The rough shape (verify against current terms)
Microsoft moves licensing details, so treat this as the map, not the deed — confirm against current product terms before you commit. The broad tiers:
| Tier | Representative capabilities |
|---|---|
| E3 baseline (M365/Office E3, or equivalents) | Manual sensitivity labels, basic retention labels/policies, standard eDiscovery, standard (short-retention) audit, core DLP |
| E5 / Compliance add-ons (E5, or the E5 Compliance / Information Protection & Governance / Insider Risk / eDiscovery & Audit add-ons) | Automatic labeling (client and service-side), advanced/records management with disposition, premium eDiscovery, premium audit (long retention + crucial events), Insider Risk Management, Communication Compliance, Information Barriers, Endpoint DLP at scale, DSPM for AI advanced signals |
The dividing line is mostly automation and scale: E3 lets a user label a file by hand; E5-class licensing lets the service label at coverage, retain audit long enough to matter, and run the risk/discovery solutions.
The per-user trap (the real failure mode)
Purview does not hard-block on licence the way you'd expect. A feature can be configured, a policy published, and it can even appear to act — while the specific users it touches lack the entitlement. Auto-labeling and Insider Risk are the classic cases: the policy exists, the dashboard looks live, but coverage silently applies only to correctly-licensed identities (or, worse, you're technically out of compliance for those who aren't). Licensing here is per affected user, not per tenant, so a mixed-licence estate is where the gaps hide.
Map solutions to entitlement — the honest exercise
The useful artefact is a two-column reality check: the Purview solutions you actually run, against the licences your users actually hold. The gap has two sides — unused entitlement (paying for E5 features nobody enabled) and unmanaged risk (running features some users aren't licensed for). Both are findings; the second is the one that surfaces in an audit.
What to watch (proofs)
- The solutions-in-use inventory: enumerate what's actually configured —
Get-Label/Get-LabelPolicy,Get-AutoSensitivityLabelPolicy,Get-DlpCompliancePolicy,Get-RetentionCompliancePolicy— then match each to the tier it requires. - Coverage vs headcount: auto-label/Insider Risk coverage counts against licensed- user counts — a coverage number well below the population often means an entitlement gap, not adoption failure.
- Premium-feature proof: premium audit events present in
Search-UnifiedAuditLogand a premium eDiscovery case type existing (Get-ComplianceCase) confirm the E5-class features are genuinely licensed and live, not just visible. - serv365's read: the honest gap report — solutions run vs licence held — stated as fact, so unused spend and unmanaged risk both get named.