Microsoft 365 & Copilot in the Enterprise · Chapter 5 of 12
Governance — Purview, Defender, and which licence buys what
Two large product families with overlapping names, mapped to the tier that actually includes each capability.
Two families cover security and compliance, and the hardest part is not what they do — it is which licence tier includes which piece. That mapping is where budgets are won and lost, and it is the question you will actually be asked.
The renames, because they make everything unsearchable
Azure Information Protection → folded into Microsoft Purview.
Office 365 Advanced Threat Protection → Microsoft Defender for Office 365.
Microsoft Cloud App Security → Defender for Cloud Apps.
As of 1 October 2025: Microsoft 365 E5 Security → Microsoft Defender Suite, and Microsoft 365 E5 Compliance → Microsoft Purview Suite. Pure renames, no feature change.
One quieter change alongside those: Business Premium stopped being an eligible prerequisite for Purview Suite. That is a real restriction for smaller organisations, and it arrived dressed as a rename.
Microsoft Purview — knowing where your data is and what happens to it
- Sensitivity labels — a classification stamped onto a document or email (‘Confidential’, ‘Internal’), which can carry encryption and usage rules that travel with the file, even outside your organisation.
- Data Loss Prevention (DLP) — rules that detect sensitive content (a card number, an identity number) and block or warn when someone tries to send it out.
- Retention policies — keep this for seven years, delete that after two. Usually driven by regulation rather than preference.
- eDiscovery — finding and preserving everything relevant to litigation or a regulatory request.
- Insider Risk Management — detecting risky behaviour by people who already have legitimate access, such as bulk downloads by someone who has just resigned.
Microsoft Defender — four different products sharing one name
- Defender for Office 365 — email and collaboration. Phishing, malicious attachments and links.
- Defender for Endpoint — laptops and servers. Endpoint detection and response.
- Defender for Identity — watches your on-premises Active Directory for attack patterns.
- Defender for Cloud Apps — a cloud access security broker: which third-party cloud applications your people are actually using, and what they are putting in them.
And one more product that keeps appearing in this estate: Microsoft Sentinel
Microsoft Sentinel is a SIEM — Security Information and Event Management. Plainly: it collects logs from everything you own (servers, laptops, firewalls, cloud services, Microsoft 365), keeps them in one searchable place, and runs rules over them looking for attacks.
Why that is a separate product from the Defender family: a single suspicious event means nothing on its own. A failed sign-in, then a success from a new device, then a mailbox rule forwarding externally — that is an attack, and no individual tool can see it, because each holds only its own piece. The SIEM is where the pieces get put together.
It was called Azure Sentinel until 2021, and it is priced per gigabyte ingested rather than per user — which is why what you choose to send it is a real cost decision.
Do not confuse it with SentinelOne, an unrelated company that sells endpoint security in competition with Defender. Same word, no relationship, and they come up in the same conversations.
The mapping you actually need
| Capability | E3 | E5 |
|---|---|---|
| Entra ID | P1 | P2 — Privileged Identity Management (time-limited admin rights), Identity Protection, Access Reviews |
| Defender for Office 365 | P1 (new in July 2026) | P2 — Threat Explorer, attack simulation, automated response |
| Defender for Endpoint | P1 | P2 — automated investigation, advanced hunting, and feeding signals into Microsoft Sentinel (see below) |
| Defender for Identity | not present | ✓ |
| Defender for Cloud Apps | not present | ✓ |
| Data Loss Prevention | Exchange, SharePoint, OneDrive | + Teams chat, endpoint DLP |
| Compliance | — | Insider Risk, Advanced eDiscovery, Advanced Audit, Communication Compliance |
| Analytics | — | Power BI Pro |
| Voice | add-on only | Audio Conferencing + Teams Phone bundled |
| Intune | Plan 1, plus Remote Help and Advanced Analytics (July 2026) | + Endpoint Privilege Management, Enterprise App Management, Cloud PKI |
Two rows there changed in July 2026, alongside a price increase: Defender for Office 365 P1 moved into E3, and both tiers gained meaningful Intune capability. Capability was added to justify the increase — which is worth knowing when someone asks why the bill went up, because part of the answer is that you also got more.
One caution on the Defender for Office 365 P1 row: the research behind this chapter found two live Microsoft pages that do not fully agree on it. Verify against your own licensing terms before you build a business case on that specific line.
Individual Purview capabilities can also be bought as add-ons to E3 — Information Protection P2, Compliance Manager, eDiscovery Premium and Insider Risk Management are each around $5–6 per user per month. Do that arithmetic before buying E5. Two or three add-ons is often cheaper than the tier upgrade; four is usually not.
Check yourself