Most asked Microsoft 365 licensing questions

Per tenant. The 300-seat cap counts every Business plan in the tenant together. Business Premium is the security suite for smaller companies; E3 has no seat cap and adds Windows Enterprise, Exchange Online Plan 2 and more Microsoft Intune. You can mix the two, so user 301 can just get E3.

• The limit applies to the whole Business family in a tenant, not to each plan. Microsoft’s own example: with 250 Business Premium seats, you can add only 50 more Business seats. [1]
• User 301 doesn’t push everyone onto E3. Business and Enterprise plans can sit side by side in one tenant, and each user gets only the features of their own licence. [1]
• You get the Microsoft 365 Apps, Exchange Online Plan 1, Microsoft Entra ID P1 (Conditional Access), Microsoft Intune Plan 1, Microsoft Defender for Business, Microsoft Defender for Office 365 P1 and a Windows 11 Pro upgrade. [2]
• E3 has no seat cap. It adds Exchange Online Plan 2, Windows Enterprise E3, Microsoft Defender for Endpoint P1 and eDiscovery (Standard). Since July 2026 it also includes Microsoft Defender for Office 365 P1, Microsoft Intune Plan 2 features, Remote Help and Advanced Analytics. [3]
• One tenant can’t mix Microsoft Defender for Business with Microsoft Defender for Endpoint P1 or P2. A company that grows past 300 users usually has to move its endpoint security. [4]

Check the Microsoft service description on Microsoft Learn: it lists which licences grant each feature, and the Product Terms are the contract behind it. Licensing is per user. Everyone who benefits needs the licence, even when the feature runs for the whole tenant.

• The service descriptions (Microsoft Defender, Microsoft Entra, Microsoft Intune, Microsoft Purview and others) are the main reference for which licence gives which feature. For each feature they list the suites and add-ons that grant it. [1]
• Your use rights are defined in the Product Terms. Where a slide or PDF says something else, the Product Terms win. [2]
• “Product names and service plan identifiers for licensing” maps each SKU to the service plans it provisions. Useful for admins, but it doesn’t state use rights. [3]
• Many services run tenant-wide and can’t be restricted technically. Every user who benefits still needs a licence: eDiscovery (Premium) custodians, for example, or everyone whose mailbox Microsoft Defender for Office 365 protects. [4]
• Conditional Access needs Microsoft Entra ID P1, which comes in Business Premium, E3 and EMS E3. Risk-based policies need Entra ID P2, which comes in E5 or the Microsoft Defender Suite. [5]

Each Microsoft 365 Copilot user needs a qualifying Microsoft 365 base licence, a paid Copilot licence, a Microsoft Entra ID account, a primary mailbox in Microsoft Exchange Online and the Office apps on Current or Monthly Enterprise Channel. Copilot Business is for Business plans up to 300 users; Microsoft 365 Copilot covers everyone else.

• Qualifying base plans include Microsoft 365 Business Basic, Standard and Premium, E3, E5, F1 and F3, the Office 365 plans, Microsoft 365 Apps, Microsoft Teams Enterprise, and the Exchange, Microsoft SharePoint and Microsoft OneDrive plans. Microsoft 365 E7 already includes Microsoft 365 Copilot. [1]
• Users need a Microsoft Entra ID account and a primary mailbox in Microsoft Exchange Online; on-premises mailboxes are not supported. The Microsoft 365 Apps must be licensed per user, not per device. Some features also need Microsoft OneDrive. [2]
• Microsoft 365 Copilot needs Current Channel or Monthly Enterprise Channel. From July 2026, Semi-Annual Enterprise Channel was merged into Monthly Enterprise Channel. [3]
• Microsoft 365 Copilot Chat is free with a work account. Since July 2026 it also shows up in Word, Excel, PowerPoint, Outlook and OneNote. Answers from your own mail, files and chats, Copilot in Microsoft Teams meetings and the Researcher and Analyst agents need the paid licence. [1]

It depends on which suites you need, and ClearSource has no South African list price for the two enterprise suites yet. Microsoft 365 E3 (USD 39,00) takes two add-ons: the Microsoft Defender Suite and the Microsoft Purview Suite (formerly E5 Compliance). Microsoft 365 E5 costs USD 60,00. E3 plus both suites still lacks Microsoft Teams Phone and Power BI Pro, which E5 includes.

