hint style="info" %} **Not sure which you have?** In the Microsoft 365 admin center, go to **Billing** → **Your products**. For Entra ID specifically, the Entra admin center **Overview** page shows your license. {% endhint %} ## Identity: Entra ID **Entra ID** is Microsoft's identity platform: it controls who can sign in, to what, and how. It comes in **P plans**, and each step up adds more security. | Plan | What it adds | Included in | | ----------------- | ------------------------------------------------------------------------------------------------------ | -------------------------------- | | **Entra ID Free** | MFA, single sign-on, basic reports | Any Microsoft cloud subscription | | **Entra ID P1** | **Conditional Access**, advanced group management, self-service password reset, HR-driven provisioning | E3, Business Premium | | **Entra ID P2** | Everything in P1, plus **ID Protection**, **Privileged Identity Management** and **access reviews** | E5, E7 | | **ID Governance** | Entitlement management, lifecycle workflows and automated approvals | Add-on to P1 or P2 | | **Entra Suite** | **Internet Access**, **Private Access**, governance and Face Check | E7, or add-on | | **Workload ID** | Conditional Access and risk detection for apps and service principals | Add-on | See Microsoft's full comparison: [Microsoft Entra plans](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing) ### Conditional Access **What it does:** Decides who can sign in, from where, on what device and with what level of proof. **Requires:** Entra ID P1 * **Authentication strengths:** require phishing-resistant methods for admins and sensitive apps * **Device requirements:** allow access only from compliant or managed devices * **Named locations:** block or challenge sign-ins from countries you don't operate in * **Session controls:** limit how long sessions last on unmanaged devices **Quick win:** use the **What If** tool in Conditional Access to test how your policies apply to a user before turning them on. ### ID Protection **What it does:** Detects compromised accounts and risky sign-ins, such as leaked passwords, impossible travel and anonymous IP addresses, and can respond automatically. **Requires:** Entra ID P2 * Turn on **risk-based Conditional Access** so high-risk users must change their password and risky sign-ins must complete MFA * Review **Risky users** weekly, and confirm or dismiss each one * Make sure users are registered for **MFA and self-service password reset**, so they can fix their own risk **Quick win:** open **ID Protection** → **Risky users** and see who's already flagged. ### Privileged Identity Management (PIM) **What it does:** Makes admin rights temporary. Admins activate a role only when they need it, for a set time, with MFA and an optional approval. **Requires:** Entra ID P2 * Move **permanent admin assignments** to **eligible** assignments * Require **approval** to activate Global Administrator and other high-impact roles * Use **PIM for Groups** to protect access to sensitive groups the same way * Set up **access reviews** for admin roles **Quick win:** in **PIM** → **Microsoft Entra roles** → **Assignments**, count how many permanent Global Administrators you have. ### Identity Governance (IGA) **What it does:** Makes sure people have the right access, for the right time, and lose it when they no longer need it. **Requires:** Entra ID P2 for access reviews. **ID Governance** or **Entra Suite** for advanced features * **Access reviews:** managers or app owners confirm who still needs access, on a schedule * **Access packages:** bundle the groups, apps and sites a role needs, with approvals and automatic expiry * **Lifecycle workflows:** automate access for joiners, movers and leavers, based on HR data * **Guest access:** expire guest accounts automatically when they're no longer used **Quick win:** create one **access review** for your guest users, and remove guests who no longer need access. {% hint style="info" %} **AOHWV specializes in Identity Governance and Administration (IGA).** We help automate access reviews and joiner/mover/leaver processes across your HR systems, Entra ID and Active Directory. See **AOHWV Identity**. **AOH Sync** gives you visibility into identity attributes and entitlements across your HR systems, Entra ID, Active Directory and other connected systems. [Learn more about AOH Sync](https://docs.aohwv.dev/). {% endhint %} ### Authentication methods **What it does:** Controls which sign-in methods users can use. **Requires:** Entra ID Free (self-service password reset needs P1) * Turn on **passkeys** and **Microsoft Authenticator** * Use a **Temporary Access Pass** to onboard new users without a password * Turn off **SMS and voice** once users have moved to stronger methods **Quick win:** in **Authentication methods** → **Activity**, see which methods your users actually use. ### Workload identities **What it does:** Protects apps, service principals and other non-human identities, which often have broad access and no MFA. **Requires:** Workload ID * Apply **Conditional Access** to service principals, for example limiting them to known IP addresses * Review **Risky workload identities** in ID Protection * Clean up **unused apps** and **old secrets** (see **Top 10 Hardening Steps**) **Quick win:** in **App registrations**, look for expired or long-lived secrets under **Certificates & secrets**. ### Global Secure Access **What it does:** Microsoft's network security service. **Internet Access** protects web and AI traffic, and **Private Access** gives secure access to internal apps without a traditional VPN. **Requires:** Entra Suite (included in E7), or Internet Access and Private Access on their