Microsoft licensing is one of the most complex areas to understand in the Microsoft ecosystem. You can find thousands of ways to license across hundreds of products. Microsoft 365 (M365) is no different. Microsoft 365 business licensing is as complex as they come. But in this guide, you’ll finally get control.
Microsoft 365 is Microsoft’s offerings that include dozens of Software as a Service (SaaS) online services and software products to enable end-user productivity or modern work. This guide isn’t just based on Microsoft documentation. Instead, it’s written with you in mind.
If you know what products you’d like to use in your organization, it provides you with a thorough understanding of your licensing options.
Microsoft is constantly revising license offerings and features. Use this guide as the beginning to understanding Microsoft licensing. Before purchasing a license agreement, be sure to speak to your Microsoft Partner or your Microsoft Account Executive. If you don’t have a partner, you’ll learn how to find one later.
Microsoft M365 Licensing Terminology
The word ‘license’ can mean many different things to many different people. But, in the Microsoft world, the word has a specific meaning you should understand and is used extensively in Microsoft licensing documentation in various contexts.
What is a ‘License’?
Each Microsoft product has specific product use rights to define how you can use a product. A license is a method that allows you to take advantage of those rights.
As an example, perhaps you’d like to provide a user with a mailbox in Exchange Online. The user would need product use rights to the Exchange Online product. The product license is an Exchange Online service plan. Microsoft offers Exchange Online service plans as different user subscription licenses (SL). The Exchange Online service plan defines the specific features of Exchange Online and the product use rights the user is now licensed to use.
In short, a license provides you rights to download, install, access, and use specific features of a specific product for a specific period of time.
License Assignment
Each product has specific product terms that define how you can assign a license to an entity. For any M365 product, you will find nearly all licenses are assigned via subscription licenses.
For the remainder of this article, if you see the term ‘license,’ assume a ‘subscription license.’
User and devices typically break up license assignments with a specific timeframe. For M365, the common term lengths are for one month or one year. Once that subscription term period ends, you will no longer be able to use the features that license granted.
Microsoft does provide a 30-day grace period if you go over the time defined to your license.
A user subscription license is assigned to a real person, an employee of an organization, a contractor, etc. A user license typically has a limit to the number of devices they can use a product with.
Nearly all M365 licensing is through a user subscription license.
A device subscription license is for a single physical asset of the organization. You typically see device licenses available for Windows 10 qualified devices.
License Limitations
Even though you may have access to assign a license, that does not necessarily mean you can use it in any situation.
Maximum Devices
Within M365, most installable products, like the Microsoft 365 Apps, can only be used by a single user on up to five concurrent devices. Know that even though you purchase a user license, that doesn’t mean that user can use that product across an unlimited amount of devices!
License Reassignment Limits
Perhaps you’d like to reassign a license to another employee. If your organization still employs that employee, you’re technically not supposed to reassign that license in under 90 days.
Microsoft has no official preventative controls in place that prevent administrators from reassigning licenses too soon.
Unlocked Features not Licensed
When you assign a license to a user, Microsoft enabled features for only that user, but not all of the time. In some situations, an applied license will unlock features beyond the scope of a single user. Although this may sound like free access, you might be stung when it comes to audit time.
A common example of applying a license that unlocks more features than it should is Microsoft Defender for Office 365. When you apply a single-user Microsoft Defender license to your tenant, all users in the tenant get access to it. To prevent other users from using unlicenseable features, you’d have to ensure only users with appropriate licenses are actually using the features.
It’s best to always license users consistently with the same service plans throughout your tenant.
Service Plans
When it comes to understanding M365 licensing at a high level, you must first understand how Microsoft categorizes them. This understanding involves getting used to many of the terms it uses, like service plans.
In Microsoft-speak, a service plan is much like a product license for a single product like OneDrive, Exchange Online, etc. But, instead, it applies to specific features of specific products.
When you purchase a license, it will nearly always be part of a service plan.
For example, Exchange Online has three different service plans; Exchange Online Kiosk, Exchange Online Plan 1, and Exchange Online Plan 2. Each service plan only allows you to use specific features in Exchange Online.
Sometimes you’ll see service plans called products, licenses, subscriptions, or offers. Each of these terms refers to a service plan but in a different context.
Service Plan Suites
If you need to use multiple M365 products, chances are you’re going to go with a service plan suite. A suite is a bundle of related service plans that generally provide the easiest and most cost-effective option to license product features.
