Enterprise Mobility + Security E3 vs E5: What Each Includes, What It Costs, and When Microsoft 365 E3 Already Covers It
Enterprise Mobility + Security (EMS) is Microsoft's identity, device-management and information-protection bundle, sold with no Office apps and no mailboxes. For one kind of tenant it is exactly the right purchase. For another it is a second payment for licenses the tenant already holds. This article lists what EMS E3 and EMS E5 contain, gives the October 2026 list prices per user per month, explains who should buy EMS (Office 365 E3 or Microsoft 365 Apps customers who need Entra ID and Intune), who already has it inside Microsoft 365 E3 or E5, and when Entra ID P2 on its own, or the Entra P2 add-on, is the smaller purchase.
What EMS E3 and EMS E5 contain
EMS is a per-user bundle of products that Microsoft also sells one at a time. Microsoft's Enterprise Mobility + Security plan comparison page lists the components as follows.
EMS E3 carries three things. Microsoft Entra ID P1, which carries Conditional Access, group-based licensing and self-service password reset with on-premises writeback. Microsoft Intune Plan 1, which manages Windows, macOS, iOS and Android devices and the apps on them. And the Microsoft Purview Information Protection P1 feature set, which gives users manual sensitivity labels in Office.
EMS E5 carries everything in E3 and steps up two of the three. Entra ID P1 becomes Entra ID P2, which adds Identity Protection (risk-based sign-in and user policies) and Privileged Identity Management (PIM); Microsoft's Entra licensing documentation puts both in the P2 tier (Microsoft Learn, Microsoft Entra licensing, June 2026, with the Identity Protection and PIM notes dated May 2025 and May 2026). Information Protection P1 becomes P2, which adds automatic and recommended labeling. EMS E5 then adds two products E3 does not have at all: Microsoft Defender for Identity, the sensor that watches on-premises domain controllers for identity attacks, and Microsoft Defender for Cloud Apps, which discovers and controls SaaS use. Microsoft's Defender for Identity licensing list names EMS E5 as one of the suites that carry it (Microsoft Learn, Defender for Identity prerequisites, source file dated September 2023).
Neither tier includes productivity services (no Office apps, Exchange Online, SharePoint, Teams or Windows Enterprise rights) or endpoint and email security (Defender for Endpoint and Defender for Office 365 are separate purchases or part of Microsoft 365 E5). Microsoft's comparison page also states that the Intune Suite's advanced capabilities (Endpoint Privilege Management, Cloud PKI and Enterprise App Management) are included with Microsoft 365 E5, not with EMS E5.
The October 2026 list prices, per user per month
The Commercial annual-term prices below are per user per year on Microsoft's list; divide by 12 for the monthly figure. Enterprise Mobility + Security E3 is $144.00 per user per year, so $144.00 ÷ 12 = $12.00 per user per month on an annual term (Microsoft list price, October 2026 price list). The same arithmetic gives these figures:
- Enterprise Mobility + Security E5: $216.00 per year, $18.00 per user per month.
- Microsoft 365 E3: $468.00 per year, $39.00. Microsoft 365 E5: $720.00 per year, $60.00.
- Microsoft Entra ID P1: $84.00 per year, $7.00. Microsoft Entra ID P2: $120.00 per year, $10.00.
- Microsoft Intune Plan 1: $96.00 per year, $8.00.
- Microsoft Defender for Identity: $66.00 per year, $5.50. Microsoft Defender for Cloud Apps: $42.00 per year, $3.50.
- Office 365 E3: $312.00 per year, $26.00. Microsoft 365 Apps for enterprise: $168.00 per year, $14.00. Microsoft 365 Business Premium: $264.00 per year, $22.00.
All of these are Microsoft list prices from the October 2026 price list, Commercial segment, annual term. The month-to-month SKUs cost more: EMS E3 is $14.40 and EMS E5 is $21.60 per user per month on a monthly term.
Two sums are worth doing once. Bought separately, Entra ID P1 ($7.00) and Intune Plan 1 ($8.00) come to $15.00 before information protection, against $12.00 for EMS E3. Entra ID P2 ($10.00), Intune Plan 1 ($8.00), Defender for Identity ($5.50) and Defender for Cloud Apps ($3.50) come to $27.00, against $18.00 for EMS E5.
Who should buy EMS
EMS exists for tenants whose productivity licensing comes from somewhere other than Microsoft 365 E3 or E5.
The first case is Office 365 E3 or E1. Those plans bring mailboxes, Teams, SharePoint and, for E3, the desktop apps, but only Entra ID Free and basic mobility and security. The moment you need Conditional Access, Intune device compliance or sensitivity labels, the clean answer is EMS E3 per user. Office 365 E3 plus EMS E3 is $26.00 plus $12.00, or $38.00 per user per month. Microsoft 365 E3 is $39.00 and adds Windows Enterprise E3 on top of the same identity and device pieces, which is why most tenants that reach this point move to Microsoft 365 E3 rather than stacking.
