Microsoft 365 E3 vs E5 — when the AU upgrade actually pays back

The Microsoft 365 E3-to-E5 upgrade is the most consequential licensing decision most Australian enterprises make. It's also the most miscommunicated. Microsoft resellers tend to lead with the security narrative; CFOs tend to lead with the per-seat delta. Both miss the actual decision driver: how much third-party tooling can E5 retire, and is that sum bigger than the upgrade premium.

The headline numbers

Microsoft 365 E3 lists at USD $36/user/month. Microsoft 365 E5 lists at USD $57/user/month. The delta is USD $21, which converts to roughly AUD $32 at typical exchange rates and Microsoft's regional adjustment. For a 500-staff tenant, that's AUD $192,000 a year of additional licensing.

Whether that AUD $192,000 is money spent or money saved depends entirely on what you currently spend on tools E5 makes redundant.

What you actually get with E5 over E3

• Defender for Identity — Entra ID-side threat detection. Replaces a category of standalone identity threat detection tools.
• Defender for Cloud Apps — full CASB. Replaces the standalone CASB market (Netskope, Palo Alto Prisma, Symantec).
• Defender for Office 365 P2 — adds Attack Simulator, Threat Explorer, automated investigation. P1 is in E3.
• Defender for Endpoint P2 — adds full EDR with automated investigation, threat & vulnerability management. P1 is in E3.
• Microsoft Purview Insider Risk Management — detects risky behaviours from inside the org.
• Microsoft Purview Communication Compliance — for regulated industries that need to monitor staff comms.
• Microsoft Purview Records Management — formal record-keeping with retention based on event triggers.
• Microsoft Purview Privacy Risk Management — for privacy team workflows.
• Entra ID P2 — Privileged Identity Management, Identity Protection, access reviews, entitlement management.
• Power BI Pro per user — included for every E5 seat. AUD $14/seat alone.
• Teams Phone Standard — included. The calling plan (PSTN connectivity) is extra.

When E5 pays back — the maths

Add up your current per-user spend on: third-party CASB, third-party identity threat detection, third-party email security if it duplicates Defender for O365, third-party SIEM if you'd downgrade tier with Sentinel as a replacement, Power BI Pro standalone, Teams Phone (or other voice), and any insider-risk or records-management tooling. If that sum is larger than AUD $32/user/month, E5 pays back. For most AU midmarket tenants pursuing Essential Eight ML2 with mature security tooling, it does.

If that sum is smaller — typically organisations that don't have third-party CASB, don't run a SIEM, don't use Power BI broadly, and aren't pursuing ML2 — E3 plus targeted add-ons is cheaper.

The middle ground — E3 plus E5 add-ons

Microsoft sells two add-ons that bring E3 part-way to E5 without the full premium. Microsoft 365 E5 Security adds the four Defender products and Entra ID P2 for ~AUD $18/user/month. Microsoft 365 E5 Compliance adds the full Purview suite for ~AUD $18/user/month. Buying E3 plus both add-ons lands at roughly AUD $90/user/month — slightly more than E5 itself, so this combination only makes sense when you want the security uplift across all users but the compliance suite for only a subset (legal, HR, regulated functions).

The mistake we see most often

Australian enterprises buy E5 for the security stack, then never deploy Defender for Identity, Cloud Apps or Purview Insider Risk. The licences sit in the bill, but the third-party tools they would replace stay running. After 12 months the CFO asks why M365 spend went up without any visible outcome, and the security team says they're 'working on the deployment plan'. Don't sign E5 without a 90-day deployment commitment and an executive willing to retire the tools E5 replaces.

The opposite mistake

Buying E3 to save money, then signing 18 months of third-party Defender-replacement contracts whose total cost dwarfs the E5 premium. The sunk-cost trap kicks in next renewal cycle and the org stays locked into the wrong stack.