Which Microsoft 365 licence meets NIS2? Decision matrix for SMBs
By Michal Lampe Sørensen · 8 min read · 17 May 2026
Contents
Kort fortalt
Business Premium dækker omkring 80% af NIS2 Artikel 21-kapabiliteterne for SMV. MFA, Conditional Access, Intune, Defender for Business og basis-DLP. E5 (eller Purview Suite som add-on) tilføjer Endpoint DLP, Insider Risk, eDiscovery Premium og Defender XDR, relevant for stærkt regulerede brancher eller virksomheder med dedikeret SOC. Blandet licensering (Premium til alle + E5 til 2-3 IT- og compliance-nøglepersoner) er ofte den mest omkostningseffektive strategi.
What NIS2 requires technically
NIS2 Article 21 doesn't name specific technologies, that's deliberately neutral. When you translate the 10 controls into concrete technical capabilities, they fall into 8 main areas:
- •Multi-factor authentication (MFA), all privileged accounts, ideally granular via Conditional Access
- •Access management, least privilege, joiner-mover-leaver processes, regular access reviews
- •Endpoint protection, anti-malware, EDR, automated response to threats
- •Logging and audit, central log collection with retention that meets supervisory requirements (typically 12+ months)
- •Backup and business continuity, tested recovery procedures with documented RTO/RPO (Recovery Time Objective / Recovery Point Objective)
- •Supply chain management, assess and monitor supplier security (B2B access controls, vendor risk)
- •Incident handling, detection, investigation, reporting within 24/72 hours
- •Encryption, data in transit and at rest, plus key management
The next section maps each capability to specific Microsoft 365 plans.
Microsoft 365 plans vs NIS2 capabilities
Comparison of which plan covers which capability.
MFA (basic)
- •Business Basic: included (Security Defaults)
- •Business Standard: included
- •Business Premium: included plus granular via Conditional Access
- •E3: included with full CA
- •E5: included with full CA and risk-based policies
Conditional Access, granular access management
- •Basic and Standard: not included
- •Premium: included
- •E3 and E5: included
Intune, device management
- •Basic and Standard: not included
- •Premium: included
- •E3: included plus Remote Help, Advanced Analytics, and Intune Plan 2 since July 1, 2026
- •E5: included plus all E3 additions as well as Endpoint Privilege Management, Enterprise App Management, and Cloud PKI from July 2026
Endpoint protection (Defender)
- •Basic and Standard: not included
- •Premium: Defender for Business (up to 300 users)
- •E3: Defender for Endpoint P1
- •E5: Defender for Endpoint P2 plus the Defender XDR portal
Audit logging
- •Basic Audit: all plans (180-day retention)
- •Audit Premium (1-year retention, high-value events): E5 or Purview Suite add-on
eDiscovery
- •Standard eDiscovery: E3+
- •Premium eDiscovery (advanced hold and workflow): E5 or Purview Suite add-on
Endpoint DLP and Insider Risk
- •E5 or Purview Suite add-on (as of September 2025, E5 Compliance was rebranded to Purview Suite and can be bought as an add-on to Business Premium or E3, max 300 users on Premium)
Backup
- •Native retention: all plans
- •Microsoft 365 Backup (against corruption and ransomware rollback): separate add-on for all plans
Business Premium covers the bulk of the requirements for typical SMBs. E5 (or Purview Suite as an add-on) adds the advanced compliance and forensics layer that only makes sense once you have dedicated IT or security staff who actually use the features.
Where Premium isn't enough, when to go E5?
E5 is $60/user/mo and adds features you probably don't need if you don't have a dedicated IT or security team. Note that since September 2025, several E5 features can also be bought as Purview Suite or Defender Suite add-ons on top of Business Premium or E3, cheaper than upgrading everyone to E5.
1. You have an internal IR function or MDR partner (Managed Detection and Response)
The Defender XDR portal and automated investigation only deliver value when someone uses them. If no one checks incidents daily, the P2 features are wasted.
2. You handle heavily regulated data
Typically healthcare and finance. Endpoint DLP prevents data exfiltration via devices. Insider Risk detects suspicious employee behaviour. eDiscovery Premium provides legal hold for litigation. If you handle data that could cost you millions in a breach, E5 or Purview Suite pays for itself.
3. You have legal audit retention requirements of 1+ years
Audit Premium gives you 1-year audit log retention by default. Supervisors, especially in finance and healthcare, often require it.
4. You need to document insider threat management
Control 9 in Article 21 requires HR security. Insider Risk is the tool that makes it operational; without it, you're stuck with manual processes.
5. You need Power BI Pro for compliance reporting
Included in E5 (costs $14/user/mo standalone).