The second case is Microsoft 365 Apps for enterprise. Organizations that keep Exchange Server on-premises, or use another mail provider, often license only the apps at $14.00 and still need identity and device management. EMS E3 on top gives them Entra ID P1 and Intune Plan 1 without buying mailboxes they will not use: $14.00 plus $12.00 is $26.00 per user per month.
When Microsoft 365 E3 or E5 already includes it
Microsoft 365 E3 is Office 365 E3, EMS E3 and Windows Enterprise E3 in one SKU. Microsoft's Entra licensing documentation lists Entra ID P1 as included in Microsoft 365 E3, E5 and E7, Microsoft 365 F1 and F3, EMS E3 and Microsoft 365 Business Premium, and Entra ID P2 as included in Microsoft 365 E5 and E7, the Microsoft Defender Suite (formerly Microsoft 365 E5 Security) and EMS E5 (Microsoft Learn, Microsoft Entra licensing, June 2026; inclusion list dated January 2025). Microsoft's Intune licensing page lists Intune Plan 1 in the same enterprise suites, and Microsoft 365 E5 carries the Defender Suite, which brings Defender for Identity and Defender for Cloud Apps (Microsoft Learn, Microsoft 365 for enterprise overview, November 2025).
So a Microsoft 365 E3 tenant that buys EMS E3 pays twice for Entra ID P1, Intune Plan 1 and Information Protection P1 and gains nothing, and a Microsoft 365 E5 tenant that buys EMS E5 does the same for the P2 set.
The check takes two minutes. In the Microsoft 365 admin center, open a user, expand the licenses, and read the service plans. If "Microsoft Entra ID P1" and "Microsoft Intune Plan 1" already appear, that user does not need EMS E3; if "Microsoft Entra ID P2", "Microsoft Defender for Identity" and "Microsoft Defender for Cloud Apps" appear, that user does not need EMS E5. Business Premium (300 seats or fewer), F1 and F3 users already hold Entra ID P1 and Intune Plan 1, so EMS E3 on top of those is a duplicate too.
EMS E5, Entra ID P2 on its own, or the P2 add-on
The E5 feature a 50 to 500 person organization usually needs is Privileged Identity Management or Identity Protection, because an insurer or an auditor asked for it. There are four ways to get Entra ID P2, and the right one depends on what you already hold.
If you are on EMS E3, step up to EMS E5. The increase is $6.00 per user per month and it brings P2, Defender for Identity, Defender for Cloud Apps and Information Protection P2. Adding Entra ID P2 standalone instead costs $10.00 and pays for P1 twice.
If you are on Microsoft 365 E3, the October 2026 price list carries an "Entra P2 Add On" SKU under Microsoft 365 E3 at $36.00 per user per year, or $3.00 per month on an annual term (Microsoft list price, October 2026 price list). If the same user also needs Defender for Identity and Cloud Apps, the Microsoft Defender Suite, formerly Microsoft 365 E5 Security, is $144.00 per year, or $12.00 per month, and carries Entra ID P2 with the Defender products; our E5 Security and E5 Compliance add-ons article walks through that arithmetic. EMS E5 on top of Microsoft 365 E3 is the wrong move: it duplicates P1, Intune and Information Protection P1 to reach the P2 set.
If you are on Office 365 E3 and need PIM or Identity Protection but not Intune, Entra ID P2 standalone at $10.00 is the answer; if you need Intune as well, EMS E5 at $18.00 costs the same as P2 plus Intune Plan 1 bought separately and adds the two Defender products. The feature split is in Entra ID P1 vs P2, and the Intune ladder is in Intune Plan 1 vs Plan 2 vs Intune Suite.
Frequently asked questions
Is EMS E3 included in Microsoft 365 E3?
Yes. Microsoft 365 E3 is built from Office 365 E3, EMS E3 and Windows Enterprise E3. Every EMS E3 component appears in a Microsoft 365 E3 user's service plans, so buying EMS E3 for that user adds nothing.
Does EMS include Defender for Endpoint?
No. Neither tier includes Defender for Endpoint or Defender for Office 365. Those come with Microsoft 365 E5, the Microsoft Defender Suite, or standalone plans; see Defender for Business vs Defender for Endpoint.
Do I need EMS to use Conditional Access?
You need Entra ID P1, which Office 365 E3 and E1 do not include. EMS E3, Entra ID P1 standalone, Microsoft 365 E3, E5, F1, F3 and Business Premium all include it (Microsoft Learn, Microsoft Entra licensing, June 2026).
