Chapter 14 of 14

Glossary of Microsoft 365 Licensing Terms

A comprehensive A–Z reference of every Microsoft 365 licensing term, acronym, and concept — from Add-on to Zero Trust — with clear definitions and practical context.

20 min read read

Key Facts

The most misunderstood term: "NCE" (New Commerce Experience) — it's not a product, it's Microsoft's billing framework that changed pricing rules for all CSP partners in 2022.
Did you know? "SKU" literally means Stock Keeping Unit — in M365 licensing, it refers to a specific product offering like "M365 E3" or "Exchange Online Plan 2."
Entra ID was formerly called Azure Active Directory (Azure AD). Microsoft renamed it in July 2023, but the underlying technology is identical.
A "tenant" is not a server — it's your organization's isolated instance of M365 in Microsoft's cloud. One company = one tenant (usually).
License Mobility does not apply to M365 SaaS licenses — it's a Software Assurance benefit for on-premises server licenses moving to Azure VMs.
The difference between MAM and MDM: MAM manages apps on personal devices without controlling the device. MDM manages the entire device. Business Premium and Intune include both.
FedRAMP authorization is required for US government cloud workloads, but GCC (Government Community Cloud) meets most civilian agency requirements without the stricter GCC High.
Zero Trust is not a product you buy — it's an architecture principle. Microsoft sells the building blocks (Entra ID, Intune, Defender) separately or bundled in E5.

A to Z Microsoft 365 Licensing Terms

This glossary covers every licensing term you will encounter when evaluating, purchasing, and managing Microsoft 365 subscriptions. Bookmark this page — you will come back to it often. If you are in the middle of a Microsoft 365 migration project, many of these terms will come up in your migration planning meetings and license assignment discussions.

Add-On License

A license that extends the functionality of a base M365 plan. Cannot be purchased standalone — requires a qualifying base license (e.g., Copilot requires E3/E5).

Annual Commitment

A 12-month licensing term that locks in pricing at a ~20% discount vs. monthly. You can add seats mid-term but cannot reduce until renewal.

Azure Information Protection (AIP)

Now part of Microsoft Purview Information Protection. Provides document classification and encryption using sensitivity labels.

Base License

The primary M365 plan assigned to a user (e.g., E3, E5, Business Premium). Required before any add-on licenses can be applied.

BYOD

Bring Your Own Device. Employee-owned devices managed through Intune MAM (app-level protection) without full device enrollment.

Calling Plan

Microsoft-provided PSTN minutes bundled with Teams Phone. Alternative to Direct Routing and Operator Connect. Available in ~30 countries.

Conditional Access

Entra ID feature that enforces access policies based on user, device, location, and risk level. Included in E3 (Entra ID P1). The foundation of Zero Trust security.

Copilot (M365)

AI assistant at $30/user/month that works inside Word, Excel, PowerPoint, Outlook, and Teams. Requires E3/E5/Business Standard/Premium base license.

CSP (Cloud Solution Provider)

Microsoft partner channel for purchasing and managing M365 subscriptions. Typically offers better pricing and support than buying direct from Microsoft.

DLP (Data Loss Prevention)

Policies that detect and prevent sharing of sensitive information (credit cards, SSN, health data) across Exchange, SharePoint, Teams, and endpoints.

Direct Routing

A Teams Phone PSTN connectivity method where you bring your own SIP trunk provider and Session Border Controller. Best for large or global organizations.

E3 / E5

Enterprise-tier M365 plans with no user limit. E3 ($36/user/mo) covers productivity + basic security. E5 ($57/user/mo) adds advanced security, compliance, analytics, and voice.

EMS (Enterprise Mobility + Security)

A bundle of Entra ID P1/P2 + Intune + Azure Information Protection. Now largely folded into M365 E3/E5 plans. EMS E3 and E5 still available as standalone.

Entra ID (formerly Azure AD)

Microsoft's cloud identity and access management platform. P1 is in E3; P2 is in E5. The backbone of authentication, Conditional Access, and Zero Trust.

F1 / F3

Frontline worker plans. F1 ($2.25/mo) gives web/mobile access. F3 ($8/mo) adds full app access and Windows 11. Both have 2 GB mailbox and 2 GB OneDrive.

FedRAMP

Federal Risk and Authorization Management Program. US government security standard. GCC = Moderate, GCC High = High, DoD = IL5.

GCC (Government Community Cloud)

Microsoft's US-sovereign cloud for government agencies. Data stays in US datacenters. Meets CJIS, IRS 1075, and FedRAMP requirements.

Group-Based Licensing

Entra ID feature that automatically assigns/removes M365 licenses based on security group membership. Requires Entra ID P1+.

Identity Protection

Entra ID P2 feature that detects risky sign-ins and user behavior. Automatically blocks or requires MFA for suspicious access attempts.

Intune

Microsoft's unified endpoint management platform. Plan 1 (in E3/E5) covers MDM/MAM. Plan 2 and Suite add advanced features like Remote Help and Cloud PKI.

Knowledge Worker

A user who primarily creates, edits, and shares information. Typically needs desktop Office apps, full email, and OneDrive. Suited for E3 or E5.

License Mobility

The ability to reassign a license from one user to another. Subject to a 90-day reassignment restriction for most per-user licenses.

MAM (Mobile Application Management)

Intune feature that protects company data at the app level without managing the entire device. Ideal for BYOD scenarios.

MDM (Mobile Device Management)

Full device management through Intune. Enables device compliance, remote wipe, app deployment, and configuration profiles.