If you need specific product features, individual service plans may be for you rather than a suite. You can sometimes optimize license costs at the expense of extra management overhead if you exclude certain service plans when you know the user does not need the product or features.
Service Families
Microsoft’s highest categorization is service families. Each service family contains multiple service plan suites for specific customer segments, such as education or enterprise. The service families focus on offers for common use cases of users within those types of organizations.
At a high level, Microsoft breaks down service families for personal and commercial use. This article will only focus on commercial service families.
You will read more detail about the five commercial service families Microsoft offers in the following sections; Business, Enterprise, Education, Government, and Nonprofit.
The Business and Enterprise Service Families are the most common as they require no organizational qualifications. The Business Service Family focuses on small and medium businesses with less than 300 employees. In contrast, the Enterprise Service Family focuses on organizations of any size or those with more legacy dependencies.
| Descriptions | Qualifications | |
| Business | Small and medium business without a need for specific products and online services within the enterprise service plans. | No prerequisites |
| Enterprise | The enterprise service plans align with the most features available and for the needs of most organizations. | No prerequisites |
| Education | For accredited education institutions and in some cases libraries, Microsoft offers pricing optimized for the user model in education. | https://docs.microsoft.com/en-us/microsoft-365/commerce/subscriptions/verify-academic-eligibility |
| Government | With the numerous government requirements for cloud services, Microsoft offers specific plans to align with these compliance needs. | https://docs.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/microsoft-365-government-how-to-buy |
| Nonprofit | Microsoft offers discounts to nonprofit organizations as a charity discount. | https://www.microsoft.com/en-us/nonprofits/eligibility |
| China | Within mainland China there are additional requirements for cloud services, Microsoft offers M365 service plans through 21Vianet Group. | Ability to transact with 21Vianet |
No Service Plan
Although far less common, you’ll sometimes see products with no service plan. These products are generally marketed as products but are commonly just features of other products. The best way to identify these requirements and dependencies is through the Microsoft documentation for the specific service you’d like to use.
A couple of standalone products are Delve or Core eDiscovery, both with a dependency on an O365 service plan.
Know your Environment
Before you can begin understanding what licensing you need, you must first know what you are asking for! Microsoft 365 licensing is based on various factors, and you need to have specific information about your specific environment before you go down the licensing rabbit hole.
Asset management is never a glamorous topic, but it is without question always beneficial. Taking the time to inventory your systems, software, and user assignment will provide you with benefits beyond licensing to security and other uses as well.
First, ensure you have an accurate inventory of all devices and users in your organization. You’re going to need this count and how users use each device.
- Device – A ‘device’ is the computer where a user uses a product. A licensed device is a single physical hardware system you assign a license to. A licensed device also requires a qualifying operating system. A qualifying operating system is generally legally distributed by Microsoft directly, an authorized reseller, or by an Original Equipment Manufacturer (OEM) who sold you the device.
- User – A user is the electronic user object representing a person. The critical relationships are the user to person and the user to the devices. Without understanding these relationships licensing becomes even more complex and can introduce risk. There are situations where you may want a non-real person, like a virtual assistant, or possibly a single individual to have multiple user objects. Proper licensing in these situations is possible but may require specific service plans. For situations like this you may require a Teams Common Area Phone service plan, another similar service plan, or may even require multiple subscriptions for a single user.
Understanding M365 Service Plans
Microsoft 365 service plan suites are the core of the M365 licensing. You must understand each category of service plan to help your organization decide which ones are for. There are three different categories of service plans; Office 365, Enterprise Mobility & Security, and Windows 10.
In each category below, you’ll see a table that contains the majority of the service plans available for the business and enterprise service families.
These tables are broken down into four columns:
- Product – The service plan name
- Description – A description of the service the product provides
- Add-On – Indicates if the service plan is a “child” plan requiring another service plan
- Versions – Various “buckets” of features available in each service plan
- Link – The link to where you can find information on that particular service plan
Office 365
Office 365 services focus on end-user productivity solutions. Office 365 services include collaboration tools like the common Exchange Online for email, SharePoint Online and OneDrive for document management, and Teams for collaboration products.
