Most companies already own part of what they need. Business Premium, E3 and E5 each include different pieces of Entra, Intune and Defender. We check what your tenant already has, tell you the smallest add-on that closes the gap, then supply and activate it.
Microsoft PartnerVerify on Microsoft Marketplace →Microsoft splits identity, device management and threat protection across several licences, and moves features between them. These are the ones UAE companies ask us about most.
Conditional Access, phone-call MFA, fraud alerts, MFA reports and MFA for on-premises apps. Already included in Microsoft 365 Business Premium, E3, F1 and F3.
The usual starting point. Most companies need it for Conditional Access alone.
Everything in P1, plus Identity Protection, risk-based Conditional Access and Privileged Identity Management (PIM). Included in Microsoft 365 E5 and the Microsoft Defender Suite.
Right when admin accounts hold standing rights. PIM makes them request access when they need it.
Access reviews, lifecycle workflows for joiners and leavers, and entitlement management. It also includes PIM.
Worth it when accounts linger long after people leave or change roles.
Microsoft’s secure web and private app access, plus ID Governance, ID Protection and Verified ID Face Check in one suite. The suite needs Entra ID P1 underneath.
A route away from a separate VPN and web filter, for companies already on Microsoft.
Device management for Windows, Mac, iOS and Android: enrolment, compliance policies, app deployment and remote wipe. Included in Business Premium, E3 and E5.
If you have Business Premium, you probably own it already and are not using it.
Add-ons to Plan 1 for advanced endpoint management, such as Remote Help and Advanced Analytics. Intune Suite includes Plan 2.
Check E3 and E5 first. Microsoft has been folding some of these features into them.
Endpoint protection with detection and response, built for companies of up to 300 users. Included in Microsoft 365 Business Premium.
The sensible default for a Business Premium company.
Plan 2 endpoint detection and response, email and Teams protection, and on-premises identity threat detection. Included in Microsoft 365 E5 and the Microsoft Defender Suite.
The Defender Suite adds these to E3 without moving everyone to E5.
Formerly MCAS. Visibility and control over the cloud apps your staff use, including shadow IT and risky app permissions. Included in Microsoft 365 E5 and the Defender Suite.
If someone asked you for an “MCAS” quote, this is the product.
Monitoring for OT and IoT networks in factories, plants and building systems. Licensed per site in five sizes, from up to 100 to up to 5,000 devices.
Priced by site, not by user, so we start by counting the devices at each site.
Security licensing is where companies most often pay twice: once inside the plan they already have, and again as an add-on. Ten minutes with your tenant’s licence list usually settles it.
Business Premium already includes Entra ID P1, Intune Plan 1 and Defender for Business. E3 includes Entra ID P1 and Intune Plan 1. Many companies buy these again as add-ons without realising.
Most of these licences are per user. Features such as Conditional Access and PIM need a licence for every user they apply to, so count those users before comparing quotes.
An Entra or Defender add-on for a few people is usually the cheaper route. Across most of the company, moving to E5 or adding the Defender Suite can work out better. It is worth calculating, not guessing.
Defender for IoT is licensed per site by device count, including IT devices on the same network. Microsoft only lets you change the size at renewal, so count first.
Licensing rules on this page were checked against Microsoft’s own documentation in October 2026. Microsoft changes plan contents regularly — if you are reading this much later, ask us to confirm before you commit to a term.
No. PIM needs Entra ID P2 or Entra ID Governance. P1 gives you Conditional Access, but not PIM or Identity Protection.
Yes. Business Premium includes Intune Plan 1, Entra ID P1 and Defender for Business. It does not include Entra ID P2.
No. E3 includes Entra ID P1. P2 comes with Microsoft 365 E5, the Microsoft Defender Suite, or as a standalone licence.
Microsoft Cloud App Security is now called Microsoft Defender for Cloud Apps. It is included in Microsoft 365 E5 and the Microsoft Defender Suite.
Microsoft Entra Internet Access and Entra Private Access. You can buy them separately or together in the Entra Suite, which needs Entra ID P1.
It depends on the plan, the number of users and whether you commit monthly or yearly. Send us your user count and your current Microsoft 365 plan, and we will come back with a written quote.
Yes. We supply the licences and activate them in your own Microsoft 365 tenant, so nothing about your accounts or data has to move.
Send us your headcount and what your team actually needs. We will come back with the right plan mix and a price — usually the same working day.