MFA (Multi-Factor Authentication)

Requires two or more verification methods to sign in. Included in all M365 plans through Security Defaults. Advanced MFA policies require Conditional Access (E3+).

Microsoft Defender

Family of security products: Defender for Office 365 (email), Defender for Endpoint (devices), Defender for Identity (on-prem AD), Defender for Cloud Apps (CASB).

Monthly Commitment

Pay-as-you-go licensing with no long-term contract. ~20% more expensive than annual. Best for temporary workers and evaluating new plans.

NCE (New Commerce Experience)

Microsoft's current billing platform for CSP partners. Replaced legacy CSP billing in 2022. Enforces annual/monthly commitment terms.

Operator Connect

A Teams Phone PSTN connectivity method where a certified telecom operator manages the SIP trunk integration through the Teams Admin Center.

PIM (Privileged Identity Management)

Entra ID P2 feature providing just-in-time privileged access. Admins must "activate" their elevated role for a limited time window.

Power Platform

Power BI, Power Apps, Power Automate, and Power Virtual Agents (now Copilot Studio). Some features included in E3/E5; premium features require add-on licenses.

Purview

Microsoft's unified data governance and compliance brand. Includes DLP, sensitivity labels, retention policies, eDiscovery, Insider Risk, and Information Protection.

Sensitivity Labels

Purview feature that classifies and protects documents/emails. Manual labeling in E3; automatic labeling (based on content detection) requires E5.

Shared Mailbox

A mailbox accessible by multiple users. Does not require a license (up to 50 GB). Commonly used for team email addresses and departed employee mailbox retention.

SKU (Stock Keeping Unit)

The internal product identifier for a license plan. Example: SPE_E3 = Microsoft 365 E3, SPE_E5 = Microsoft 365 E5.

SLA (Service Level Agreement)

Microsoft guarantees 99.9% uptime for M365 services. Financial credits available if they fall below this threshold in a given month.

Tenant

Your organization's dedicated instance of M365. Identified by your domain name. All users, groups, licenses, and data belong to one tenant.

Teams Phone

Cloud PBX capability for Teams. Standard license ($8/user/mo) provides calling features. Requires separate PSTN connectivity (Calling Plan, Direct Routing, or Operator Connect).

Teams Premium

$10/user/month add-on. AI-powered meeting recaps, custom branding, advanced webinar features, watermarking, and sensitivity labels for meetings.

Trial License

Free 30-day trial available for most M365 plans and add-ons. Up to 25 users. Converts to paid subscription or expires. Great for testing before committing.

Unified Labeling

The current generation of sensitivity labeling in Microsoft Purview. Replaced the older Azure Information Protection labels with a unified experience across all M365 apps.

Viva

Microsoft's employee experience platform. Includes Viva Insights (analytics), Viva Learning (training), Viva Engage (community), Viva Goals (OKR tracking). Suite: $12/user/mo.

Volume Licensing

Traditional licensing for large organizations (500+ users). Enterprise Agreement (EA) and Select Plus. Being gradually replaced by CSP and NCE for cloud products.

Web Direct

Purchasing M365 directly from microsoft.com at list price. Simplest but most expensive channel. No partner support included.

Windows 365

Cloud PC service. Streams a full Windows desktop from Azure. Business (self-service) or Enterprise (Intune-managed). Starts at $28.50/user/month.

Zero Trust

Security framework: "never trust, always verify." Every access request is evaluated based on identity, device health, location, and data sensitivity. M365 E5 provides the complete Zero Trust toolkit.

Most Commonly Confused Terms

Microsoft 365 vs. Office 365 — M365 includes Windows + security + Intune. O365 is productivity only. New purchases should choose M365.
Entra ID vs. Azure AD — Same product, rebranded in 2023. All documentation now uses "Entra ID" but the Portal URLs still say "Azure AD" in places.
Defender for Endpoint vs. Defender for Business — Endpoint is the enterprise product (P1 in E3, P2 in E5). Defender for Business is a simplified version included in Business Premium.
Copilot for M365 vs. Copilot Studio vs. Security Copilot — Three completely separate products with different licensing models (per-user, per-tenant, consumption-based).
CSP vs. Web Direct vs. EA — Three purchasing channels. CSP is partner-managed, Web Direct is self-service, EA is enterprise-negotiated. Same product, different pricing and support.

Did You Know?

The most misunderstood term: "NCE" (New Commerce Experience) — it's not a product, it's Microsoft's billing framework that changed pricing rules for all CSP partners in 2022.

Chapter Summary

1This glossary covers 40+ Microsoft 365 licensing terms organized alphabetically from AAD/Entra ID to Zero Trust.
2Key identity terms: Entra ID (formerly Azure AD) comes in Free, P1 (included in E3), and P2 (included in E5) tiers — each unlocking progressively more security features.
3Key licensing terms: Base License, Add-on, SKU, Annual vs. Monthly Commitment, and NCE (New Commerce Experience) are the building blocks of every M365 purchase decision.
4Key security terms: Conditional Access, MFA, Defender (multiple products), DLP, Sensitivity Labels, and Purview form the security and compliance stack.
5Key telephony terms: Teams Phone, Calling Plans, Direct Routing, and Operator Connect are the four PSTN connectivity options with distinct cost and complexity tradeoffs.
6The 10 most misunderstood terms are clarified: NCE is a billing framework not a product, shared mailboxes are free up to 50 GB, Intune IS included in E3, and per-user licensing covers up to 15 devices.