Microsoft 365 Product Solutions
Microsoft 365 F3 includes Windows 10 E3
with the following exceptions:
1. No Long-Term Servicing Channel
rights (LTSC)
2. No Microsoft Desktop Optimization
Pack (MDOP)
3. F3 includes Office for Web and
mobile apps only. Office mobile
limited to devices with integrated
screens 10.1” diagonally or less”.
4. F3 includes 2GB inbox only, No
Outlook Integration, no Voicemail.
5. Includes Walkie Talkie, Tasks
Management and Shift Management.
6. Users cannot be administrators. No
Site mailbox. No personal site.
Cannot create forms, 2GB Mailbox
per user / 10GB shared storage.
7. F3 plans include 2GB OneDrive
storage per user.
8. F3 includes consumption only, no
publish/share.
Microsoft 365 F1 does not include
Windows. It also has the following
limitations:
1. Users cannot be administrators
2. No Teams desktop or app sharing
3. No access to productivity servers
O365 F3 & M365 F3 Include:
1. SharePoint Online & EXO Kiosk (2GB
Mailbox and 2GB OneDrive)
M365 F1 and F3 are reduction eligible at
anniversary. M365 F1 can be stepped up
to F3.
* Skype for Business Standard CAL included
for reference in legacy and existing
agreements.
Apps
Cloud Productivity
and Mobility
Services
Rich Communication and
Secure Collaboration
• Microsoft 365 Apps (Office Pro
Plus):
o Office Apps on up to 5
devices
• Microsoft 365 Mobile Apps*
o Web Apps Office
Interface
o Apps for Tablets and
Smartphones
o Excel, Word, PowerPoint
for Mobile
• Exchange*
o Business-class email
and calendar
• SharePoint*
o File Collaboration and
Storage
• OneDrive*
o Personal Storage and
Ransomware Protection
• Teams*
o Intra-org Chat and Call
communications
o EXO & SPO Integration
o No AC or Phone Sys
• Power Apps
o Low/No Code solutions
o Integrations with M365
• Stream
o Video recording and
Sharing
Office 365 E3
Browser Apps Client Apps
Security
Advanced Enterprise-wide
Protection
Analytics
Personal and Org-wide
Analytics
Voice
Enterprise-level Voice
Services
• Microsoft Defender for Office
365
o Defender for O365
o Attack Simulator
o Threat Tracking
o Threat Intelligence
• Office Cloud App Security
o CASB service for M365
Apps and like Services
o Uses existing Office
DLP
• Advanced Compliance
o Adv eDiscovery
o Adv Data Governance
o Customer Key
o Customer Lockbox
• Power BI Pro
• My Analytics (full)
o Insights available* at E3
• Delve
o Available at E1 and E3
with limited telemetry
o Microsoft Graph
• Audio Conferencing (PSTN):
o Worldwide dial-in
for Online Meetings
o Cost Effective cloudbased dial tone
o Audio conferencing
for invitees by
dialing in from a
landline or mobile
phone
• Phone System
o Business Phone
System in the cloud
Office 365 E5
*Available: M365 F1, M365 F3, O365 K and E1
Identity and Access
Management
- Zero-trust model -
Connected IdentityDriven Security
Managed Mobile and
Workstation
Information
Protection
• Azure Active Directory P1
o Single Sign On
o Azure App Proxy
o Multi-factor Authentication
o Automatic Windows
Enrollment
o Windows Hello for Business
o Conditional Access Features
o Self-Service Password Reset
• Advanced Threat Analytics
o Internal Threat Alerts
o Reconnaissance Alerts
o Suspicious Activity
o Anomalous Actions
• Microsoft Endpoint Manager
o Device Management
o On-Premises
o Mobile & Desktop
o MDM/MAM
o Per-user licensing
o Intune + SCCM
o Restricted copy/paste
o Device Wipe
o Compliance and
Configuration Policies
• Azure Information Protection P1
o Bring Your Own Key
(BYOK)
o Office 365 Message
Encryption
o Manual, default, and
mandatory document
classification
o Document tracking and
revocation
o AIP Scanner / Detection
EMS E3
• Azure Active Directory P2
o Detecting vulnerabilities
and risky accounts
o Investigating Risk Events
o Risk-Based Conditional
Access
• Advanced Identity Governance
o Privileged Identity
Management (PIM)
o Access Reviews
• Microsoft Defender for Identity
o ATA +
o Advanced Detection
o Automatic Mitigations
o Microsoft Cloud App Security*
o Single Portal for CASB+
o Use DLP across Cloud Apps
o Find threats from Cloud
Apps and internal users
o Robust Integrations X-Plat
• Desktop and Workstation
Analytics
• Upgrade Analytics
• Azure Information Protection P2
o Identify Sensitive Info
o Automatically-Apply Labels
(On-Premises)
o Grant Granular Rights
o Keep Protection offline
o Hold Your Own Key (HYOK)
o AIP Scanner /Automatic
Classification and Labeling
• Customer Lockbox
• Customer Key
EMS E5
* Not available natively to GCC, available under certain term-conditions outside of GCC Compliance Boundary Feature is also Included with: *Win10 Business, ** Win 10 Pro for Workstation Win Ent E3 Intelligent Security Next Generation
Protection
Flexible Management &
Insight Versatile Devices
• Host Intrusion Prevention Rules*
• Network Protection (web-based
threats)*
• Enterprise Protections:
o Device Guard
o Credential Guard
o App Locker
• Application Guard for MS Edge
• Runtime Behavior Monitoring
• In-memory anomaly and behavior
monitoring
• Machine learning and AI-based
protections
• Cloud protection for fast
responses
• Protection from file-less based
attacks
• Microsoft Secure Score (for
