What is Changing in Microsoft 365 E5 on July 1, 2026?

Many E5 customers still pay for third-party endpoint privilege tools. They keep legacy certificate servers on aging domain controllers. And they treat Security Copilot as a six-figure standalone purchase.

Starting July 1, 2026, Microsoft is folding all those capabilities directly into the license they already own.

Security Copilot, Intune Endpoint Privilege Management, Enterprise Application Management and Cloud PKI are all being absorbed into Microsoft 365 E5. The price is increasing from $57 to $60 per user per month to reflect the additions.

New Microsoft 365 E5 Features Coming July 1, 2026

Security Copilot is Now Included in Microsoft 365 E5

Previously, Security Copilot was only available as a standalone purchase through the Azure portal. Organizations provisioned Security Compute Units (SCUs) at $4 per hour. For enterprises with dedicated SOC teams, annual costs regularly exceeded $100,000 before the tool delivered meaningful coverage.

What E5 customers now receive:

• 400 SCUs per month for every 1,000 licensed E5 users
• Scales up to a maximum of 10,000 SCUs per month
• No separate provisioning or procurement required
• Microsoft activates the entitlement through a phased rollout with 30 days' notice before each tenant is enabled

Security Copilot is still consumption based. The included SCUs cover routine work like incident summaries, guided investigation, and threat correlation across Defender, Entra, Intune, and Purview. Heavier usage can go past the monthly allocation. When it does, usage is throttled instead of billed.

Teams still need to watch consumption closely. A complex workflow on a recurring schedule can burn through tokens fast. The same rules that apply to Copilot Studio apply here.

Security teams can now investigate incidents, analyze suspicious scripts, and run AI-assisted triage without a separate licensing conversation.

Endpoint Privilege Management and App Management Are Now Part of E5

E5 is absorbing advanced Intune Suite capabilities that previously required a separate add-on. The two most significant additions are Endpoint Privilege Management (EPM) and Enterprise Application Management.

EPM removes standing local admin rights from endpoints. Users can still request just-in-time, per-device elevation when a task requires it. Every request is logged and audited. IT teams get compliance visibility without blocking real work.

Many organizations rely on tools like CyberArk or BeyondTrust for this because Microsoft did not offer it natively. Now that EPM is built into Intune, teams already managing devices through the platform do not need a separate tool.

Enterprise Application Management adds lifecycle controls over application deployment, trust boundaries, and app-level policy enforcement. Combined with EPM, Intune now spans device compliance, application lifecycle, privilege elevation, and app trust controls from a single console. A year ago, Intune did not cover half of that.

Cloud PKI Joins E5 to Replace Legacy Certificate Infrastructure

Cloud PKI brings certificate authority functionality directly into Intune. Organizations can issue, manage, and rotate certificates through the cloud without maintaining on-premises servers or third-party PKI providers.

What Cloud PKI enables:

• Automatic certificate deployment to managed devices through Intune
• Certificate-based Wi-Fi and VPN authentication tied to device compliance
• Device trust enforcement so only managed, certificate-holding devices can connect
• Full certificate lifecycle management (issuance, renewal, revocation) from a single console

If a device is not managed or does not hold a valid certificate, it does not connect. You know exactly which device is on the other end of the VPN session. You are not counting on a user to keep an unauthorized machine off the network.

This is the same function that legacy Active Directory Certificate Services provided for years. Cloud PKI delivers it without the on-premises infrastructure. For enterprises still running certificate authorities on aging domain controllers or paying for third-party PKI services, this is a direct replacement path.

Why Microsoft is Expanding E5 in 2026

AI-Assisted Security has a Hard Cost

AI is increasingly embedded in security operations, not just end-user productivity. Security teams need tools that operate at the same scale and speed as the threats they defend against. But AI workloads are expensive to run. Every query consumes compute resources, and high-volume usage creates measurable infrastructure costs.

For most security teams, the standalone cost of Security Copilot put it out of reach. Now that E5 includes credits, teams can start using it without a separate procurement cycle. The consumption model still applies past the baseline allocation, but the cost of entry drops from six figures to zero.

How E5 Fits into Microsoft's 2026 Licensing Strategy

The E5 expansion is part of a broad pattern. Microsoft is building what it considers essential enterprise security and management into fewer, more comprehensive licenses while raising prices to reflect the added value.

The Cost Math

The capabilities being added carried significantly higher costs as standalone purchases. Organizations currently paying for any of them separately should evaluate whether the E5 expansion reduces their total spend.

Packaging updates being rolling out in June 2026. Microsoft provides 30 days' notice through the Message Center before changes become available in each tenant. Pricing takes effect on July 1, and existing customers remain on current pricing until renewal.

If you are Running E5 Plus Copilot, Consider E7

The July 2026 updates make E5 a stronger license, but it still does not include Microsoft 365 Copilot, the full Entra Suite, or Agent 365. Organizations already purchasing those as separate add-ons on top of E5 may find that E7 at $99 per user per month delivers the same stack at a lower cost.

What IT Teams Should Evaluate Before July 1, 2026

The July 1, 2026 updates turn E5 into more than a security and compliance license. It now also handles endpoints, certificates, and AI-assisted security work natively. If you are near renewal, compare what you pay for third-party endpoint, PKI, and privilege tools against what E5 now includes at $60 per user per month.