Microsoft 365 Licensing: Complete Administration Guide
🏢 Microsoft 365 vs Office 365
💡 What Changed
Office 365 was rebranded to Microsoft 365 in 2020, but it’s more than a name change. Office 365 plans bundle the core productivity apps and services — Exchange, Teams, SharePoint, OneDrive, Office apps. Microsoft 365 plans include everything Office 365 does, plus additional device management (Intune) and security/compliance features (Azure AD Premium, Defender, Purview) bundled at the same price point for equivalent tiers. Some legacy Office 365 SKUs (like E1/E3/E5 “Office 365” plans) still exist for grandfathered customers but Microsoft 365 is the current standard offering.
⚖️ Microsoft 365 E3 vs E5
E5 is a superset of E3 — everything in E3 is included, plus advanced security, compliance, and analytics.
| Feature | E3 | E5 |
|---|---|---|
| Desktop Office Apps | ✅ Yes | ✅ Yes |
| Exchange Online (100GB) | ✅ Yes | ✅ Yes |
| Intune Device Management | ✅ Yes | ✅ Yes |
| Azure AD Premium P1 | ✅ Yes | ✅ Yes |
| Azure AD Premium P2 (PIM, Identity Protection) | ❌ No | ✅ Yes |
| Microsoft Defender for Office 365 Plan 2 | ❌ No | ✅ Yes |
| Microsoft Defender for Endpoint Plan 2 | ❌ No | ✅ Yes |
| Microsoft Purview Compliance | Basic | Advanced |
| Power BI Pro | ❌ No | ✅ Yes |
| Audio Conferencing | ❌ No | ✅ Yes |
🏪 Microsoft 365 Business Plans
⚠️ User Cap
All Microsoft 365 Business plans (Basic, Standard, Premium, Apps for Business) are capped at a maximum of 300 users per tenant. Organisations that grow beyond 300 users must migrate to Enterprise (E-series) plans — there is no way to purchase Business plans for more than 300 seats.
Business Standard vs Business Premium
| Feature | Business Standard | Business Premium |
|---|---|---|
| Desktop Office Apps | ✅ Yes | ✅ Yes |
| Exchange Online, Teams, SharePoint | ✅ Yes | ✅ Yes |
| Microsoft Defender for Business | ❌ No | ✅ Yes |
| Intune Device Management | ❌ No | ✅ Yes |
| Azure AD Premium P1 (Conditional Access) | ❌ No | ✅ Yes |
| Information protection & DLP | ❌ No | ✅ Yes |
👷 Frontline Worker Plans — F1 vs F3
| Feature | F1 | F3 |
|---|---|---|
| Teams (chat, meetings, calling) | ✅ Yes | ✅ Yes |
| Exchange Online mailbox | ❌ Kiosk only (2GB, no full mailbox) | ✅ Yes (2GB full mailbox) |
| Intune device management | ❌ No | ✅ Yes |
| Azure AD Premium P1 | ❌ No | ✅ Yes |
| Microsoft 365 Apps (web/mobile) | ❌ No | ✅ Yes |
💡 When to Use Which
F1 suits shift workers who only need Teams for scheduling and communication with no email requirement. F3 is the right choice whenever the frontline worker needs an actual mailbox, device management, or Conditional Access — most organisations standardise on F3 for anyone beyond very basic communication needs.
🤖 Microsoft 365 Copilot Licensing
✅ Requirements
Copilot is an add-on license, not a standalone plan — it cannot be purchased on its own. It requires a qualifying base subscription: Microsoft 365 E3, E5, Business Standard, or Business Premium. Once the base plan is in place, Copilot is added per-user and integrates directly into Word, Excel, PowerPoint, Outlook, and Teams for that user.
🔐 Azure AD Premium P1 vs P2
| Feature | P1 | P2 |
|---|---|---|
| Conditional Access | ✅ Yes | ✅ Yes |
| Group-based licensing | ✅ Yes | ✅ Yes |
| Self-service password reset (hybrid write-back) | ✅ Yes | ✅ Yes |
| Identity Protection (risk-based sign-in policies) | ❌ No | ✅ Yes |
| Privileged Identity Management (PIM) | ❌ No | ✅ Yes |
| Access reviews | ❌ No | ✅ Yes |
💡 The Simple Way to Remember It
P1 gives you the controls (Conditional Access, group-based licensing). P2 adds the intelligence and governance layer on top — detecting risk automatically (Identity Protection) and managing who has standing privileged access and for how long (PIM, access reviews).
🔗 Group-Based Licensing in Azure AD
💡 How It Works
Instead of assigning licenses to users one by one, an admin assigns a license to a security group in Entra ID (Licenses → assign to group). Every current and future member of that group automatically receives the license, and it’s automatically removed if they leave the group. Combined with dynamic group membership rules (e.g. based on department attribute), this fully automates license assignment as people join, move within, or leave the organisation — eliminating manual per-user license management.
📦 What Happens When a License Is Removed
⚠️ Immediate Effects
- The mailbox is not deleted, but it stops sending/receiving mail and becomes inaccessible to the user
- OneDrive and SharePoint content the user owns typically becomes read-only or is retained per the tenant’s grace period policy (commonly 30 days) before deletion
- Teams, Office apps, and other licensed services stop working for that account immediately
- Data is generally preserved for a grace period (30 days by default, longer if litigation hold or retention policies apply) — re-adding the license within that window restores full access
- After the grace period expires without reassignment, mailbox and OneDrive content can be permanently deleted depending on tenant retention settings
💡 Best Practices & Recommendations
- Assign the minimum license tier each user role actually needs — frontline workers rarely need E3, F3 usually covers them at a fraction of the cost
- Use group-based licensing with dynamic groups so onboarding/offboarding automatically applies and removes the right licenses
- Review the License Usage Reports in the Microsoft 365 admin center regularly to reclaim unused licenses
- Before removing a license, confirm any legal hold or retention requirements on that mailbox — removal doesn’t bypass compliance obligations
- Standardise on Business Premium over Business Standard wherever security (Intune, Conditional Access) is a requirement, even for smaller teams
- Track Copilot licenses separately since they require a qualifying base plan — assigning Copilot without checking the base plan will fail
🎓 Common Interview Questions
📚 References & Further Reading
- 🔗 Manage Microsoft 365 licenses — Microsoft Learn
- 🔗 Assign licenses to groups in Entra ID — Microsoft Learn
- 🔗 Set up Microsoft 365 Copilot — Microsoft Learn