Sometimes people get Office 365 and Microsoft 365 confused and think they are the same. Office 365 is a subset of Microsoft 365 and only includes end-user productivity solutions.
| Description | Add On | Versions | Link | |
| Exchange Online | Email as a Service | ☐ | Plan 1 Plan 2 Kiosk | https://docs.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-service-description |
| Exchange Online Archiving | Email Archiving as a Service | ☐ | For Exchange Online For Exchange Server | https://docs.microsoft.com/en-us/office365/servicedescriptions/exchange-online-archiving-service-description/exchange-online-archiving-service-description |
| Exchange Online Protection | Email Security as a Service | ☐ | https://docs.microsoft.com/en-us/office365/servicedescriptions/exchange-online-protection-service-description/exchange-online-protection-service-descriptionhttps://docs.microsoft.com/en-us/office365/servicedescriptions/office-applications-service-description/office-applications-service-description | |
| Microsoft 365 Apps | Office Productivity Suite, desktop apps | ☐ | For Business For Enterprise | |
| Microsoft 365 Audio Conferencing | Public Switched Telephone Network (PSTN) Dial-In Meetings | ☑ | ||
| Microsoft 365 Business Voice | Suite of Audio Conferencing, Phone System, and Calling Plan | ☑ | With Calling Plan Without Calling Plan | |
| Microsoft 365 Calling Plan | Per Minute PSTN Circuit Access | ☑ | Domestic Calling Plan Domestic & International Calling Plan | |
| Microsoft 365 Phone System | Basic Private Branch Exchange (PBX) | ☑ | ||
| Microsoft Defender for Office 365 | Advanced security services for the Office 365 services | ☑ | Plan 1 Plan 2 | https://docs.microsoft.com/en-us/office365/servicedescriptions/office-365-advanced-threat-protection-service-description |
| Microsoft Stream Plan 2 | Corporate Video Distribution Service | ☑ | ||
| Office 365 | Suite including majority of other Office 365 service plans | ☐ | E1 E3 E5 F3 | https://docs.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-platform-service-description |
| Office 365 Data Loss Prevention | Core Email and File Policy Engine | ☑ | ||
| Office for the Web | Office Productivity Suite, online browser access only | ☑ | https://docs.microsoft.com/en-us/office365/servicedescriptions/office-online-service-description/office-online-service-description | |
| OneDrive for Business | Personal Cloud Storage as a Service | ☐ | Plan 1 Plan 2 | https://docs.microsoft.com/en-us/office365/servicedescriptions/onedrive-for-business-service-description |
| Project | Suite of Enterprise Project Management Tools | ☐ | Online Essentials Plan 1 Plan 3 Plan 5 | https://docs.microsoft.com/en-us/office365/servicedescriptions/project-online-service-description/project-online-service-description |
| SharePoint Online | Document Management Platform as a Service | ☐ | Plan 1 Plan 2 Kiosk | https://docs.microsoft.com/en-us/office365/servicedescriptions/sharepoint-online-service-description/sharepoint-online-service-description |
| SharePoint Syntex | Documentation process automation | ☑ | https://docs.microsoft.com/en-us/office365/servicedescriptions/sharepoint-syntex-service-description/sharepoint-syntex-service-description | |
| Visio | Suite of Diagraming Tools | ☐ | Plan 1 Plan 2 | https://docs.microsoft.com/en-us/office365/servicedescriptions/visio-online-service-description/visio-online-service-description |
Enterprise Mobility & Security
The EM+S products focus on end-user security solutions within M365. These products manage and secure user access and the systems they use.
Two of the most common products are Azure Active Directory (AD) for employee identity and access management and Microsoft Endpoint Manager Intune.
| Product | Description | Version | Link |
| Azure AD | Multiple identity and access management (IAM) services | Premium P1 Premium P2 | https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis |
| Azure Information Protection | Additional data loss prevention (DLP) features with a primary focus of extension of discovery, classification, and protection to endpoints | Premium P1 | https://docs.microsoft.com/en-us/azure/information-protection/what-is-information-protection |
| Enterprise Mobility + Security | Suite including majority of other EM+S service plans | E3 E5 | https://www.microsoft.com/en-us/security/business/enterprise-mobility-security |
| Intune | Mobile device management (MDM) and mobile application management (MAM) platform | https://docs.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune | |
| Microsoft Cloud App Security | Cloud access security broker (CASB) with a focus as a secure web gateway and direct integrations to the broader M365 suite for additional capabilities | https://docs.microsoft.com/en-us/cloud-app-security/what-is-cloud-app-security | |
| Microsoft Defender for Identity | User and entity behavior analytics (UEBA) service with a focus on Azure AD, Microsoft Cloud App Security, and hybrid authentication sources | https://docs.microsoft.com/en-us/defender-for-identity/what-is | |
| Microsoft Endpoint Configuration Manager (formerly System Center Configuration Manager) | Robust asset configuration management platform for traditional and cloud use cases | https://docs.microsoft.com/en-us/mem/configmgr/core/understand/introduction | |
| Microsoft Identity Manager (MIM) | Comprehensive IAM platform | https://docs.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016 |
Windows 10
Windows products focus on the current major desktop operating system environment (OSE). Windows products in the M365 ecosystem focus on upgrade rights. An upgrade right is an organization’s permission to use a specific feature on an already qualified device.