Sources
- Microsoft Learn source files on GitHub (MicrosoftDocs/entra-docs), opened 2026-10-05: "Microsoft Entra licensing", ms.date 06/18/2026, and its "entra-offerings" include, ms.date 01/31/2025; "licensing-identity-protection" include, ms.date 05/22/2025; "licensing-pim" include, ms.date 05/05/2026; "licensing-conditional-access" include, ms.date 06/10/2026
- Microsoft Learn source files on GitHub (MicrosoftDocs/ATADocs), opened 2026-10-05: "Prerequisites, Microsoft Defender for Identity", ms.date 08/28/2023, and its "licenses" include, ms.date 09/26/2023; (MicrosoftDocs/microsoft-365-docs): "Microsoft 365 for enterprise overview", ms.date 11/18/2025
- Microsoft, Enterprise Mobility + Security compare plans and pricing page (www.microsoft.com), and Microsoft Learn, "Microsoft Intune licensing": as reported by search excerpts on 2026-10-05; neither page was reachable from our environment, so verify there
- Microsoft Commercial price list, October 2026 (every list price above)
- IT Partner blog: entra-id-p1-vs-p2-conditional-access-pim-identity-protection-compliance; intune-licensing-plan-1-vs-plan-2-vs-intune-suite-remote-help-epm; microsoft-365-e5-security-and-e5-compliance-add-ons-vs-full-e5-the-math-for-e3-tenants
- IT Partner pages: EMS E3 (CFQ7TTC0LHT4), EMS E5 (CFQ7TTC0LFJ1), Microsoft 365 E3 (CFQ7TTC0LFLX, including the Entra P2 Add On SKU), Microsoft 365 E5 (CFQ7TTC0LFLZ), Entra ID P2 (CFQ7TTC0LFK5), Microsoft Defender Suite (CFQ7TTC0LHQB); content/services/ITPWW310IMPOT, ITPWW240SECOT and ITPWW490SECOT
| Your base license | What you need | Buy | List price per user per month, annual term |
|---|---|---|---|
| Office 365 E3 or E1 | Conditional Access, Intune, sensitivity labels | EMS E3 | $12.00 |
| Office 365 E3 or E1 | The above plus PIM, Identity Protection, Defender for Identity and Cloud Apps | EMS E5 | $18.00 |
| Office 365 E3 or E1 | Only PIM or Identity Protection, no Intune | Entra ID P2 standalone | $10.00 |
| Microsoft 365 Apps for enterprise | Identity and device management without mailboxes | EMS E3 | $12.00 |
| EMS E3 | PIM or Identity Protection | Step up to EMS E5, not P2 standalone | $18.00, an increase of $6.00 |
| Microsoft 365 E3 | Only PIM or Identity Protection | Entra P2 Add On, listed under Microsoft 365 E3 | $3.00 |
| Microsoft 365 E3 | P2 plus Defender for Identity and Cloud Apps | Microsoft Defender Suite | $12.00 |
| Microsoft 365 E3 or E5 | Anything EMS contains | Nothing, it is already included | $0.00 |
| Microsoft 365 Business Premium, F1 or F3 | Entra ID P1, Intune Plan 1 | Nothing, it is already included | $0.00 |
Key takeaways
- EMS E3 is Entra ID P1, Intune Plan 1 and Information Protection P1; EMS E5 steps up to Entra ID P2 and Information Protection P2 and adds Defender for Identity and Defender for Cloud Apps.
- At Microsoft's October 2026 list, EMS E3 is $12.00 and EMS E5 is $18.00 per user per month on an annual term, against $39.00 for Microsoft 365 E3 and $60.00 for Microsoft 365 E5.
- EMS is the right buy for Office 365 E3 or E1 tenants and for Microsoft 365 Apps for enterprise tenants that need Conditional Access and Intune without buying mailboxes.
- Microsoft 365 E3 already contains EMS E3 and Microsoft 365 E5 already contains the EMS E5 set, so EMS on top of either is a duplicate purchase; read the user's service plans before you order.
- For P2 alone, an EMS E3 tenant steps up to EMS E5 for $6.00 more, a Microsoft 365 E3 tenant adds the $3.00 Entra P2 add-on, and an Office 365 tenant without Intune buys Entra ID P2 standalone at $10.00.
Open Enterprise Mobility + Security E3 or Enterprise Mobility + Security E5 and use the quote button with your user count; if you are on Microsoft 365 E3 and only need P2, the add-on sits on the Microsoft 365 E3 page. For the work that follows the license, Microsoft Intune Initial Setup for Windows Device Management is $6,500 per project over 8 weeks, Microsoft Entra ID, Conditional Access Policy Implementation is $2,950 per project over 2 weeks, and Microsoft Entra PIM and Privileged Access Hardening is $3,950 per project over 2 weeks, all fixed price. Book 30 minutes with Mike with your current license mix and we will tell you which row of the table you are in.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.