Microsoft 365 Tenant Level Service Licensing Guide
Microsoft 365 Tenant-Level Service Licensing Guide
Section titled “Microsoft 365 Tenant-Level Service Licensing Guide”Overview
Section titled “Overview”Microsoft 365 provides security and compliance services that apply across the entire organization, known as tenant-level services. These services help maintain a uniform security and compliance framework but can raise licensing questions when not all users are licensed for specific services.
This guide explains how to configure these services to apply only to licensed users while maintaining compliance and cost-effectiveness.
Information Protection and Governance
Section titled “Information Protection and Governance”This suite helps manage sensitive information throughout its lifecycle.
Microsoft Purview Information Protection
Section titled “Microsoft Purview Information Protection”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Sensitivity Labels | Classification and encryption tools | Basic: All users Advanced: E5 or IP&G add-on | Data protection across emails and documents |
| Automatic Labeling | AI-powered content classification | E5 or IP&G add-on only | Streamlined compliance automation |
| Manual Labeling | User-driven classification | All users | Flexible data governance |
Tenant-Level Guidance: Sensitivity labels are tenant-wide, but advanced features like automatic labeling require Microsoft 365 E5 or E5 Information Protection and Governance licenses. Configure label policies to apply only to licensed user groups.
Retention and Deletion Policies
Section titled “Retention and Deletion Policies”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Basic Retention | Standard data retention rules | All users | Regulatory compliance |
| Event-Based Retention | Trigger-based retention | E5 Compliance only | Dynamic compliance management |
| Disposition Review | Manual review before deletion | E5 Compliance only | Enhanced governance control |
Tenant-Level Guidance: Advanced retention features require E5 Compliance licenses. Scope policies to specific groups or locations where licensed users reside.
Insider Risk Management
Section titled “Insider Risk Management”A suite of tools designed to manage potential risks originating from internal users.
Core Features
Section titled “Core Features”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Risk Detection | Behavioral analysis for threats | E5 Compliance/Security | Proactive threat identification |
| Investigation Tools | Timeline analysis and evidence | E5 Compliance/Security | Comprehensive incident response |
| Communication Compliance | Policy violation monitoring | E5 Compliance/Security | Regulatory adherence |
Tenant-Level Guidance: Configure policies to target specific licensed user groups. Risk detection and investigation apply only to users with E5 Compliance or E5 Security licenses.
Compliance Solutions
Section titled “Compliance Solutions”Tools that help organizations meet regulatory obligations and manage legal compliance.
Microsoft Purview Compliance Manager
Section titled “Microsoft Purview Compliance Manager”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Basic Compliance Tracking | Standard compliance scorecards | All users | Compliance visibility |
| Risk Assessments | Advanced risk analysis | E5 Compliance only | Enhanced compliance management |
| Third-Party Assessments | External regulatory compliance | E5 Compliance only | Industry-specific compliance |
Advanced eDiscovery
Section titled “Advanced eDiscovery”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Basic eDiscovery | Standard search and export | All users | Legal investigation support |
| Advanced eDiscovery | AI-powered analytics | E5 Compliance only | Enhanced legal capabilities |
Tenant-Level Guidance: Scope eDiscovery cases to specific custodians or data locations associated with licensed users.
Data Loss Prevention (DLP)
Section titled “Data Loss Prevention (DLP)”DLP policies prevent the sharing of sensitive information outside the organization.
DLP Capabilities
Section titled “DLP Capabilities”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Basic DLP | Standard sensitive data protection | All users | Fundamental data protection |
| Exact Data Match | Custom sensitive data patterns | E5 or IP&G add-on | Precise data classification |
| Advanced SITs | Enhanced sensitive information types | E5 or IP&G add-on | Comprehensive data protection |
Tenant-Level Guidance: Configure targeted DLP rules focusing on specific user groups or locations with appropriate licenses.
Privileged Access Management
Section titled “Privileged Access Management”Provides granular control over high-value systems and data access.
PAM Features
Section titled “PAM Features”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Just-in-Time Access | Temporary privileged access | E5 Security only | Reduced attack surface |
| Access Approval | Multi-level authorization | E5 Security only | Enhanced security control |
| Audit Logging | Comprehensive access tracking | E5 Security only | Compliance reporting |
Tenant-Level Guidance: Restrict PAM to specific roles or groups with E5 Security licenses.
Microsoft Defender Security Suite
Section titled “Microsoft Defender Security Suite”Defender for Identity
Section titled “Defender for Identity”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Basic Identity Protection | Standard threat detection | All users | Identity security foundation |
| Advanced Identity Protection | Behavioral analytics | E5 Security only | Sophisticated threat detection |
Defender for Office 365
Section titled “Defender for Office 365”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Basic Protection | Standard email security | All users | Essential email protection |
| Safe Attachments/Links | Advanced threat scanning | E5 Security or P2 | Enhanced email security |
Defender for Endpoint
Section titled “Defender for Endpoint”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Basic Endpoint Protection | Standard antivirus | All users | Device security foundation |
| EDR & AIR | Advanced detection and response | E5 Security or P2 | Comprehensive endpoint security |
Defender for Cloud Apps
Section titled “Defender for Cloud Apps”| Feature | Capability | Licensing Requirements | Business Value |
|---|---|---|---|
| Basic CASB | Cloud app visibility | All users | Cloud security foundation |
| App Governance | Advanced cloud control | E5 Security or standalone | Enhanced cloud management |
Licensing Configuration Best Practices
Section titled “Licensing Configuration Best Practices”Scoping Strategies
Section titled “Scoping Strategies”| Strategy | Implementation | Benefit |
|---|---|---|
| Group-Based Targeting | Create license-specific security groups | Precise license management |
| Location-Based Scoping | Target specific SharePoint/OneDrive sites | Focused protection |
| Policy Segmentation | Separate policies for different license tiers | Clear compliance boundaries |
Configuration Steps
Section titled “Configuration Steps”-
Identify Licensed Users
- Create security groups for each license type
- Maintain up-to-date group memberships
-
Scope Policies Appropriately
- Apply advanced features only to licensed groups
- Use location-based targeting for content services
-
Monitor Compliance
- Regular audit of policy applications
- Review license utilization reports
Conclusion
Section titled “Conclusion”Key Takeaway: While tenant-level services in Microsoft 365 provide organization-wide security and compliance, advanced features must be scoped to licensed users to maintain licensing compliance and cost-effectiveness.
By implementing proper configuration strategies through group-based targeting, location-based scoping, and policy segmentation, organizations can leverage the full power of Microsoft 365’s security and compliance tools while ensuring only licensed users benefit from advanced features.
This approach enables organizations to maintain robust security postures, achieve regulatory compliance, and optimize their Microsoft 365 investment through strategic license management.