own * Replace VPN access for specific internal apps with **Private Access** * Apply **Conditional Access** to network traffic, not just sign-ins **Quick win:** if you have E7, open **Global Secure Access** in the Entra admin center. It's already licensed. ## Threat protection: Defender **Microsoft Defender** detects and stops attacks. The Defender products for Microsoft 365 work together in the **Defender portal** (Defender XDR). **Defender for Cloud** protects Azure, AWS and GCP, and is licensed separately through Azure. ### Defender for Endpoint **What it does:** Protects laptops, desktops, servers and mobile devices from malware, ransomware and hands-on-keyboard attacks. **Requires:** Plan 1 (E3) for prevention. **Plan 2** (E5, E7) adds endpoint detection and response (EDR), automated investigation and advanced hunting * Make sure **every device is onboarded**. Unprotected devices are a common gap * Turn on **attack surface reduction rules**, starting in audit mode * Turn on **tamper protection** so attackers can't switch Defender off * Use **device isolation** to cut off a compromised device during an incident **Quick win:** in the Defender portal, go to **Assets** → **Devices** and look for devices that aren't onboarded or haven't checked in recently. ### Defender for Office 365 **What it does:** Protects email and collaboration from phishing, malware and business email compromise. **Requires:** Plan 1 (E3) for Safe Links and Safe Attachments. **Plan 2** (E5, E7) adds attack simulation training, threat investigation and automated response * Turn on **preset security policies**: Standard for everyone, Strict for executives and admins * Run **attack simulation training** to teach users to spot phishing * Set up **user-reported messages** so suspicious emails reach your security team **Quick win:** in **Email & collaboration** → **Policies & rules** → **Threat policies**, check whether **Preset security policies** are on. ### Defender for Identity **What it does:** Watches on-premises Active Directory for attacks such as credential theft, lateral movement and domain takeover. **Requires:** E5 or E7 * Install **sensors** on every domain controller, plus AD FS, AD CS and Entra Connect servers if you have them * Review **identity security posture** recommendations * Check **lateral movement paths** to sensitive accounts **Quick win:** in **Settings** → **Identities** → **Sensors**, confirm every sensor is healthy. ### Defender for Cloud Apps **What it does:** Gives visibility and control over cloud apps, including ones IT didn't approve, and the apps connected to your Microsoft 365 data. **Requires:** Discovery only in E3. **Full protection** in E5 and E7 * Connect **Microsoft 365** and other key apps with **app connectors** * Use **Cloud discovery** to find unapproved apps (shadow IT) * Review **OAuth apps** for risky permissions * Use **session policies** with Conditional Access to control downloads on unmanaged devices **Quick win:** open **Cloud apps** → **Cloud discovery** and see which apps employees are actually using. ### Defender for Cloud **What it does:** Protects Azure, and also AWS, GCP and code environments like GitHub, from misconfigurations and attacks. **Requires:** Basic posture management is free. **Defender CSPM** and the workload protection plans (Servers, Storage, Databases, Key Vault, Containers and more) are paid **through your Azure subscription**, not your Microsoft 365 license * Turn on the **Defender plans** that match the resources you use * Connect **AWS and GCP** in **Environment settings** to see all clouds in one place * Use **Attack path analysis** (Defender CSPM) to find the riskiest paths to critical resources * Work through **Recommendations** by **potential score increase** **Quick win:** in **Environment settings**, check the **Defender coverage** column for each subscription. {% hint style="info" %} **Not sure which Defender plans you need?** RedLegg Advisory can review your environment, and RedLegg EDR & Automation can deploy and tune endpoint protection. See **Get Expert Help**. {% endhint %} ## AI for security: Security Copilot **What it does:** Lets security teams ask questions about their security data in plain language, and runs AI agents for tasks like alert triage and phishing review. **Requires:** E5 or E7, once rolled out in your tenant. Otherwise, Security Compute Units set up in Azure **Quick win:** go to [securitycopilot.microsoft.com](https://securitycopilot.microsoft.com) and try a prompt from **Prompts to try**. See **Microsoft Dashboards** for more. ## Where to start | If you have… | Start with | | --------------------- | ------------------------------------------------------------------------------------------------------ | | **E3** | Conditional Access baseline, Defender for Endpoint onboarding, preset email protection | | **E5** | Add risk-based policies, PIM, Defender for Identity sensors, Cloud Apps discovery and Security Copilot | | **E7** | All of the above, plus Private Access to replace VPN and governance automation from the Entra Suite | | **Azure, AWS or GCP** | Defender for Cloud plans and multicloud connections, whatever your Microsoft 365 plan | *Last verified: October 2026* ## Related * [Top 10 Hardening Steps](/secure-and-measure/top-10-hardening-steps.md) — The highest-impact settings to fix first * [Microsoft Dashboards](/secure-and-measure/microsoft-dashboards.md) — Scores, dashboards and Security Copilot * [Get Expert Help](/get-expert-help/overview.md) — RedLegg and AOHWV services --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://msdocs.aohwv.com/secure-and-measure/get-more-from-your-microsoft-licenses.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.