Six months of Microsoft 365 E7 – an interim verdict

When Microsoft announced Microsoft 365 E7 in March 2026, my first reaction was, frankly, scepticism. Another licence tier above E5, more Copilot, another new name – the “Frontier Suite”. I suspected it was mainly a way to force AI down our throats. Since general availability on 1 May 2026 I have introduced E7 in several customer projects, assessed it and occasionally talked customers out of it. Time for an honest interim verdict.

If you want the basics first, read my article Microsoft 365 E7 adds Copilot, Entra Suite and Agent 365 on top of E5. This one is about practice.

E7 bundles what used to sit in four contracts

The most obvious benefit is mundane but noticeable every day. E7 combines Microsoft 365 E5, Microsoft 365 Copilot, the Microsoft Entra Suite and Agent 365 in one licence. At most of my customers these building blocks used to be scattered: E5 in the Enterprise Agreement, Copilot as a separate add-on with its own assignment logic, Entra ID Governance only for some departments, Global Secure Access not at all.

The projects showed that exactly this fragmentation slowed down Copilot adoption. Anyone who had Copilot but no clean permission model quickly learned how well Copilot finds overshared SharePoint sites. With E7 everyone has the same baseline, and the governance tools are no longer subject to budget approval.

The Entra Suite convinced me more than Copilot itself

That sounds paradoxical for a licence marketed as an AI bundle. In practice, though, my customers benefited fastest from the identity features:

• Entra ID Governance with access reviews and lifecycle workflows for joiners, movers and leavers. Found in the Microsoft Entra admin center under ID Governance → Lifecycle workflows or Access reviews.
• Entra Private Access as a replacement for classic VPN solutions, set up under Global Secure Access → Connect → Traffic forwarding.
• Entra Internet Access for web policies tied directly to identity context.
• Verified ID for identity verification during onboarding and helpdesk password resets.

In one project the lifecycle workflows alone made orphaned accounts of former employees disappear after weeks instead of months. That is not AI, but it is the prerequisite for AI to work safely.

The Intune Suite has been included since July 2026

Microsoft integrated the Intune Suite into E5 from July 2026, and therefore into E7. Endpoint Privilege Management, Enterprise App Management, Cloud PKI, Remote Help and Advanced Analytics can be used without an extra licence. At two customers this allowed us to retire a third-party tool for local admin rights. Policies are created in the Microsoft Intune admin center under Endpoint security → Endpoint Privilege Management.

Agent 365 is the real reason for E7

After six months I am convinced that Agent 365 is the core of E7. Microsoft could have kept selling Copilot as an add-on. Agent 365, however, answers a question that comes up in every organisation as soon as business units build their own agents in Copilot Studio: who actually knows which agents exist, which data they access and who owns them?

Agent 365 brings all agents together in one inventory, links them to their own identity in Microsoft Entra and binds them to the same controls we have long used for people: Conditional Access, Purview policies and Defender monitoring.

flowchart TD
  A[Agent created] --> B[Approval requested]
  B --> C{Review}
  C -->|rejected| D[Agent blocked]
  C -->|approved| E[Entra Agent ID]
  E --> F[Conditional Access<br>and Purview DLP]
  F --> G[Defender<br>monitoring]
  G --> H[Regular<br>review]
  H -->|no longer needed| D
  H -->|still needed| G

A machine builder brought its agents under control with Agent 365

The most impressive project of recent months was a mid-sized machine builder with around 1,800 employees. The customer had been using Copilot for a year and had opened Copilot Studio to everyone. The result of the inventory: almost 140 agents, more than half without a recognisable owner. Some accessed engineering data in SharePoint, one had read access to the ERP system through a connector.

We proceeded in four steps.

First we built a complete inventory

In the Microsoft 365 admin center under Agents we listed all agents with creator, publishing status and data sources used. Every agent was assigned a business owner. Agents nobody claimed within four weeks were blocked and deleted after another four weeks.

Then every agent received its own identity

We gave the remaining agents an Entra Agent ID. They now appear in the Microsoft Entra admin center as identities of their own and can be included in groups, access reviews and policies just like user accounts. The big gain: an agent no longer silently inherits the permissions of the person who built it.

Next we extended Conditional Access and Purview to agents

For agents with access to engineering data we created dedicated Conditional Access policies (Microsoft Entra admin center → Protection → Conditional Access) that block risky sign-ins. In Microsoft Purview we extended the existing sensitivity labels and DLP policies so that content labelled “Highly confidential – Engineering” does not end up in agent responses. Data Security Posture Management for AI in the Purview portal now shows which agents touch sensitive data.

Finally we introduced an approval process

New agents are no longer published to everyone directly. Business units request approval, IT reviews data sources, connectors and audience, and only then does the agent appear in the organisation’s catalogue. Unapproved agents stay limited to their creator. By the way, we did not block the ERP agent but rebuilt it – with its own identity, minimal read permissions and logging.

After three months 46 agents were still active, all with owners and documented data sources. The number has grown again since, but this time in a controlled way.

There is no “Business Platinum” for small and mid-sized businesses

The most common question from my smaller customers is: is there a Business plan for this? The answer is no. There is no “Business Platinum” as a better Business Premium that would match E7. Business plans are capped at 300 users, and Microsoft 365 Business Premium includes neither the Entra Suite nor Agent 365. Device management also stays at Intune Plan 1; the Intune Suite is not included there.

Small and mid-sized businesses therefore combine Business Premium with Copilot as an add-on and add individual components as needed. That works, but it is piecemeal – and agent governance is largely missing from this combination. SMBs that want to work seriously with agents have to ask themselves whether moving to Enterprise licences makes sense after all. I still hope Microsoft will follow up here.

E7 is still not the all-inclusive package many hope for

Many customers expected E7 to finally give them “everything”. It does not. Depending on the scenario, additional licences or consumption models still need to be planned:

• Copilot Credits for running agents in Copilot Studio, either via capacity packs or pay-as-you-go through an Azure subscription.
• Microsoft Foundry and Azure consumption as soon as custom models, pro-code agents or Azure resources are involved.
• Teams telephony: Teams Phone is included, Calling Plans or phone numbers and Operator Connect come on top.
• Teams Premium for advanced meeting features and webinar capabilities.
• Microsoft Defender for Cloud including Defender for Servers for Azure, hybrid and multicloud workloads.
• Microsoft Sentinel, billed by data volume.
• Windows 365 for Cloud PCs.
• Purview capabilities with pay-as-you-go billing, for example certain AI protection scenarios outside Microsoft 365.
• Power Apps and Power Automate Premium for premium connectors and custom business apps.
• Role-specific Copilot offerings and Dynamics 365 licences, for example in sales or service.

This list is not a complaint about Microsoft but a note for budget planning. Copilot Credits in particular are underestimated: agents cost money to run, even if the licence governs them. Consumption can be tracked in the Microsoft 365 admin center under Copilot → Billing & usage – do this regularly from day one.

My fear did not come true

Six months ago I thought E7 was mainly an attempt to force AI down our throats. Today I see it differently. E7 is the logical and absolutely necessary evolution of the AI hype. Over the past two years organisations rolled out Copilot and built agents, often faster than security and governance could keep up. E7 closes this gap by putting identity, data protection and agent management into the same licence as the AI itself.

Anyone who introduces Copilot today without inventorying agents, giving them identities and binding them to policies is building tomorrow’s shadow IT. The machine builder example shows how quickly that happens. E7 is neither cheap nor complete, but for the first time it is a package that thinks AI and control together. For organisations of a certain size that are serious about agents, I see hardly any way around it.