Microsoft 365 E3 / E5 / E7

Capability and roadmap workspace

Roadmap

Prerequisite chains and delivery horizons for the held tier

MaturityNot includedAdd-on requiredBaselineAdvancedFrontier

The chains show prerequisite order per pillar. The card below sequences the same work into delivery horizons for the selected tier.

Tier

Progression by pillar

Each chain is ordered by prerequisite, not by licence tier. Steps you already hold at Microsoft 365 E5 are filled. Earlier steps stay in the chain because they remain required foundations at every tier above them.

4 of 6 included at E5
5 of 5 included at E5
4 of 4 included at E5
5 of 5 included at E5
5 of 5 included at E5
4 of 4 included at E5
3 of 3 included at E5
1 of 6 included at E5
2 of 2 included at E5
Held at this tierRequires a higher tierAdd-on = separately purchased at every tier

Microsoft 365 E5

E5 adds detection, investigation, records management and analytics. The sequence below turns those entitlements into an operating capability and identifies the adjacent products they overlap.

Horizon 1 | 0 to 6 months

Foundation

Turn the security suite into an operating capability

  1. 01Deploy Defender for Endpoint P2 to all endpoints and servers; enable automated investigation and remediation
  2. 02Defender for Identity sensors on every domain controller and AD FS/AD CS server
  3. 03Enable Identity Protection and wire risk-based Conditional Access policies
  4. 04PIM for every privileged role; eliminate standing Global Administrator assignments
  5. 05Stand up the Defender XDR incident queue as the single triage surface
Horizon 2 | 6 to 15 months

Consolidate

Displace duplicate tooling and close compliance obligations

  1. 01Enable auto-labelling with trainable classifiers; move from user-applied to service-applied classification
  2. 02Endpoint DLP for removable media, print and cloud upload; enable Adaptive Protection
  3. 03Implement Purview Records Management with a file plan, the trigger to decommission a legacy EDRMS
  4. 04Move eDiscovery and legal hold in-house on the full Purview eDiscovery experience
  5. 05Defender for Cloud Apps: shadow-IT discovery, then app governance for OAuth risk
  6. 06Replace per-user Power BI Pro spend with the included entitlement
Horizon 3 | 15 to 24 months

Extend

Prepare the estate for AI and non-human identity

  1. 01Remediate oversharing: site-level permissions, broken inheritance, 'Everyone except external users' sprawl
  2. 02Confirm labelling and DLP coverage is dense enough that AI grounding inherits real controls
  3. 03Assess Entra Suite separately (GSA / ID Governance) against VPN and IGA renewal dates
  4. 04Decide Copilot as an add-on versus E7, the arithmetic changes once agents enter scope

CeilingE5 governs people. It has no construct for an agent as a first-class identity, no agent registry and no agent-level cost or behaviour telemetry.