devices)
• Device Health
• BranchCache
• Configure Windows Diagnostic
Data
• Manage Cortana*
• Direct Access & Always On VPN
• Cred-based Bitlocker
Management*
• Managed Store Access*
• Desktop Analytics
• Windows 10 LTSC
• Resilient Filesystem**
• Windows To Go
• SMB Direct**
• Persistent Memory**
• App Assure
• Windows Subscription Activation
• Windows Virtual use-Rights:
o UE-V
o App-V
o Windows Virtual Desktop
• Advanced Machine Learning and
Protection
• Threat and Vulnerability Management
(Microsoft Defender for Endpoint)
o Integrated Protection for 3rd
Party OS: Linux, MacOS,
Android, iOS
o Automatic Investigation and
Remediation
o Endpoint Detection and
Response (EDR & EPP)
• Advanced Cloud Protection:
o Deep Inspection and
Detonation
o Emergency Outbreak
Protection
o Monitoring Analysis and
Reports
• Customizable Allow/Deny lists:
(IP/URL, Files, Certs)
• Centralized API Configuration and
Management
o Monitoring Analytics and
Reporting
o Open APIs
o Integration with Microsoft
Security
• Device-based Conditional Access
Win Ent E5
Productivity Collaboration
• Microsoft 365 Apps (Office Pro
Plus):
o Office Apps on up to 5
devices
• Microsoft 365 Mobile Apps*
o Web Apps Office
Interface
o Apps for Tablets and
Smartphones
o Excel, Word, PowerPoint
for Mobile
o Compliance Center
o Single portal for all M365
o Content Search
o Retention Labels
o Sensitive Labels
o Manual or Default label
o Windows Enterprise - per User
• Exchange*
o Business-class email
and calendar
• SharePoint*
o File Collaboration and
Storage
• OneDrive*
o Personal Storage and
Ransomware Protection
• Teams*
o Intra-org Chat and Call
communications
o EXO & SPO Integration
o No AC or Phone Sys
• Power Apps
o Low/No Code solutions
o Integrations with M365
• Stream
o Video recording and
Sharing
Microsoft 365 E3
Browser Apps Client Apps
Enterprise
Security
Advanced Security,
Compliance, and Identity
Voice and
Analytics
• Azure Active Directory
P1
o Conditional Access
o Azure App Proxy
o Single SignOn/SAML
• Microsoft Endpoint
Manager
o MDM/MAM
o On-Premises and
remote devices
o Workstation,
tablet, mobile
devices
• Windows Antivirus
• Data Loss Prevention
• Sensitive Information
• Retention capabilities
• Core e-Discovery
• Microsoft Threat Protection
o Defender for Office
o Defender for O365
o Attack Simulator
o Threat Tracking
o Threat Intelligence
o Defender for Identity
o Defender for Endpoint
o EDR + EPP
• Identity Governance:
o JIT Access
o PIM/PAM
o Risk-Based Conditions
• Advanced Compliance
o Adv eDiscovery
o Adv Data Governance
o Customer Key
o Teams Chat DLP
• Automatic Data Classification
• Unlimited Archive for Exchange mailbox
• Audio Conferencing (PSTN):
o Worldwide dial-in for
Online Meetings
o Cost Effective cloudbased dial tone
o Audio conferencing
for invitees by dialing
in from a landline or
mobile phone
• Phone System
o Business Phone
System in the cloud
• Power BI Pro
• My Analytics (full)
o Insights available* at
E3
• Delve
o Available at E1 and E3
with limited telemetry
o Microsoft Graph
Microsoft 365 E5
*Available: M365 F1, M365 F3, O365 K and E1
Zero Trust is a shift in mindset of how we secure our infrastructure, networks, and data - from verify once at the perimeter to now performing continual verification of each user, device, application, and transaction.
What is Zero Trust - 101
Microsoft Commitment
Microsoft is committed to support customers in building a strong foundation of Zero Trust that serves as the basis to modernize identity and device management, secure the hybrid workforce, and prevent and respond to threats more quickly and efficiently.
NIST Definition:
“Zero trust assumes there is
no implicit trust granted to
assets or user accounts
based solely on their physical
or network location.”*
Continual Verification
Always authenticate identity
and device based on all available data
Limit privileged access
Limit user access with Just In Time and
Just Enough Access to protect both
data and productivity
Assume Breach
Minimize blast radius for breaches
and employ security strategy to
prevent lateral movement.
Browse to
a website
Phishing
mail
Open
attachment
Click a URL
Exploitation
& Installation
Command
& Control
User account
is compromised
Brute force pen, stolen
account credentials,
anomalous/risky activity
Attacker attempts
lateral movement
Privileged account
compromised
Domain
compromised
Attacker accesses
sensitive data
Exfiltrate data
Azure AD Identity Protection
Identity Protection, Risk Policies
Microsoft Cloud App Security
Extends protection & conditional
access to other cloud apps
Microsoft Defender for
Office 365 (Office ATP)
Malware detection, safe links, and
safe attachments
Microsoft Defender for
Endpoint (Defender ATP)
Endpoint Detection and Response (EDR) &
End-point Protection (EPP)
Microsoft Defender for Identity* (Azure ATP successor to ATA) On-premises detections and activities with abnormal
behavior analytics to assist in investigating the most atrisk user Attacker collects
reconnaissance &
configuration data
Maximize Detection
During Attack Stages with Microsoft Threat Protection