ASD's Blueprint for Secure Cloud

Microsoft 365 Licensing

This section describes the design decisions associated with Microsoft 365 Licensing for system(s) built using ASD's Blueprint for Secure Cloud.

Estimated reading time: 2 minutes

Microsoft licenses access to Microsoft 365 and its security offerings through user-based licensing. Microsoft offers several enterprise licensing options for Microsoft 365, Enterprise Mobility and Security (EMS), and Windows. These licensing options are summarised below:

  • Microsoft 365 E5 (recommended for the Blueprint) – Top level Enterprise Plan. Microsoft 365 E5 includes everything inside Microsoft 365 E3 plus additional features and services (largely security and compliance related). In the case of Microsoft 365 E5, the capabilities in Microsoft Defender for Microsoft 365 suite as well as other services such as Microsoft 365 Advanced Compliance are increased.
  • Microsoft 365 E3 - Mid range Enterprise Plan. Microsoft 365 E3 provides access to core products with enhanced features and security features. In the case of Microsoft 365 E3, the Office client suite is included, and the service limits are increased.

The Microsoft 365 Maps by Aaron Dinnage provides detailed information and comparisons of the Microsoft 365 licences as well as detailing licences and features required to align with the Essential Eight and ASD’s Information Security Manual (ISM).

To grant access to the services a licence is assigned to an individual user account. A licence can be assigned by an administrator at the time of the user account is created or through Microsoft Entra ID group-based licensing. Microsoft Entra ID group-based licensing enables an administrator to associate a licence to a group. Any members within the group will be assigned that licence automatically. When a user is removed from the group the licence is removed from the user.

Suggested licensing configuration

Admin Licence Grouprol-OrganisationName-AdministratorThis is the group that the organisation administrators belong to.
User Licence Groupsrol-OrganisationName-UsersThis is the group that the organisation non-administrator users belong to.

Security & Governance

  • None identified



  • None identified


Do you have a suggestion on how the above page could be improved? Get in touch! ASD's Blueprint for Secure Cloud is an open source project, and we would love to get your input. Submit an issue on our GitHub, or send us an email at

Acknowledgement of Country icon

Acknowledgement of Country
We acknowledge the Traditional Owners and Custodians of Country throughout Australia and their continuing connections to land, sea and communities. We pay our respects to them, their cultures and their Elders; past, present and emerging. We also recognise Australia's First Peoples' enduring contribution to Australia's national security.

Authorised by the Australian Government, Canberra