A qualified device uses rights already acquired through a different product on the same agreement or an entirely separate agreement. Microsoft has a great comparison of the feature differences between the different Windows 10 products offered.
| Product | Desctiption | Version | Link |
| Microsoft Defender for Endpoint | Next generation endpoint detection and response platform | https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint | |
| Windows 10 Enterprise | Upgrade entitlement for qualifying Windows 10 Pro installations to Windows 10 Enterprise. ‘Windows 10 Enterprise refers to the Windows 10 product type of Enterprise and not the M365 Enterprise service family. | E3 E3 VDA E5 | https://docs.microsoft.com/en-us/windows/resources/ |
Your Business and Enterprise M365 Licensing Options
If you’re in a organization that’s not deemed educational or government, you’re going to need to look into the Business and Enterprise service plan offerings.
Microsoft provides discounted solutions for qualified nonprofit organizations, which are identical to the business and enterprise offerings. Microsoft requires nonprofit organizations to validate their qualifications through a registration process.
Business Service Family
The Business Service Family offers subscriptions for small and medium businesses with less than 300 users. This service family offers five service plan suites:
- M365 Business Basic
- M365 Business Standard
- M365 Business Premium
- M365 Apps for Business
- M365 Business Voice
The Business Service Plan suites are intended for customers without supporting “enterprise” functionality such as any of the “Plan 2” service plans.
The M365 Business Premium service plan suite does not include Windows Server Client Access Licenses (CALs). The exclusion of the Windows Server CAL messages that the business service family is not intended for customers who still need to support Microsoft legacy products.
Enterprise Service Family
Microsoft 365 Enterprise offerings align with the majority of organizations. There is no minimum or maximum user limit. This service family offers over 50 distinct service plans and even more service plans included but not as distinct subscriptions. This service family offers seven service plan suites:
- M365 Enterprise E3
- M365 Enterprise E5
- M365 Enterprise F1, an option for frontline workers
- M365 Enterprise F3, an option for frontline workers
- Office 365 E1
- Office 365 E3
- Office 365 E5
- Office 365 F3, an option for frontline workers
Your Education M365 Licensing Options
The Microsoft 365 Education Service Plan Suites provide similar subscriptions as the Enterprise Service Family. Still, they can only be used by educational institutions, administrative offices, boards of education, public libraries, and public museums.
Generally, the Education Service Plans provide comparable experiences to those within the Enterprise Service Plans. But, certain solutions, such as Teams, provide user experiences focused on educational institution needs rather than those within the enterprise.
Educational service plan suites come with a Student Use Benefit. This privilege allows a free license for up to 40 students for every paid faculty or staff. The Student Use Benefit does not provide a direct license mapping and can map to lower feature sets for students, and the ratio may not always be 40 to 1 so always check the licensing provided.
The service family offers over 90 distinct subscriptions for online services or software, and even more, are included but not as distinct subscriptions. Although, many of these are duplicate subscription offerings, with one for faculty and one for students. The service family offers six service plan suites with any interesting information about each below:
- Microsoft 365 A1
- Microsoft 365 A3
- Microsoft 365 A5 – Providing students with Windows 10 Education A3 equivalency
- Office 365 A1 – Available to qualified institutions at no cost
- Office 365 A3
- Office 365 A5
Your Government M365 Licensing Options
If you’re in a governmental organization, the Government M365 service plan suites will be for you. Although similar to the Enterprise offerings, the Government service plan suites have different offerings to meet your organization’s compliance attestation needs.
Given additional compliance requirements, not all features in Enterprise service plans suites will be available in Government offerings.
The Government service family consists of six different service plan suites:
- Enterprise Mobility + Security E3 for Government
- Enterprise Mobility + Security E5 for Government
- Office 365 GCC F3
- Office 365 GCC G1
- Office 365 GCC G3
- Office 365 GCC G5
This service family offers over 40 distinct subscriptions within GCC and many more within GCC-High and DoD.
