DEV Community

Cover image for That viral Microsoft 365 license chart has mistakes. Here is the fixed version
cuong do
cuong do

Posted on Originally published at gitlab.com

That viral Microsoft 365 license chart has mistakes. Here is the fixed version

#microsoft #azure #security #productivity

Day 1 of a new series on Microsoft 365 licensing and customization, checked against Microsoft's own plan comparison and service descriptions (October 2026).

This week a colourful "Microsoft 365 Enterprise Licenses" chart landed in my feed. Nice icons, green ticks, red crosses, a little handwritten "A more productive and secure tomorrow". Very shareable. Also wrong in about ten places, and some of those mistakes cost real money: buy F3 because the chart says it has Defender for Office 365, and your frontline staff get phishing protection that is a lot thinner than you think.

So I rebuilt the chart from Microsoft's documents, and then did the part no chart can do: checked what a tenant actually owns, and turned off one service inside a license without touching the rest. All commands run against a lab tenant with made-up users.

TL;DR

  • The chart gets mailboxes, F1 and F3 badly wrong: F1 has no mailbox, F3 has 2 GB, E3 and E5 have 100 GB. Only E1 really has 50 GB.
  • F3 has no Defender for Office 365 and no desktop Office apps, but it does include Windows Enterprise E3, Intune and Entra ID P1.
  • Never trust a chart (this one included) over your own tenant: Get-MgSubscribedSku shows exactly which service plans you pay for.

The corrected chart: five plans, twelve features, with the cells the viral chart got wrong highlighted

Table of contents

1. The mistakes, one by one

I went through the chart cell by cell. Here is everything that is wrong, out of date or misleading.

# The chart says Reality
1 Exchange Online "50 GB mailbox" for all five plans E1: 50 GB. E3 and E5: 100 GB plus an archive that grows up to 1.5 TB. F3: 2 GB, no archive. F1: no mailbox at all
2 F1 has Word, Excel, PowerPoint on the web F1 is read-only on web and mobile. It can open a file, not edit it
3 F3 has desktop Office apps "(Limited)" F3 has no desktop apps. Web and mobile only (mobile on screens under 10.9")
4 F3 has no Windows Enterprise Microsoft 365 F3 includes Windows Enterprise E3
5 F1 has no Intune F1 includes Intune Plan 1, same as E3, E5 and F3
6 F3 has Advanced Security (Defender for Office 365) F3 has Exchange Online Protection only. Defender for Office 365 is an add-on (or part of F5 Security)
7 E3 has "Basic" Defender for Office 365 Out of date. From 1 July 2026 Microsoft 365 E3 includes Defender for Office 365 Plan 1. Before that it had EOP only
8 F1 has no Entra ID Premium F1 includes Entra ID P1. F3's green tick is also P1, not P2
9 E1, F1 and F3 have no Purview at all They have the basics: standard audit, manual retention labels, content search (E1, F3), manual sensitivity labels (F1, F3). E3 is the standard tier (DLP for mail and files, eDiscovery Standard, litigation hold), not "basic". E5 is premium
10 OneDrive is the same for everyone F1 and F3 get 2 GB of OneDrive. E1 gets 1 TB, E3 and E5 get 1 TB or more
11 Teams is simply ticked True for most tenants, but "no Teams" versions of E1, E3 and E5 still exist. Check which one you bought
12 (no row) The chart has no Defender for Endpoint row at all. E3 includes Plan 1, E5 Plan 2, E1, F1 and F3 none

What the chart gets right: Power BI Pro only in E5, desktop apps only in E3 and E5, Windows Enterprise in E3 and E5, Entra ID P1 in E3 and P2 in E5, Defender for Office 365 Plan 2 in E5.

Sources: Modern Work plan comparison (Microsoft) · Exchange Online limits · 2026 Microsoft 365 packaging updates

2. The fixed chart

The same five plans, rebuilt from Microsoft's plan comparison and service descriptions. Cells in amber are the ones the viral chart got wrong.

