Microsoft 365 E5 Security Features Banks Pay For But Don't Use

If your institution moved from Microsoft 365 E3 to Microsoft 365 E5, you are paying Microsoft an additional $21 per user per month, every month, in exchange for a defined bundle of nine security and compliance features. None of those features turn themselves on. Each one requires a tenant configuration step inside the Microsoft Defender portal, Microsoft Entra admin center, or Microsoft Purview portal before it produces any value. Skip the configuration step, and the feature still costs you the same money.

This is one of the most common patterns we see at banks, credit unions, and mortgage companies that bought into the Microsoft 365 E5 promise: the license is on the invoice, the security stack is sitting in the tenant unused, and the team is still buying point products from third-party vendors to fill gaps that E5 already covers. The good news is that every E5 feature is verifiable. Your IT team can open the right Microsoft 365 admin console today and confirm whether each piece of the stack is active or sitting dormant.

The numbers matter, especially with the July 1, 2026 price increase only weeks away. Microsoft announced on December 4, 2025 that Microsoft 365 E5 list pricing rises from $57 to $60 per user per month, a roughly 5 percent increase. For a 100-employee community bank, credit union, or mortgage company that means the annual cost of E5 jumps from $68,400 to $72,000. If the security features are not active, that is $25,200 to $28,800 in unrealized value each year, sitting next to a security team that may be paying third-party vendors for capabilities the E5 license already includes.

How much your bank pays for Microsoft 365 E5 in 2026

Microsoft 365 E5 lists for $57 per user per month for commercial and enterprise customers with annual commitment, as of May 2026. Microsoft 365 E3 lists for $36 per user per month on the same terms. The differential, $21 per user per month, is the price tag on the E5 security and compliance stack. Microsoft published these prices on its commercial licensing news page and confirmed them in the December 4, 2025 announcement that previewed the July 2026 price adjustments.

For a financial institution running 100 Microsoft 365 seats, the E3 line item is $43,200 per year and the E5 line item is $68,400 per year. The $25,200 spread is what your CFO is approving each renewal to buy you nine extra security capabilities plus an extra Microsoft Sentinel data benefit. After July 1, 2026, those same 100 E5 seats list at $72,000 per year, putting the upcharge for the security stack at $28,800.

The internal question this article is built to answer is straightforward: are we activating the nine security features and the Sentinel benefit that justify the $21-per-user-per-month spend? If yes, E5 is a value-priced consolidation: one vendor, one bill, one identity, one set of controls, one audit trail. If no, your institution is buying license inventory and topping it up with third-party point products that duplicate features sitting unused inside your own tenant.

The nine security features E5 adds over E3

Microsoft 365 E3 already includes a baseline security stack: Microsoft Defender Antivirus, Microsoft Defender for Endpoint Plan 1 (next-generation antimalware plus attack surface reduction), basic Microsoft Purview Information Protection, basic data loss prevention, and Microsoft Entra ID Plan 1 with Conditional Access. When you upgrade to E5, you do not lose any of that. Instead, Microsoft adds nine distinct capabilities on top.

The most useful way to read the E5 stack is feature by feature, mapped to the Microsoft Learn page that documents what each capability does and to the admin portal where you can confirm whether it is active in your tenant.

That table is the entire E5-over-E3 value proposition in one view. Ten line items if you split Entra ID P2 into PIM and Identity Protection (Microsoft sometimes counts them as one feature license, sometimes as two capabilities). The combined feature inventory is the same either way.

The 9 Microsoft 365 E5 security features that are not included in E3, mapped to the Microsoft Defender, Microsoft Entra, and Microsoft Purview portals where each is configured.

How to verify each E5 feature is actually turned on

Every feature in the E5 stack has a specific surface inside one of the three Microsoft 365 admin portals where its activation status is visible. The fastest way to inventory what is and is not active in your tenant is to walk through each portal once with this list in hand. It takes about an hour for a tenant under 250 seats, and the answers do not require deep configuration expertise. You are looking for a single question: does the feature show as active, or does it show as not configured?

Start with the Microsoft Defender portal at security.microsoft.com. The portal home page shows a tenant-wide Microsoft Secure Score along with security recommendations grouped by product family. If Defender for Office 365 Plan 2 is active, you will see Threat Explorer in the left navigation under Email and collaboration, and the Investigations area will list any auto-investigations the AIR engine has spun up in the last 30 days. If Defender for Endpoint Plan 2 is active, the Assets blade will show your enrolled devices and the Vulnerability management area will populate with a CVE inventory. If Defender for Cloud Apps is active, the Cloud apps area will list the SaaS apps discovered in your tenant.

Next, move to Microsoft Entra admin center at entra.microsoft.com. Privileged Identity Management appears in the left navigation under Identity governance. If PIM is active, you will see a list of eligible role assignments and recent activations. If you see a "Get started with PIM" splash and no role assignments, PIM is licensed but not configured. Identity Protection appears under Protection in the left navigation, and the dashboard shows recent risky users, risky sign-ins, and risk detections. A flat dashboard with no detections in a tenant of any size usually means the feature was never enabled, not that the tenant has zero risk.

