Enterprise Mobility + Security
The identity, device management and information protection part of Microsoft 365 E3 and E5; does not include Office or Windows.
| Feature | EMS E3Per user, annual commitment | EMS E5Per user, annual commitment |
|---|---|---|
| Identity and access management | ||
| Microsoft Entra ID edition[2] | Entra ID P1 | Entra ID P2 |
| Multifactor authentication (MFA)[1] | ||
| Conditional Access[1] | ||
| Advanced security reporting[1] | ||
| Risk-based Conditional Access[1] | – | |
| Privileged Identity Management (PIM)[1] | – | |
| Windows Server CAL[1]The EMS add-on offer is available to customers who acquire Windows Server CAL and related products through Enterprise volume licensing. | ||
| Endpoint management (Intune) | ||
| Intune Plan 1 (MDM and MAM)[1] | ||
| Intune Plan 2[1]Microsoft Tunnel for MAM, specialty device management and firmware-over-the-air updates. | From July 1, 2026 | From July 1, 2026 |
| Remote Help[1] | From July 1, 2026 | From July 1, 2026 |
| Intune Advanced Analytics[1] | From July 1, 2026 | From July 1, 2026 |
| Endpoint Privilege Management, Cloud PKI, Enterprise App Management[1]These Intune Suite components are included in Microsoft 365 E5, not in EMS E5. | ||
| On-premises management with Configuration Manager[1] | ||
| Information protection (Purview) | ||
| Persistent data protection and encryption[1] | ||
| Document tracking and access revocation[1] | ||
| Encryption key management for regulatory needs[1] | ||
| Intelligent data classification and labeling[1] | – | |
| Identity-driven security | ||
| Microsoft Defender for Identity[1] | – | |
| Microsoft Defender for Cloud Apps[1] | – | |
| Microsoft Advanced Threat Analytics (ATA)[1]Mainstream support ended on January 12, 2021 and extended support ended in January 2026. | Support ended | Support ended |
- Included
- Available as add-on
- Not confirmed in official sources
- Not included
- EMS delivers Entra ID, Intune and Purview Information Protection in one bundle. It does not include Office apps, Exchange, SharePoint or Teams.
- As of July 1, 2026, Intune Plan 2, Remote Help and Intune Advanced Analytics are included in EMS E3 and E5 at no extra cost.
- Endpoint Privilege Management, Cloud PKI and Enterprise App Management are included in Microsoft 365 E5; they are not included in EMS E5 and are purchased as add-ons.
- Microsoft does not offer a separate discount for customers moving from EMS E3 to E5.
- Advanced Threat Analytics is still listed on the pricing page, but its extended support ended in January 2026. Defender for Identity is used instead.
Sources
Last updated: 16 October 2026