Fixed Microsoft 365 license chart for E1, E3, E5, F1 and F3

Feature Office 365 E1 Microsoft 365 E3 Microsoft 365 E5 Microsoft 365 F1 Microsoft 365 F3
Mailbox 50 GB 100 GB + archive 100 GB + archive None 2 GB
OneDrive 1 TB 1 TB+ 1 TB+ 2 GB 2 GB
Office on web and mobile Edit Edit Edit Read-only Edit
Desktop Office apps No Yes Yes No No
Windows Enterprise No E3 E5 No E3
Intune No Yes Yes Yes Yes
Entra ID Free P1 P2 P1 P1
Defender for Endpoint No Plan 1 Plan 2 No No
Defender for Office 365 EOP only Plan 1 (from July 2026) Plan 2 No EOP only
Purview Basic Standard Premium Minimal Basic
Power BI Pro No No Yes No No

Two honest warnings about my own chart:

  1. Microsoft changes packaging every year or two. The July 2026 update alone moved Defender for Office 365 Plan 1 and more Intune features into E3. Check the date on any chart before you use it, including this one.
  2. "Yes" hides detail. F3's Windows Enterprise E3 comes with frontline usage terms, and "Purview Basic" in E1 is not the same as Purview in E3. When money is involved, read the service description, not the tick.

3. Which plan for which person

The real question is never "E3 or E5?". It is "what does this person do all day?". A simple way to sort people:

Person Usually enough Why
Uses a shared device, checks shifts and chats in Teams, reads documents F1 No mailbox, read-only Office, but Intune and Entra ID P1 so you can still protect the account and the device
Has a company email and works mostly in the browser or on a phone F3 2 GB mailbox, web and mobile Office, Windows Enterprise E3 for the shared PC
Office worker who only needs mail, Teams and web apps E1 Cheap, but no Intune and no Entra ID P1: you will need add-ons to protect it properly
Most office staff, managers, engineers E3 Desktop apps, Intune, Entra ID P1, Defender for Endpoint P1, and Defender for Office 365 P1 since July 2026
Admins, security team, finance, executives, anyone attackers would love to phish E5 Entra ID P2 (risk-based sign-in, PIM), Defender for Endpoint P2, Defender for Office 365 P2, Purview premium

You don't have to pick one plan for the whole company. A common setup mixes two or three: F3 on the shop floor, E3 for the office, E5 only for admins and high-risk roles. That mix is usually cheaper than "E5 for everyone" and safer than "E1 for everyone".

Which license for which person: F1, F3, E1, E3 and E5, with a short checklist before you buy

Sources: Microsoft 365 frontline plans · Changing from an E plan to an F plan

4. Lab: see what your tenant really owns

Lab at a glance
Goal List every license and every service plan inside it, from your own tenant
You need A test tenant, the Microsoft Graph PowerShell SDK, an account with the License Administrator or Global Reader role
Time 10 minutes
Cost Nothing extra
What we break on purpose A license assignment that silently switches a service back on

A license (SKU) is a box. Inside the box are service plans: Exchange, SharePoint, Intune, Defender and so on. Charts show the box. Your tenant shows the plans.

Connect with read-only permissions first:

Connect-MgGraph -Scopes "Organization.Read.All","User.Read.All"
Enter fullscreen mode Exit fullscreen mode

List your licenses, how many you bought and how many are used:

Get-MgSubscribedSku |
  Select-Object SkuPartNumber, ConsumedUnits,
    @{n="Purchased";e={$_.PrepaidUnits.Enabled}}
Enter fullscreen mode Exit fullscreen mode

Then open one box and see the plans inside:

$sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "SPE_E3"
$sku.ServicePlans | Select-Object ServicePlanName, ProvisioningStatus | Sort-Object ServicePlanName
Enter fullscreen mode Exit fullscreen mode

What it looks like in a lab tenant (shortened):

ServicePlanName            ProvisioningStatus
---------------            ------------------
AAD_PREMIUM                Success
EXCHANGE_S_ENTERPRISE      Success
INTUNE_A                   Success
MDE_LITE                   Success
SHAREPOINTENTERPRISE       Success
TEAMS1                     Success
...
Enter fullscreen mode Exit fullscreen mode

Three things to notice:

  • The names are not the marketing names. SPE_E3 is Microsoft 365 E3, MDE_LITE is Defender for Endpoint Plan 1, AAD_PREMIUM is Entra ID P1. Microsoft keeps a reference table that maps them.
  • Microsoft 365 F3 shows up as SPE_F1. Yes, F1. It's a leftover from an old rename, and it's the easiest way to assign the wrong license by script.
  • A plan in the list means you paid for it, not that anyone configured it. Defender for Office 365 Plan 1 in E3 still needs its policies set up.

