What is Changing in Microsoft 365 E5 on July 1, 2026?

Many E5 customers are still paying for third-party endpoint privilege tools, maintaining legacy certificate servers on aging domain controllers, and evaluating Security Copilot as a six-figure standalone purchase. 

Starting July 1, 2026, Microsoft is folding all those capabilities directly into the license they already own.

Security Copilot, Intune Endpoint Privilege Management, Enterprise Application Management and Cloud PKI are all being absorbed into Microsoft 365 E5. The price is increasing from $57 to $60 per user per month to reflect the additions. 

New Microsoft 365 E5 Features Coming July 1, 2026

Security Copilot is Now Included in Microsoft 365 E5

Previously, Security Copilot was only available as a standalone purchase through the Azure portal. Organizations provisioned Security Compute Units (SCUs) at $4 per hour. For enterprises with dedicated SOC teams, annual costs regularly exceeded $100,000 before the tool delivered meaningful coverage. 

What E5 customers now receive: 

• 400 SCUs per month for every 1,000 licensed E5 users

• Scales up to a maximum of 10,000 SCUs per month

• No separate provisioning or procurement required

• Microsoft activates the entitlement through a phased rollout with 30 days' notice before each tenant is enabled 

Security Copilot remains consumption based. The included SCUs cover routine security workflows like incident summarization, guided investigation, and threat correlation across Defender, Entra, Intune, and Purview. But heavier usage can exceed the monthly allocation. When that happens, usage is throttled rather than automatically billed. 

Organizations still need to monitor consumption closely. A complex Security Copilot workflow running on a recurring schedule can burn through tokens quickly. The same consumption awareness that applies to Copilot Studio applies here. 

Security teams can now investigate incidents, analyze suspicious scripts, and run AI-assisted triage without a separate licensing conversation. 

Endpoint Privilege Management and App Management Are Now Part of E5 

E5 is absorbing advanced Intune Suite capabilities that previously required a separate add-on. The two most significant additions are Endpoint Privilege Management (EPM) and Enterprise Application Management. 

EPM allows organizations to remove standing local admin rights from endpoints while still enabling users to request just-in-time, per-device elevation when a task requires it. Every elevation request is logged and audited, giving IT teams compliance visibility without blocking legitimate workflows. Many organizations currently rely on tools like CyberArk or BeyondTrust for this function because Microsoft did not offer it natively. With EPM now being built into Intune, that dependency is no longer necessary for organizations already managing devices through the platform. 

Enterprise Application Management adds lifecycle controls over application deployment, trust boundaries, and app-level policy enforcement. Combined with EPM, Intune now spans device compliance, application lifecycle, privilege elevation, and app trust controls from a single console. A year ago, Intune did not cover half of that. 

Cloud PKI Joins E5 to Replace Legacy Certificate Infrastructure

Cloud PKI brings certificate authority functionality directly into Intune. Organizations can issue, manage, and rotate certificates through the cloud without maintaining on-premises servers or third-party PKI providers. 

What Cloud PKI enables: 

• Automatic certificate deployment to managed devices through Intune
• Certificate-based Wi-Fi and VPN authentication tied to device compliance
• Device trust enforcement so only managed, certificate-holding devices can connect
• Full certificate lifecycle management (issuance, renewal, revocation) from a single console

If a device is not managed or does not hold a valid certificate, it does not connect. That level of control means you know exactly which device on the other end of the VPN session. You are not relying on a user to keep an unauthorized machine off the network. 

This is the same function that legacy Active Directory Certificate Services provided for years. Cloud PKI delivers it without the on-premises infrastructure. For enterprises still running certificate authorities on aging domain controllers or paying for third-party PKI services, this is a direct replacement path. 

Why Microsoft is Expanding E5 in 2026 

AI-Assisted Security Has a Hard Cost

AI is increasingly embedded in security operations, not just end-user productivity. Security teams need tools that operate at the same scale and speed as the threats they defend against. But AI workloads are expensive to run. Every query consumes compute resources, and high-volume usage creates measurable infrastructure costs. 

For most security teams, the standalone cost of Security Copilot put it out of reach. But now that E5 includes credits, teams can start using it with a separate procurement cycle. The consumption model still applies beyond the baseline allocation, but the cost of entry drops from six figures to zero. 

How E5 Fits into Microsoft's 2026 Licensing Strategy 

The E5 expansion is part of a broad pattern. Microsoft is building what it considers essential enterprise security and management into fewer, more comprehensive licenses while raising prices to reflect the added value. 

The Cost Math

The capabilities being added carried significantly higher costs as standalone purchases. Organizations currently paying for any of them separately should evaluate whether the E5 expansion reduces their total spend. 

Packaging updates being rolling out in June 2026. Microsoft provides 30 days' notice through the Message Center before changes become available in each tenant. Pricing takes effect on July 1, and existing customers remain on current pricing until renewal. 

If you are Running E5 Plus Copilot, Consider E7

The July 2026 updates make E5 a stronger license, but it still does not include Microsoft 365 Copilot, the full Entra Suite, or Agent 365. Organizations already purchasing those as separate add-ons on top of E5 may find that E7 at $99 per user per month delivers the same stack at a lower cost. 

What IT Teams Should Evaluate Before July 1, 2026

The July 1, 2026 updates shift E5 from a license that covered security and compliance into one that also manages endpoints, certificates, and AI-assisted security operations natively. Organizations approaching renewal should compare what they are paying for third-party endpoint, PKI, and privilege tools against what E5 now includes at $60 per user per month.