EXELEGENT REFERENCE
Microsoft 365 Value Realization Matrix
What each plan includes, which capabilities are most often licensed and never configured, and which review addresses each one. Built for organizations from 250 to 5,000 employees deciding what to renew.
Verified August 2026 · 45 capabilities · 21 commonly underused
Office 365 E1$10per user / month
Office 365 E3$26per user / month
Microsoft 365 E3$39per user / month
Microsoft 365 E5$60per user / month
Business Premium$22per user / month
Microsoft 365 F3$10per user / month
How to read this
- Row selection
- Capabilities were included when they appear in renewal conversations, are commonly licensed and left unconfigured, or replace a separately purchased third party tool. This is a buying reference, not a complete feature list.
- Plan data
- Inclusion is taken from Microsoft service descriptions and product documentation. Every capability name links to its Microsoft source.
- Business risk
- The exposure created when a capability is licensed but not deployed. Not the risk of the capability itself.
- Commonly underused
- Marked where the capability is routinely present in a tenant and not configured. Based on Exelegent assessment experience rather than published data.
- Prices
- US commercial list, per user per month, annual commitment, effective July 1, 2026. Your rate depends on your agreement.
✓ Included
+ Add-on available
– Not available
● Commonly licensed and not configured
Showing all 45 capabilities
| Capability | Office 365 | Microsoft 365 Enterprise | Business | Frontline | Exelegent advisory | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| E1 | E3 | E3 | E5 | Premium | F3 | Risk | Value | Underused | Recommended review | |
| Where the money leaksCapacity, entitlement, and add-on overlap. The lines that show up on the invoice. | ||||||||||
| Desktop Office applicationsInstalled Word, Excel, PowerPoint, Outlook | – | ✓ | ✓ | ✓ | ✓ | – | Med | High | – | License optimization |
| Exchange Online mailboxPrimary mailbox capacity | 50 GB | 100 GB | 100 GB | 100 GB | 50 GB | 2 GB | Med | Med | – | License optimization |
| Exchange Online ArchivingAuto expanding archive | 50 GB | 1.5 TB | 1.5 TB | 1.5 TB | 50 GB | – | Low | Med | ● | License optimization |
| OneDrive storagePer user cloud storage | 1 TB | 1 TB | 1 TB | 1 TB | 1 TB | 2 GB | Low | Low | – | License optimization |
| Power BI ProPublish and share reports | – | – | – | ✓ | – | – | Low | High | ● | License optimization |
| Teams PhonePSTN calling capability | – | – | – | ✓ | – | – | Low | High | ● | License optimization |
| Audio ConferencingDial in for meetings | – | – | – | ✓ | – | – | Low | Med | ● | License optimization |
| Windows Enterprise upgrade rightsE3 or E5 edition rights | – | – | E3 | E5 | Business | – | Low | Med | – | License optimization |
| Microsoft 365 CopilotAI layer across the suite | + | + | + | + | + | + | Med | High | ● | Copilot readiness |
| Frontline eligibilityF series restricted to deskless staff | – | – | – | – | – | ✓ | Med | High | – | License optimization |
| What you are not detectingCoverage gaps that only become visible during an incident. | ||||||||||
| Microsoft Secure ScorePosture measurement baseline | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | Med | High | ● | Security posture review |
| Defender for Office 365 Plan 1Safe Links and Safe Attachments | – | ✓ | ✓ | ✓ | ✓ | + | High | High | – | Security posture review |
| Defender for Office 365 Plan 2Threat investigation and response | – | – | – | ✓ | – | – | High | High | ● | Security posture review |
| Defender for Endpoint Plan 1Endpoint protection and attack surface reduction | – | – | ✓ | ✓ | – | – | High | High | – | Security posture review |
| Defender for Endpoint Plan 2Endpoint detection and response | – | – | – | ✓ | – | – | High | High | – | Security posture review |
| Defender for BusinessSMB endpoint protection | – | – | – | – | ✓ | – | High | High | – | Security posture review |
| Defender for IdentityOn premises identity signal | – | – | – | ✓ | – | – | High | High | ● | Identity security review |
| Defender for Cloud AppsShadow IT and SaaS visibility | – | – | – | ✓ | – | – | High | High | ● | Security posture review |
| Attack simulation trainingPhishing simulation program | – | – | – | ✓ | – | – | Med | High | ● | Security posture review |
| Conditional AccessPolicy based access control | – | – | ✓ | ✓ | ✓ | ✓ | High | High | – | Identity security review |
| Multifactor authenticationSecond factor enforcement | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | High | High | – | Identity security review |
| Privileged Identity ManagementJust in time elevation for admin roles | – | – | – | ✓ | – | – | High | High | ● | Identity security review |
| What an auditor will ask forRetention, discovery, and evidence capability. | ||||||||||