Finish in Microsoft Purview portal at purview.microsoft.com. Each of the four Premium services has its own solution area in the left navigation: Information Protection, eDiscovery, Insider Risk Management, and Communication Compliance. For each one, look for an active policy or case list. Empty solution areas with no policies configured is the most common state at financial institutions that bought E5 but have not yet deployed the compliance stack.

The free Microsoft Sentinel benefit most E5 buyers don't claim

Hidden inside the E5 license, alongside the nine features in the table above, is a separate benefit that Microsoft markets less aggressively: free Microsoft Sentinel data ingestion. The official Microsoft Learn billing page for Microsoft Sentinel documents the policy directly. Microsoft 365 E5, A5, F5, and G5 customers receive a data grant of up to 5 megabytes per user per day for Microsoft 365 data ingestion into Microsoft Sentinel, applied automatically with no separate sign-up.

Five megabytes per user per day does not sound like much in isolation. For a 100-employee credit union, however, it compounds to roughly 18 gigabytes of free Sentinel ingestion per month, or about 219 GB per year, depending on the data sources actually piped into Sentinel. At Microsoft's commercial Sentinel pay-as-you-go ingestion rate, that benefit is worth several thousand dollars annually in avoided ingestion cost, sitting unused on the same E5 license your institution already pays for.

The eligible data sources for the 5 MB-per-user-per-day grant are the high-value ones for FFIEC, NCUA, and OCC audit narratives: Microsoft Entra ID sign-in and audit logs (every authentication event, including risky sign-ins), Microsoft Defender for Cloud Apps Shadow IT discovery logs, Microsoft Purview Information Protection logs (every sensitivity-label application and DLP detection), and Microsoft 365 advanced hunting data. Those four sources, ingested into Sentinel, form a strong baseline for identity and data-loss telemetry that examiners increasingly expect to see correlated in a single SIEM view.

For institutions running a separate SIEM today (Splunk, Sumo Logic, LogRhythm, or a Sentinel competitor), the benefit becomes a real decision: keep paying a third-party for what is essentially the same data, or shift the four eligible Microsoft 365 sources to Sentinel and let the free grant absorb the ingestion cost. Either way, leaving the benefit unclaimed while paying for E5 is the worst outcome.

The activation order: which features to turn on first

If your institution has not configured the E5 stack, do not try to enable everything in the same week. The features have dependencies, deserve different rollout cadences, and require different team skills to operate. The order below is the sequence that returns the most security and audit value the fastest, based on what we see banks, credit unions, and mortgage companies actually need most when their E5 stack is dormant.

The activation order most banks, credit unions, and mortgage companies should follow when standing up a dormant Microsoft 365 E5 security stack. Identity governance first, threat protection next, data protection in the middle, behavioral analytics last, Sentinel ingestion to close the loop.

The reason E5 looks expensive is that the bill arrives in full every month. The reason it stops looking expensive is when you do the activation work. Microsoft already paid for the engineering; you already paid for the license. The only thing left is the configuration.

How banks, credit unions, and mortgage companies deploy E5 in practice

The activation order above is the theoretical answer. In real-world Microsoft 365 tenants at community banks, credit unions, and mortgage companies, the deployment typically falls into one of three buckets. Knowing which bucket your institution lives in tells you where the biggest spending leak is and which features will produce the most audit-ready value the fastest once activated.

Most banks, credit unions, and mortgage companies we work with start the conversation at License-Only or Threat-Protection. Almost none start at Fully-Deployed without help. The activation gap is not a Microsoft engineering problem; the features work, the documentation exists, the controls are clear. It is a sequencing-and-skills problem, and it is the gap a Tier-1 Microsoft Cloud Solution Provider that specializes in financial services is built to close.

For institutions that want to move from License-Only or Threat-Protection up to Fully-Deployed, the practical path is to verify the tenant's current state first using Microsoft Secure Score and the portal walkthrough described earlier, then sequence the activation against the eight-step order in this article. Doing it inside a single quarter is realistic for a 100-employee bank, credit union, or mortgage company. Pairing the activation work with a managed-detection-and-response (MDR) operating model means the alerts and detections the new E5 stack starts producing actually get triaged and acted on, instead of piling up unread in the Defender portal.

For a deeper look at how the E5 stack sits next to E3 and Microsoft 365 Business Premium for community-sized financial institutions, the Microsoft 365 E3 vs E5 vs Business Premium companion article walks through the licensing decision. The Microsoft 365 license audit guide shows how to audit current license assignment for waste before adjusting upward or downward. And for the broader security control mapping to FFIEC, GLBA, and OCC expectations, see Microsoft 365 compliance for GLBA and OCC requirements at community banks.

Frequently Asked Questions