• The Microsoft Purview Suite covers automatic labelling, DLP for Microsoft Teams and devices, Insider Risk Management, Communication Compliance, eDiscovery (Premium), Audit (Premium), records management, Customer Key and Customer Lockbox. [1]
• E5 has things neither suite offers: Microsoft Teams Phone, Audio Conferencing, Power BI Pro, Windows Enterprise E5 and a Microsoft Security Copilot allowance. Since summer 2026 it also includes Microsoft Intune Endpoint Privilege Management, Cloud PKI and Enterprise App Management. [2]
• Business Premium tenants use the Microsoft Defender Suite and Microsoft Purview Suite for Business Premium (up to 300 seats). The enterprise suites require E3. [3]

Business Premium and E3 give you manual sensitivity labels, DLP for email and files, retention policies and Audit (Standard). Automatic labelling, DLP for Microsoft Teams and devices, records management, eDiscovery (Premium), Audit (Premium), Insider Risk and Communication Compliance need E5 or the Microsoft Purview Suite.

• Business Premium, E3 and E5 all include manual sensitivity labels. Automatic labelling, whether in the Office apps or on stored mail and files, needs E5, Office 365 E5 or the Microsoft Purview Suite. [1]
• Business Premium and E3 include DLP for Exchange, Microsoft SharePoint and Microsoft OneDrive. DLP for Microsoft Teams chats and for Windows and macOS devices needs E5 or the Microsoft Purview Suite. [1]
• Business Premium and E3 include organisation-wide retention policies (Microsoft Teams included) and manual retention labels. Auto-applied labels, adaptive scopes, event-based retention, records and disposition review need E5 or the Microsoft Purview Suite. [1]
• eDiscovery (Premium) needs E5 or the Microsoft Purview Suite, for the admins and for the custodians whose data is searched. Audit (Premium), with one-year log retention, needs E5, the Purview Suite or a Business Premium Purview add-on. [1]
• Business Premium tenants can add the Microsoft Purview Suite for Business Premium (up to 300 users). It brings automatic labelling, DLP for Microsoft Teams and devices, records management, Insider Risk, Communication Compliance, eDiscovery (Premium) and Audit (Premium). [2]

Core data can. Microsoft commits to storing core Microsoft 365 data of South African tenants in South Africa at no extra cost. Broader guarantees need the paid Advanced Data Residency add-on. Customer Key, Advanced Message Encryption and Customer Lockbox need E5, E7, Office 365 E5 or a Microsoft Purview Suite. ClearSource does not state which data is stored where; Microsoft’s pages are listed below.

• For tenants provisioned in South Africa, Microsoft’s Product Terms commit to storing core Microsoft 365 data at rest in South Africa, including Exchange Online mailbox content and SharePoint site content, at no extra cost; broader guarantees need the paid Advanced Data Residency add-on. [1]
• Microsoft lists Cape Town and Johannesburg as its datacentre locations for South Africa. The “Store Microsoft 365 customer data in-country” setting is available only to tenants in five European countries, not South Africa. [1]
• Advanced Data Residency commits data at rest in Exchange, Microsoft SharePoint, Microsoft Teams and more to your local datacenter region; South Africa is eligible. It must be licensed for 100% of the tenant’s eligible paid seats. [2]
• Microsoft’s plan comparisons list Advanced Data Residency as an add-on to 12 plans (Business Basic, Standard and Premium; Microsoft 365 E3, E5, E7, F1 and F3; Office 365 E1, E3, E5 and F3) and as included in none. It has no SKU and no South African list price. [3]
• Customer Key, Advanced Message Encryption and Customer Lockbox are included in Microsoft 365 E5 and E7, Office 365 E5 and the Microsoft Purview Suite, not in E3. Basic Message Encryption is in E3, E5 and E7. [4]
• Business Premium includes Basic Message Encryption. Customer Key, Advanced Message Encryption and Customer Lockbox come with the Microsoft Purview Suite for Business Premium. [5]
• Customer Key encrypts Microsoft 365 data at rest with root keys you provide and control, on top of Microsoft’s own encryption. [6]

Any user who benefits from a P1 feature. That means everyone in scope of Conditional Access (MFA enforced through it included), members of dynamic groups, users of password reset with on-premises writeback and holders of custom admin roles. If you need none of that, the free Security defaults give you baseline MFA.