| Audit (standard)Baseline activity logging | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | Med | Med | – | Compliance readiness |
| Audit (premium)Extended retention and intelligent insights | – | – | – | ✓ | – | – | High | Med | ● | Compliance readiness |
| eDiscovery (standard)Search, hold, and export | – | ✓ | ✓ | ✓ | – | – | Med | Med | – | Compliance readiness |
| eDiscovery (premium)Custodian management and review sets | – | – | – | ✓ | – | – | High | Med | ● | Compliance readiness |
| Litigation holdPreserve mailbox content | – | ✓ | ✓ | ✓ | – | – | High | Med | – | Compliance readiness |
| Retention policies and labelsInformation lifecycle control | – | ✓ | ✓ | ✓ | ✓ | ✓ | High | High | – | Data governance assessment |
| Records managementRegulatory record declaration | – | – | – | ✓ | – | – | Med | Med | – | Data governance assessment |
| Communication CompliancePolicy monitoring of messaging | – | – | – | ✓ | – | – | High | Med | ● | Compliance readiness |
| Insider Risk ManagementBehavioral risk signal on internal users | – | – | – | ✓ | – | – | High | High | ● | Compliance readiness |
| Customer KeyCustomer controlled encryption keys | – | – | – | ✓ | – | – | Low | Low | – | Compliance readiness |
| What blocks CopilotData governance prerequisites that determine whether AI amplifies or exposes. | ||||||||||
| Sensitivity labelsManual classification of content | – | ✓ | ✓ | ✓ | ✓ | ✓ | High | High | – | Data governance assessment |
| Automatic labelingPolicy driven classification at scale | – | – | – | ✓ | – | – | High | High | ● | Data governance assessment |
| Data Loss PreventionPrevent sensitive data leaving the tenant | – | ✓ | ✓ | ✓ | ✓ | ✓ | High | High | – | Data governance assessment |
| Endpoint DLPDLP enforcement on devices | – | – | – | ✓ | – | – | High | High | ● | Data governance assessment |
| SharePoint oversharing controlsSite access review and restriction | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | High | High | – | Data governance assessment |
| Restricted SharePoint SearchLimit Copilot grounding scope | – | – | ✓ | ✓ | ✓ | ✓ | High | High | ● | Copilot readiness |
| Copilot usage analyticsAdoption measurement | + | + | + | + | + | + | Med | High | – | Copilot readiness |
| Intune device managementManaged and compliant endpoints | – | – | ✓ | ✓ | ✓ | ✓ | High | High | – | Endpoint management review |
| Already paid for and switched offCapabilities most often licensed and never configured. | ||||||||||
| Microsoft Purview portalUnified governance console | – | ✓ | ✓ | ✓ | ✓ | ✓ | High | High | ● | Data governance assessment |
| Entra ID ProtectionRisk based sign in and user policies | – | – | – | ✓ | – | – | High | High | ● | Identity security review |
| Intune Endpoint Privilege ManagementRemove standing local admin | – | – | – | ✓ | – | – | High | High | ● | Endpoint management review |
| Microsoft Cloud PKICertificate lifecycle in Intune | – | – | – | ✓ | – | – | Med | Med | – | Endpoint management review |
| Information BarriersSegment communication between groups | – | – | – | ✓ | – | – | Low | Low | – | Compliance readiness |
Where the money leaks
Exchange Online mailbox
Primary mailbox capacity
E1 50 GBO365 E3 100 GBM365 E3 100 GBM365 E5 100 GBBus Prem 50 GBF3 2 GB
Exchange Online Archiving
Auto expanding archive
E1 50 GBO365 E3 1.5 TBM365 E3 1.5 TBM365 E5 1.5 TBBus Prem 50 GB
OneDrive storage
Per user cloud storage
E1 1 TBO365 E3 1 TBM365 E3 1 TBM365 E5 1 TBBus Prem 1 TBF3 2 GB
Microsoft 365 Copilot
AI layer across the suite
E1 add-onO365 E3 add-onM365 E3 add-onM365 E5 add-onBus Prem add-onF3 add-on
What you are not detecting
What an auditor will ask for
What blocks Copilot
Copilot usage analytics
Adoption measurement
E1 add-onO365 E3 add-onM365 E3 add-onM365 E5 add-onBus Prem add-onF3 add-on
Already paid for and switched off
What this matrix does not cover
- It is not a complete feature list. Microsoft publishes hundreds of service capabilities. This covers the ones that change a renewal decision.
- It does not reflect your negotiated price. Enterprise Agreement discounts, CSP margins, and nonprofit or education pricing all change the number.
- It does not account for standalone add-ons already purchased separately, which frequently duplicate what a bundle already includes.
- It does not tell you which of your users need which plan. That depends on usage data only your tenant holds.
- Microsoft changes licensing frequently. Check the verification date above before relying on any row.
Sources. Plan inclusion is drawn from Microsoft service descriptions and product documentation, linked from each capability name. Pricing reflects the Microsoft 365 pricing and packaging update effective July 1, 2026. Risk, value, and underuse assessments are Exelegent’s own, based on assessment work with mid market organizations, and are offered as informed judgment rather than as published research.
