What the E5 Security Add-On Bundles
The Microsoft E5 Security vs standalone add-ons comparison hinges on what sits inside the add-on. For roughly $12 per user per month on top of an E3 base, the E5 Security add-on packages the full Defender XDR stack plus advanced identity: Microsoft Entra ID P2, Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity, and Defender for Cloud Apps. In effect it is the security half of E5 sold separately, so you can lift your protection to E5 level without paying for the E5 productivity, compliance, and voice components you may not use.
Each component carries real capability, not just a badge. Entra ID P2 adds Identity Protection, Privileged Identity Management for just-in-time admin access, and access reviews and entitlement management for governed onboarding. Defender for Endpoint P2 adds advanced hunting and six months of device data retention; Defender for Office 365 P2 adds automated investigation and response that extends into Teams; and Defender for Cloud Apps provides the CASB layer. This is the same stack analysed in our Microsoft E5 security licensing guide.
The Bundle Economics
Bought standalone, these components add up fast. Defender for Endpoint P2 lists at $5.20 per user per month, Defender for Office 365 P2 at $5.00, Defender for Identity at $5.50, and Defender for Cloud Apps at $5.00 — about $23 per user per month for the Defender stack alone, before Entra ID P2 is layered on top. The E5 Security add-on delivers the same set for roughly $12. That is close to a 50% saving against standalone list, which is exactly why bundling is Microsoft's default motion and why piecemeal purchasing is rarely the cheaper path at scale.
| Component | Standalone list (per user/month) | In E5 Security add-on |
|---|---|---|
| Defender for Endpoint P2 | $5.20 | Included |
| Defender for Office 365 P2 | $5.00 | Included |
| Defender for Identity | $5.50 | Included |
| Defender for Cloud Apps | $5.00 | Included |
| Microsoft Entra ID P2 | Added on top of the ~$23 stack | Included |
| Effective price | ~$23+ stack | ~$12 add-on |
The standalone Defender stack lists near $23 per user per month before Entra ID P2 is added; the E5 Security add-on delivers the same capability for about $12. Standalone only wins in one narrow case — when you need just one or two components for a small subset of users and the rest of the stack would sit unused.
E5 Security vs Standalone: Side by Side
The decision is rarely about capability — the components are identical either way — so it comes down to coverage breadth and user count. Buy the add-on when most of your users need most of the stack; buy standalone only when a small, defined group needs one or two specific tools. A common middle path is to apply the E5 Security add-on to your standard knowledge-worker population and use standalone SKUs for edge cases such as frontline or shared-device users where a single Defender component suffices. The broader E3-versus-E5 trade is covered in our E5 vs E3 cost optimisation analysis.
Watch the SIEM angle too. Microsoft Sentinel ingestion starts at $2.46 per GB, and E5 and E5 Security customers receive a data grant of up to 5MB per user per day to ingest Microsoft 365 data at no extra ingestion cost. That benefit is genuine for Microsoft-sourced telemetry, but it does not stretch to broad coverage of non-Microsoft log sources — model your full ingestion volume before assuming the grant covers your security operations centre.
Which to Buy
For most enterprises, the E5 Security add-on on an E3 base is the right answer — it captures the full Defender and Entra protection at roughly half the standalone list price, without committing to the full E5 bundle. If you only need the security capabilities, E3 plus the add-on is also cheaper than buying full E5, which sells for around $57 today and rises to about $60 in July 2026 when Security Copilot compute units fold into the SKU. Full E5 earns its premium only when you will genuinely use the Purview compliance and analytics components as well.
Reserve standalone add-ons for the genuine edge cases: a pilot of one Defender component, a small high-risk user group needing a single capability, or a frontline population where the full stack is overkill. Even then, model the crossover point — once a user group needs three or more components, the add-on almost always wins. The full decision tree sits in our Microsoft licensing pillar guide, with current market context in the Microsoft vendor hub.
Negotiating the Security Licence
The list prices above are the starting point, not the contract. Inside an Enterprise Agreement, the E5 Security add-on is discountable like any other SKU, and the discount usually deepens when the add-on is part of a larger renewal conversation rather than a mid-term bolt-on. Right-size first: a utilisation review almost always finds Defender or Entra P2 capabilities assigned to inactive or low-risk users, and trimming that baseline before you negotiate strengthens both your price and your position. We run this as standard software licensing negotiation work.
Time the security add-on to the EA cycle and avoid letting it be bundled in without independent pricing — the same discipline we apply to Copilot and other mid-term additions. For the framework behind every Microsoft renewal we negotiate, download the Microsoft EA Guide, and to pressure-test an E5 Security versus standalone decision before you sign, request a confidential briefing.