• Conditional Access, self-service password reset with on-premises writeback and MFA for on-premises apps all belong to P1. Each intended user needs a licence, even where the feature technically runs without one. [1]
• Every unique member of a dynamic group needs P1. You don’t have to assign the licences, but the tenant must own that many. Device-based dynamic groups need no licence. [2]
• Business Premium, E3, E5, E7, F1, F3 and EMS E3 include P1, and it is also sold on its own. Business Basic, Business Standard and the Office 365 plans come with Microsoft Entra ID Free only. [3]
• Guests don’t take per-user licences. External ID bills per monthly active user, and the first 50,000 monthly active users are free, P1 and P2 features included. [4]
• Security defaults cost nothing: MFA registration for everyone, MFA for admins, and legacy sign-ins blocked. They are all or nothing, and you can’t combine them with your own Conditional Access policies. [5]

Not by default. A shared mailbox is free up to 50 GB. It needs a licence once it is larger, has an archive, sits on litigation hold, or benefits from licensed features such as Microsoft Defender for Office 365 or retention. Everyone who opens it needs their own licence. Room and equipment mailboxes don’t.

• Without a licence, a shared mailbox holds up to 50 GB. To go up to 100 GB, the mailbox needs Exchange Online Plan 2. [1]
• An archive, an auto-expanding archive or litigation hold needs Exchange Online Plan 2, or Plan 1 with the Exchange Online Archiving add-on. [2]
• Microsoft’s terms for Microsoft Defender require a licence for every shared mailbox that benefits from Microsoft Defender for Office 365, and for every user who accesses a protected mailbox. [3]
• Anyone who opens a shared mailbox needs their own Microsoft Exchange Online licence. Block sign-in on the shared mailbox’s own account: once it is used as a normal account, it is no longer a shared mailbox. [1]
• Room and equipment mailboxes need no licence and stop at 50 GB. You may not use a shared mailbox just to collect copies of everyone’s mail for archiving. [2]

Monthly costs 20% more: Business Premium is USD 26,40 instead of USD 22,00. In return, you can reduce seats every month. Annual fixes the price for the year, but you can only reduce or cancel seats within 7 days of buying or renewing.

• Microsoft’s South African site shows the 20% premium for monthly terms. Business Standard: USD 16,80 monthly against USD 14,00 annual. Business Basic: USD 8,40 against USD 7,00. [1]
• Since 1 April 2025, paying an annual or three-year term in monthly instalments costs 5% more than paying upfront. That holds in every channel: web direct, partner and MCA-E. [2]
• A cancellation with a prorated refund works only within 7 days (168 hours) of a term starting or renewing. After that, all you can do is switch off auto-renewal. [3]
• You can add seats at any time; they share the subscription’s price and end date. Removing seats works only in the same 7 days. Otherwise it takes effect at renewal. [4]
• Since 2026, partner subscriptions with auto-renewal off no longer simply end. They move to a month-to-month extension at the monthly price plus 3%. [5]

Possibly. Since January 2025 Microsoft no longer renews some cloud EAs, mostly small and mid-sized ones, and tells those customers individually. They move to CSP (Microsoft’s Cloud Solution Provider programme: an IT partner bills and supports you), or buy direct under the Microsoft Customer Agreement for Enterprise (MCA-E). Since November 2025 EA renewals also no longer get volume discounts for levels B to D.

• From 1 January 2025, “a small percentage” of cloud EAs can no longer be renewed. In their place Microsoft recommends CSP for partner services and support, or MCA-E for buying direct. [1]
• Microsoft has published no seat threshold. Microsoft’s EA page still says 500. Only your Microsoft account team or partner can confirm your case. [2]
• MCA-E is Microsoft’s direct, open-ended agreement. It has no purchase minimum, is available in South Africa and bills South African customers in US dollars. [3]
• Unlike the EA, there is no annual true-up: you buy seats when you add them. Prices are locked per subscription term, and you can only reduce seats at renewal. [4]
• In CSP the partner handles support, and you can no longer open tickets with Microsoft yourself. Under MCA-E, enterprise support is a separate Microsoft Unified Support contract. [5]

Same products, same Microsoft Customer Agreement. What differs is who bills you, who supports you and who can administer your tenant. A CSP partner suits most small and mid-sized companies that want local support. Buying direct suits strong in-house IT, or large organisations that negotiate MCA-E and buy Microsoft support.

• Partners set their own prices. Depending on margin, services and promotions, these can sit above or below Microsoft’s estimated retail (direct) price. [1]
• Under CSP the partner owns support and escalates to Microsoft. You can’t open Microsoft tickets yourself. Partners must state what support they give and at what price. [2]
• Microsoft invoices direct customers; the partner invoices CSP customers. Under the Microsoft Customer Agreement, Microsoft’s billing currency for South Africa is the US dollar. ClearSource does not state which currency partners invoice in. [3]
• Terms, 7-day cancellation, reductions only at renewal: the commitment rules are the same in both channels. [4]
• Partners should use GDAP: named, least-privilege, time-limited roles that you grant and can revoke. You keep your own Global Admin accounts. [5]