If none of the 5 scenarios apply, E5 is probably overkill. You'd be paying $38/user/mo extra for features you won't configure, money better spent elsewhere. Consider Purview Suite or Defender Suite as an add-on instead.
Mixed licensing, the smart strategy
Microsoft allows you to mix licences in the same tenant. For NIS2 compliance, mixed licensing is almost always the most cost-effective strategy.
Model scenario: consultancy with 30 employees
- •25 staff on Business Premium ($22) = $550/mo
- •3 IT and compliance specialists on E5 ($60) = $180/mo
- •2 receptionists on Business Basic ($7) = $14/mo
- •Total: $744/mo
Compared with the alternatives
- •Everyone on Premium: 30 × $22 = $660/mo (missing advanced compliance on IT)
- •Everyone on E5: 30 × $60 = $1,800/mo
- •Mixed saves around $1,056/mo compared to all-E5. The current price in USD, EUR or DKK is shown live in the comparison tool
Why it works
- •IT and compliance specialists use Defender XDR, Insider Risk, and eDiscovery Premium daily, they need E5 (or the Purview Suite add-on)
- •Regular employees use Intune, MFA, and basic Defender. Premium covers it fully
- •Receptionists and part-time staff mostly use email and Teams. Basic is enough
NIS2 supervision looks at what your organisation as a whole can document, not whether every user has the same licence. As long as IT has the tools to enforce policies and users have endpoint protection, you're covered.
My recommendation
If you're unsure, start with Business Premium for the whole company. It's the safe starting point that covers 80% of Article 21 requirements. Add E5 or Purview Suite for IT and compliance specialists as you start configuring the advanced features.
Under 25 employees with no heavy compliance requirements
Everyone on Business Premium. Document your configuration in Compliance Manager. Sufficient for the NIS2 baseline.
25-50 employees with GDPR-sensitive data
Business Premium baseline plus a Purview Suite add-on for 2-3 IT and compliance specialists (or direct E5). Activate Endpoint DLP and Insider Risk for those few users so they can enforce policies across the organisation.
Over 50 employees or heavily regulated
E.g. healthcare, finance, critical infrastructure. E3 as baseline (Windows Enterprise and unlimited users start to matter) plus E5 for the IT and compliance team. Expect to have your own SOC or an MDR partner.
Large frontline segment
Warehouse, retail, manufacturing. Mix of Premium and E3 for office staff plus F3 ($10) for frontline. Note that F licences only get limited value from Microsoft 365 Copilot because they have no desktop apps, and they can't be combined with Power BI Pro.
Documentation matters as much as the licence. The NIS2 question isn't *"which licence do you have?"* but *"what have you configured, and can you prove it?"*. Read our Article 21 guide for the concrete requirements.
Find the right plan in 2 minutes
Our optimizer asks 9-18 questions and gives you a personalised recommendation, so you know exactly which licence matches your compliance needs.
Start the optimizerFrequently asked questions
Is Business Premium enough for NIS2 compliance?+
For most SMBs under 50 employees with no specific compliance requirements: yes. Premium covers about 80% of the Article 21 capabilities. Conditional Access, Intune, Defender for Business, Sensitivity Labels, and basic DLP. The remaining 20% (Endpoint DLP, Insider Risk, eDiscovery Premium, Audit Premium) are typically only needed by heavily regulated sectors or organisations with dedicated IT/security staff. These can be added via the Purview Suite add-on on top of Premium (max 300 users) instead of upgrading everyone to E5.
When should we move to E5?+
E5 only delivers real value if one of the following applies: (1) you have a dedicated IR team or MDR partner using the Defender XDR portal daily, (2) you handle heavily regulated data that requires Endpoint DLP and Insider Risk, (3) you have legal audit retention requirements of 1+ years, or (4) you need Power BI Pro for compliance reporting. If none of those apply, E5 is probably wasted money, consider Purview Suite or Defender Suite as an add-on instead.
Can we use mixed licensing under NIS2?+
Yes, it's often the most cost-effective strategy. Microsoft allows you to mix Basic, Standard, Premium, E3, and E5 in the same tenant. NIS2 supervision looks at what the organisation can document as a whole, not whether each user has the same licence. A typical model: Premium baseline for everyone plus E5 (or Purview Suite add-on) for 2-3 IT and compliance specialists.
How much does compliance cost for a 30-person company?+
Concrete calculation with a Premium baseline plus 3 E5: 27 × $22 + 3 × $60 = $774/mo. That's the licence cost only, and the current price in USD, EUR or DKK is shown live in the comparison tool. On top you need to add consulting implementation (typically 40-80 hours for a NIS2 baseline), any add-ons (Microsoft 365 Backup about $3-5/user/mo, an MDR partner if you don't have your own SOC), and ongoing operations. It's not cheap, but the fines for non-compliance are higher.