Microsoft 365 E3 Security Add-Ons. Get the controls that actually enforce, without moving to E5.

They are three Microsoft security upgrades that E3 customers can buy individually through a Cloud Solution Provider: Microsoft Entra ID P2, the Defender for Endpoint P2 add-on, and the Defender for Office 365 P2 add-on. Each one lifts a capability your E3 subscription already carries at the Plan 1 level up to the Plan 2 level. None of them requires moving your organization to a different Microsoft 365 plan.

This did not all land at once, and the timeline is worth knowing because it explains why your partner may never have raised it. In January 2026 Microsoft made Entra ID P2 and Defender for Endpoint P2 available to existing Microsoft 365 E3 customers through CSP, with what it called "incremental, programmatic step up pricing; the same pricing model previously available through EA and MCA E motions." In August 2026 it listed the set including the Defender for Office 365 P2 add-on and described "consistent pricing across Enterprise Agreements (EA) and CSP."

Microsoft describes the buyer plainly: "customers who want to upgrade to advanced security, but aren't ready to commit to" the full enterprise suite. Closing the gap between the two purchasing models means the conversation can be about which capability you need rather than which paperwork you signed. The reason the ladder now reads cleanly, though, is a change to E3 itself that most customers have not noticed.

Microsoft 365 E3 now includes Defender for Office 365 Plan 1, which it did not before July 1, 2026. Microsoft's own service description is direct: "Beginning July 1, 2026, Microsoft Defender for Office 365 Plan 1 is included with Office 365 E3 and Microsoft 365 E3. This adds Plan 1 protection (Safe Links, Safe Attachments, anti-phishing, real-time detections); it doesn't include Plan 2 capabilities."

If your last licensing review predates this summer, your notes are wrong on this point, and the mistake runs in your favor for once. Safe Links and Safe Attachments are not something you need to go buy. Check whether they are switched on and tuned, because an entitlement nobody configured protects nobody.

On the endpoint side, E3 has carried Defender for Endpoint Plan 1 for a while. Microsoft's Defender service description states that Plan 1 "is available as a standalone user subscription license and as part of Microsoft 365 E3/A3/G3." Plan 1 covers next-generation antivirus, attack surface reduction, device control, and manual response actions taken by hand. Plan 2 is where detection and response becomes automatic. On identity, E3 ships Microsoft Entra ID P1, which gives you Conditional Access. The catch there is narrow, specific, and the whole point of the section after this table.

Because the policy and the risk signal it depends on are licensed separately. A risk-based Conditional Access policy acts on a risk level, and that risk level is produced by Microsoft Entra ID Protection, which Microsoft licenses at the P2 tier. Microsoft 365 E3 includes P1. So the coverage a risk-based policy can give you is bounded by how many of the users it targets hold a P2 entitlement, and a policy list on its own does not show you that number.

Microsoft says both halves plainly. On what those policies do: risk-based Conditional Access policies "can be enabled to require access controls such as providing a strong authentication method, perform multifactor authentication, or perform a secure password reset based on the detected risk level." On what produces the detected risk level: "Using this feature requires Microsoft Entra ID P2 licenses." Microsoft's configuration guide for risk policies repeats it: "The Microsoft Entra ID P2 or Microsoft Entra Suite license is required for full access to Microsoft Entra ID Protection features."

Read those two together and coverage becomes a licensing question as much as a configuration one, which is not how most teams think about Conditional Access. A screenshot of the policy list is weak evidence of coverage on its own, because it shows what is configured and not who is entitled. This is why ABT's security assessments report what a control can do for a named population rather than whether it appears in a list, and it is a finding that surprises IT directors more often than it should.

The mixed-tenant version is the harder one to spot, because it sits inside a tenant that is otherwise fine. If some of your people hold P2 and some do not, one policy scoped to all users covers two populations with different entitlements behind them. Microsoft documents the licensing requirement; what it cannot tell you is how many of your users fall on each side of it. That number is worth establishing in your own tenant rather than inferring from the policy list.

We did exactly that in our own tenant. ABT's corporate tenant is itself mixed-license: 43 of its 483 enabled users hold no Entra ID P2, and all 43 sit inside the targeting of two enabled risk-based Conditional Access policies. We pulled thirty days of interactive sign-in records and compared the two populations. Wherever those policies show up in a sign-in's evaluation record they look exactly the same for both groups, present and marked not applied on routine sign-ins, and nothing on any row says which users the risk signal actually protects. The one record that shows the mechanism working belongs to a licensed user: a sign-in Microsoft scored as medium risk, closed with Microsoft's own annotation that the user satisfied multifactor authentication driven by a risk-based policy. The unlicensed population produced no such record, and across those thirty days none of them tripped a risky sign-in for the policies to act on, so what the records establish is the quiet-day picture: nothing in the logs distinguishes the two groups. The only place their situation is visible at all is the license roster itself.

One caution before anyone signs anything. For detection and response, partial coverage produces partial visibility, and the gaps are exactly where an attacker has room to work. Make the scope a decision rather than a rounding of the budget, and write down which you chose. There is also a point where the arithmetic stops favoring add-ons: attach enough of them and the packaged Defender and Purview suites, or Microsoft 365 E5 itself, become the cheaper answer. A partner who will not run that comparison for you is not doing the job.