To see what one user actually has, including plans someone switched off:

Get-MgUserLicenseDetail -UserId "lab.user01@contoso.com" |
  Select-Object SkuPartNumber -ExpandProperty ServicePlans |
  Where-Object ProvisioningStatus -eq "Disabled"
Enter fullscreen mode Exit fullscreen mode

Sources: View licenses and services with PowerShell · Product names and service plan identifiers

5. Lab: turn off one service inside a license

This is the "customization" part of the series name. A common request: "Give the office team Microsoft 365 E3, but no Bookings and no Sway." You don't need a different license for that. You keep the box and switch off a plan inside it.

You need write permissions for this one:

Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All"

$sku   = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "SPE_E3"   # Microsoft 365 E3
$off   = $sku.ServicePlans | Where-Object ServicePlanName -in "MICROSOFTBOOKINGS","SWAY" |
         Select-Object -ExpandProperty ServicePlanId

Set-MgUserLicense -UserId "lab.user01@contoso.com" `
  -AddLicenses @(@{ SkuId = $sku.SkuId; DisabledPlans = $off }) -RemoveLicenses @()
Enter fullscreen mode Exit fullscreen mode

Break it on purpose

Now run the same command again for the same user, but disable only SWAY. Check the user with Get-MgUserLicenseDetail. Bookings is back on.

That's the trap: DisabledPlans replaces the list, it doesn't add to it. Every script that changes one plan has to read the user's current disabled plans first, merge them with the new ones, and send the full list. Microsoft's own example does exactly that, and plenty of scripts on the internet don't.

Fix it, and do it at scale

For one user, merge the lists. For a team, don't script per user at all: use group-based licensing in Entra ID. You assign the license to a security group, untick the plans you don't want once, and everyone who joins the group gets the same setup. Two things to know:

  • Group-based licensing needs Entra ID P1 (or higher) for every user who benefits from it. E3, E5, F1 and F3 already include P1; E1 doesn't.
  • It doesn't work with nested groups, and if a license runs out, Entra stops assigning, so watch the group's error count.

Clean up

Remove the test license from lab.user01, or re-enable all plans with an empty DisabledPlans. Disconnect with Disconnect-MgGraph.

Sources: Disable access to Microsoft 365 services with PowerShell · Set-MgUserLicense · What is group-based licensing

Gotchas

  • Charts age fast. Microsoft repackaged E3 in July 2026. Any chart without a date is a guess.
  • "No Teams" SKUs. Some tenants bought E3 or E5 without Teams and a separate Teams license. The chart's green Teams tick won't tell you which one you have. Get-MgSubscribedSku will.
  • SPE_F1 is F3. Scripts that pick a license by name break on this one.
  • E1 can't do group-based licensing on its own. It doesn't include Entra ID P1.
  • Two plans that overlap can't sit on one user. For example, assigning both Office 365 E1 and Office 365 E3 to the same user fails.
  • Paying is not protecting. Defender for Office 365 P1 in E3, or Intune in F1, does nothing until someone sets up the policies.

Checklist

  • [ ] Listed every SKU with Get-MgSubscribedSku and matched part numbers to product names
  • [ ] Checked which users have plans disabled, and why
  • [ ] Mapped each group of people (frontline, office, admin) to F1, F3, E3 or E5
  • [ ] Moved per-user license scripts to group-based licensing where possible
  • [ ] Any script that sets DisabledPlans reads the current list first
  • [ ] Checked the date and source of every license chart before sharing it

Which license do you think is the most over-bought in your company? My bet is E5 for people who only ever open Outlook.

Sources

Top comments (1)

Collapse
 
aaaasds profile image
DEV VERIFY 👇 •

tr.ee/dev-to