Microsoft 365 carries a three-tier construct (E1, E3, E5) plus the F-series for frontline workers and the Apps variants. The Admodum read on the tier-by-tier inclusions, the step-up arithmetic and the seat-assignment hygiene that decides which tier each seat actually needs.
Microsoft 365 E1 is the entry-level enterprise tier: web and mobile Office, Exchange Online (50 GB mailbox), SharePoint Online, OneDrive, Teams. Microsoft 365 E3 adds the desktop Office applications, Windows 11 Enterprise upgrade rights, Intune mobile-device management, basic information protection (Azure Information Protection P1) and basic identity protection (Entra ID P1).
Microsoft 365 E5 adds the full security and compliance overlay: Defender for Office 365 P2, Defender for Identity, Defender for Endpoint P2, Entra ID P2, Purview eDiscovery and DLP, Information Protection P2, Power BI Pro, Teams Phone System (without calling plan), and the analytics tier (Viva Insights / Workplace Analytics).
The wider framework sits at the Enterprise Agreement overview; the renewal cadence sits at the EA renewal cycle; the wider editorial sits in the Microsoft pillar.
The principal step from E3 to E5 is the security-and-compliance overlay. A buyer that operates a separate Defender Plan 2 estate, a separate Entra ID P2 estate, a separate Power BI Pro estate and a separate Purview DLP estate already pays, in third-party or stand-alone seats, for the bulk of the E5 overlay.
The arithmetic decides the step. A buyer with strong overlap with the included E5 overlay is paying twice (E3 plus the third-party / stand-alone overlays); the consolidation case for E5 then carries on its own arithmetic. A buyer with minimal overlap (no Power BI estate, no Defender estate, no Purview estate) carries an E5 step that buys capability not consolidation; the case is then different.
The wider security overlay context sits at the Defender suite licensing spoke (forthcoming); the identity overlay sits at the Entra ID licensing spoke (forthcoming); the Power BI context sits at the Power BI Pro / Premium spoke (forthcoming).
Microsoft 365 F1 and F3 license frontline workers: shift workers, retail floor, manufacturing floor, healthcare bedside. F1 carries web and mobile Office plus identity; F3 adds the desktop applications in a per-device construct (rather than per-user) and a 2 GB Exchange mailbox. The price is materially below the E-tier; the use rights are correspondingly bounded (no full desktop Office user-per-seat install rights; no advanced security overlay).
Microsoft 365 Apps for Enterprise licenses the Office desktop applications without the identity / security overlay. Apps for Business is a small-business construct (300-seat cap) not generally applicable to enterprise. The Apps variants sit alongside an Exchange Online plan or an on-prem Exchange estate.
The base seat tier carries the bulk of the inclusion; specific advanced capabilities then sit on add-on seats. Defender for Office 365 Plan 2 add-on, Entra ID P2 add-on, Purview eDiscovery and Audit add-on, the analytics tier, Teams Phone (with or without calling plan), Copilot for Microsoft 365.
The add-on construct is the principal mechanic by which an E3 buyer can selectively acquire E5 capability without taking the full E5 step. The arithmetic is product-by-product: an E3 buyer that needs Defender for Office P2 only can take the add-on; an E3 buyer that needs the full overlay typically finds E5 economic.
The wider Copilot context sits at the Copilot seat economics spoke; the Teams Phone context sits at the Teams Phone licensing spoke (forthcoming).
The seat-assignment discipline is the principal renewal-time lever. A typical estate carries E3 (or E5) seats assigned to users who do not need an E-tier (frontline workers, contractors, mailboxes-only); E5 seats assigned to users who do not need the E5 overlay (knowledge workers without security / compliance / BI workload); and unassigned-but-purchased seats (the standing buffer above headcount).
The audit-grade inventory captures every assigned seat against the user, the workload (the applications actually launched in the last 90 days), the legal entity and the licence type. The renewal-time read reconciles the assigned-seat inventory against the workload reality; the renewal entitlement is then designed to match the reality rather than the legacy mix.
The wider SAM context sits at the SAM audit anatomy spoke; the seat-assignment hygiene context sits at the seat-assignment hygiene spoke (forthcoming).
The buyer-side artefacts to hold against the M365 plans are: the assigned-seat inventory (every seat, every user, every workload, every legal entity); the workload-versus-tier reconciliation (which seats need the E-tier; which need the F-tier; which need Apps-only; which need a mailbox-only construct); the add-on map (which add-ons sit against which seats and whether the add-on is the right unit); the renewal-term seat forecast (against the True-Up profile or the MCA-E flex).
The renewal-time conversation is then a negotiation against artefacts. The publisher's renewal proposal is read against the assigned-seat inventory and the workload reality; the renewal entitlement is designed to match the reality; the True-Up forecast (under the EA) or the monthly flex (under the MCA-E) is then arithmetic, not narrative.
The wider engagement sits in the Microsoft practice; the aggregated reading list sits in the Microsoft knowledge hub; active renewal moments route to the Renewal Programme; active audit moments route to Audit Defence.
The maintenance overlay against which Apps and the desktop rights are renewed.
A senior Admodum Microsoft advisor will read your assigned-seat inventory, the workload-versus-tier reconciliation and the add-on map against your renewal position on a private call. Active renewal moments route to the Renewal Programme.