Microsoft 365 E3 / E5 / E7

Single sign-on across cloud and integrated on-premises apps with policy-based access conditions on user, device, location and risk signal.

Sign-in and user risk scoring that feeds Conditional Access so access tightens automatically when behaviour looks anomalous.

Time-bound, approval-gated elevation into admin roles with access reviews, so standing privilege can be driven to near zero.

Attribute-driven provisioning, access packages and automated de-provisioning tied to HR source of truth.

Identity-centric access to private apps and the internet, replacing legacy VPN concentrators and standalone web filtering.

Issue and verify cryptographic credentials for onboarding, contractor validation and helpdesk identity checks.

Enrolment, compliance policy, configuration profiles and app deployment across Windows, macOS, iOS and Android.

Removing local admin rights while allowing elevation of approved tasks, plus deeper endpoint analytics and remote help.

Ring-based, service-managed delivery of Windows, driver and Microsoft 365 Apps updates with reporting.

Behavioural detection, automated investigation and remediation, threat and vulnerability management on the endpoint.

Licence entitlement to run Windows in Azure Virtual Desktop / Windows 365 scenarios.

Safe Links, Safe Attachments, anti-phishing policy and detonation for mail, Teams, SharePoint and OneDrive.

Detection of lateral movement, Kerberos abuse and domain-dominance techniques against Active Directory.

Shadow-IT discovery, app governance, session control and OAuth app risk across third-party SaaS.

Unified incident queue, advanced hunting across raw telemetry, and automated attack disruption.

Natural-language incident summarisation, script analysis and guided response for analysts.

Centralised log retention, custom analytics rules and correlation with non-Microsoft sources.

Classification and persistent encryption applied to documents and mail, enforced by the label rather than the location.

Policy enforcement on sensitive content in transit across mail, Teams, SharePoint and the endpoint.

Behavioural signals (departing user, mass download, policy circumvention) turned into investigable risk cases.

Visibility over which sensitive data AI prompts and agents are touching, plus oversharing remediation.

Bring-your-own-key and double key encryption for the small set of content that cannot rely on Microsoft-managed keys.

Org-wide and location-scoped retention policies and labels with defensible deletion.

Regulatory records declaration, file plan, disposition review and proof-of-disposal reporting.

Search, hold, review-set culling, near-duplicate detection and export for legal or statutory requests.

Availability of high-value audit events and how long audit logs are retained before extra cost.

Policy-based review of internal communications for code-of-conduct, harassment and regulatory breach.

Detecting overexposed personal information and running subject rights requests as a managed workflow.

Point in time restore of Exchange, SharePoint and OneDrive content, and low cost retention of inactive content.

Microsoft 365 Apps for enterprise across desktop, web and mobile with 1 TB OneDrive per user.

Chat, channels, meetings and the collaboration substrate the rest of the estate sits on.

SharePoint, OneDrive, Loop and Viva Connections as the content and communications layer.

Primary mailbox size, in-place archive and auto-expanding archive behaviour.

Authoring, sharing and consuming governed reports and semantic models.

Aggregate patterns on meeting load, focus time and collaboration networks.

Power Apps and Power Automate for process digitisation, within the seeded M365 connector limits.

Enterprise-data-protected chat with the model, including web grounding.

Drafting, summarisation and analysis inside Word, Excel, PowerPoint, Outlook and Teams, grounded on tenant data via the Graph.

Creating task-specific agents grounded on organisational content and connected systems.

Agents registered in the directory with their own identity, owner, permissions and access reviews, governed like a workforce identity.

A registry of every agent in the tenant, what it did, what it cost and the ability to suspend it.

Extending Defender detections and Purview DLP, labelling and retention to agent interactions.

PSTN dial-in for meetings and dial-out to participants.

Call queues, auto attendants, transfer, hold and voicemail, the PBX replacement layer.

Actual outbound/inbound calling to the public network.