Microsoft provides extensive compliance adherence for the GCC, GCC-High, and DoD offerings. The major distinctions are the supporting infrastructure, integrations, and feature availability differences between these offerings.
With GCC, there are shared components with the commercial offerings, but with delays in feature releases. The delays in feature releases are mainly due to additional compliance requirements. Richard Wakeman, with Microsoft, has built the best reference for understanding the complexities of these distinct offerings and their compliance adherence.
How to Buy Microsoft Licenses
Now that you’ve gotten a (hopefully) good understanding of your M365 licensing options, where can you buy them? You can buy them directly from Microsoft’s M365 Admin Center or via a Microsoft Partner.
M365 Admin Center
One of the easiest ad-hoc ways to purchase licenses is through the M365 Admin Center. By purchasing directly through Microsoft, you forego the hassle of talking through options with a Microsoft Partner. This method can be easy when you know what you need, but may not be the most cost-effective.
Microsoft Partner
Most of the time, organizations choose to use a Microsoft partner to help acquire licenses. A Microsoft partner will help you navigate the complex world of M365 licensing.
If you are looking for a partner, Microsoft has a search tool. Microsoft also has a bulk order sales team to assist organizations in placing orders.
Microsoft has two active partner programs that can offer M365 subscriptions called a Licensing Solutions Provider (LSP) and Cloud Solutions Provider (CSP).
Licensing Solutions Provider
The LSP Partner Program is aging, but purchase agreements through this program are still viable for enterprises with thousands of users. Licensing Solutions Providers offer volume licensing contracts or agreements, one year or three years in term length.
Cloud Solutions Provider
The Cloud Solutions Provider program is the modern program set to replace the LSP Partner Program eventually. The notable difference with a CSP is there is only a single agreement, the Microsoft Customer Agreement (MCA); with LSPs, there were multiple agreements you could purchase. Cloud Solutions Providers offer subscriptions with a monthly or annual term period.
The CSP and LSP Partner Programs are not mutually exclusive. Your partner may be able to offer your organization an agreement as either type.
If you’re in a government organization, you can purchase GCC-High service plans directly from Microsoft or from a Microsoft Licensing Solution Provider (LSP). Subscriptions for DoD are only available from Microsoft directly. Microsoft requires customers to validate their qualifications for GCC or GCC-High through a registration process. The DoD subscriptions are by invitation only.
Obtaining Technical Support
With so many complexities and nuances, you likely will want to know the best place to ask questions as they come up. The support you have access to is relative to who you purchase your licenses from.
If you purchase from Microsoft directly, Microsoft will also handle the technical support. When you are purchasing on a traditional volume license agreement, your support will be direct with Microsoft. You will either have access to the included support or through your organization’s Unified or Premier Support agreements.
The Unified and Premier Support agreements are support plans with additional benefits beyond the included technical support for products. If you purchase from a CSP, the CSP will handle the first call for technical support. The CSP will also be able to escalate to Advanced or Premier Support for Partners when necessary.
Admin Portal
The M365 Admin Portal is the easiest method to determine your support model. When you log in as a user with appropriate roles, you will access Support > New service request, and the support blade will pop out from the right side. You need to search for your topic before the contact support option becomes available. Once it becomes available, you will see a form to contact Microsoft support directly or the contact information of your partner.
Direct & Volume
When you purchase directly from Microsoft, you will see a form similar to below. The same form is shown when you purchase a legacy volume license agreement, such as an Enterprise Agreement (EA). If your organization maintains Unified Support or Premier Support, you will have a different experience. In all cases, Microsoft is your first and primary point of contact.
Cloud Solutions Provider
When you purchase from a Cloud Solutions Provider (CSP) partner on a modern agreement, they will also provide support. In place of the form on the contact support tab, you will see your partner’s email and phone number. Your partner will maintain Advanced Support for Partners or Premier Support for Partners for escalation to Microsoft. Your partner will be your first and primary point of contact.
Conclusion
Wow! There’s a lot to M365 licensing. Hopefully, this Ultimate Guide will give you enough background information to help you on your licensing journey.
Microsoft licensing is complex. Take the knowledge in this article as a seed to help you understanding M365 licensing further but also consult Microsoft or a Microsoft partner directly to verify you’re always licensed accurately and at the best cost possible.
