Microsoft 365 May 2026: Free Security Features Now in Your License

Microsoft added significant security capabilities to existing Microsoft 365 licenses on May 1, 2026. Defender for Office 365 Plan 1 is now included in E3 at no extra cost. URL Safe Links extend down to Business Basic and E1. Intune Remote Help and Advanced Analytics moved into core licenses. If you’re still paying separately for any of these, or you haven’t enabled the features your plan now includes, you’re paying for coverage you already have or missing protection you’re entitled to.

What’s Now Included in Your License

Three categories of features moved from paid add-ons into standard M365 licenses this month. Here’s what each one delivers and what you need to do to start using it.

Defender for Office 365 Plan 1 in E3

Previously, Defender for Office 365 Plan 1 cost approximately $2 per user per month as a standalone add-on. Microsoft bundled it into E3 and Office 365 E3 starting May 1. Plan 1 includes Safe Attachments, which scans email attachments in a detonation sandbox before delivery. It also includes Safe Links, which rewrites URLs and verifies them at time of click across emails and Teams. Finally, it adds anti-phishing policies with mailbox intelligence that go beyond what Exchange Online Protection provides by default.

This is not a minor improvement. Safe Attachments catches malware variants that signature-based scanning misses by executing attachments in an isolated environment before they reach the inbox. Safe Links protects against credential harvesting sites that activate hours or days after an email is delivered. These are the same capabilities that E5 customers have relied on for years.

For a 200-person company on E3, eliminating the standalone Defender add-on saves roughly $4,800 per year. More importantly, it raises the baseline email security for every E3 tenant. If you were relying on Exchange Online Protection alone because the add-on wasn’t in the budget, that gap just closed.

What to do: Check your Microsoft 365 admin center under Billing > Your products. If you have a standalone Defender for Office 365 Plan 1 subscription alongside E3 licenses, contact your licensing reseller about removing the duplicate. Then open the Microsoft Defender portal at security.microsoft.com and verify that Safe Attachments and Safe Links policies are active and applied to all users. The features are included in your license but are not always enabled by default in every tenant configuration.

URL Safe Links for E1, Business Basic, and Business Standard

Safe Links used to require a Defender for Office 365 add-on or an E3/E5 plan. Microsoft extended it to E1, Business Basic, and Business Standard licenses starting May 1. This is a significant improvement for organizations that keep frontline workers, part-time staff, or administrative roles on lower-cost plans.

Safe Links rewrites URLs in emails and Microsoft Teams messages, checking them at the time of click rather than just at delivery. A link that was clean when the email arrived but was weaponized an hour later still gets blocked when the user clicks it. According to Microsoft’s December 2025 announcement, this change reflects the company’s goal of making baseline security available across all commercial license tiers.

For employees who handle customer emails, process invoices, or click vendor links throughout the day, time-of-click URL scanning is a critical layer of phishing defense that was previously out of reach without upgrading their license tier.

What to do: Open the Microsoft Defender portal and review your Safe Links policies. Create or update your policy to cover all user groups, not just E3/E5 users. If you have 40 people on Business Standard who didn’t have Safe Links coverage before May 1, they need to be explicitly included in the policy scope. Also verify that Safe Links is enabled for Microsoft Teams messages, not just email.

Intune Remote Help and Advanced Analytics

Microsoft moved two Intune Suite capabilities into core M365 licenses: Remote Help (screen sharing and remote control for IT support sessions with full audit logging) and Advanced Analytics (device health scoring, anomaly detection, and battery/app performance reporting). These were previously part of the Intune Suite add-on, which costs $10 per user per month.

For IT teams and managed IT providers supporting remote and hybrid workers, Remote Help reduces reliance on third-party remote access tools. It runs inside the Intune portal with full session logging and role-based access, which matters for organizations with compliance requirements around remote support documentation. Advanced Analytics provides visibility into which devices are degrading, which apps are crashing, and where endpoint performance issues are developing before they generate help desk tickets.

What to do: If you’re paying for the Intune Suite primarily for Remote Help or Advanced Analytics, evaluate whether you still need the full add-on. The remaining Suite capabilities (Endpoint Privilege Management, advanced firmware management, and specialized compliance features) may not justify the $10 per user per month cost on their own.

50 GB Mailbox Storage Increase for Business Licenses

Microsoft doubled mailbox storage for Business Basic, Business Standard, and Business Premium from 50 GB to 100 GB per user. This is a practical improvement that reduces “mailbox full” support tickets and aligns Business plans with the storage levels that Enterprise plans have offered for years.

The increase also supports Microsoft’s broader push toward AI-powered search and Copilot features. Larger mailboxes give Copilot more historical email and calendar data to index and reason over, which makes AI-assisted features more useful for organizations that adopt them.

Before and After: License Value Comparison

Here’s how the May 2026 changes shift the feature set across common M365 plans.

The takeaway: E3 licenses gained the most value. If your organization is on E3 and was paying for Defender Plan 1 and Intune Suite separately, the combined savings can exceed $12 per user per month even after accounting for the upcoming price increase.

The Price Increase in Context

These free features arrive alongside a $3 per user per month price increase across Business and Enterprise plans, effective July 1, 2026. For a 150-person company on E3, that adds $5,400 per year. Microsoft is positioning the bundled features as justification for the higher base price.

Whether the math works in your favor depends on what you were paying for separately before May 1. If you were already buying Defender Plan 1 ($2/user/month) and Intune Suite ($10/user/month) as add-ons, the net impact is positive: you’re paying $3 more in base cost but eliminating $12 in add-ons, for a net savings of $9 per user per month. If you weren’t using any of those add-ons, the $3 increase is a straight cost with no offset, though you’re now getting security features you should probably enable anyway.

Microsoft also launched the M365 E7 Frontier Suite at $70 per user per month, bundling E5 with Copilot and Agent 365. For organizations already paying for E5 and Copilot separately, E7 consolidates billing and reduces total cost. For everyone else, E7 is not relevant yet. We covered the E7 and Agent 365 details in a separate post with a full breakdown.

Five-Step License Optimization Checklist

Use this checklist to capture the value of the May changes and prepare for the July price increase. Most organizations can complete this in a single afternoon with their IT team or MSP.

1. Inventory your current add-ons. Pull a subscription report from the Microsoft 365 admin center (Billing > Your products) showing every active license and add-on. Flag any standalone Defender for Office 365 Plan 1, Intune Suite, or Safe Links licenses that are now redundant with your base plan. Your M365 consulting partner can run this report for you if you don’t have admin access.

2. Enable and configure the new features. Inclusion in the license does not mean automatic activation. Verify that Safe Links and Safe Attachments policies are active and applied to all user groups in the Microsoft Defender portal. Check that Intune Remote Help is available to your support team. Features that are included but not configured provide zero protection, and this is where most organizations fail to capture the value they’re already paying for.

3. Right-size your license tiers. Review whether every user needs the plan they’re currently assigned. Employees who only use email, Teams, and web apps may work well on Business Basic or E1, both of which now include Safe Links. Conversely, if you were keeping some users on lower tiers to avoid Defender add-on costs, the E3 bundle might make an upgrade worthwhile. Run the numbers in both directions.

4. Model the net cost impact. Calculate your current per-user cost including all add-ons, then compare it to the post-July per-user cost minus the add-ons you can now eliminate. Do this per license tier, not as a blended average across your organization. Some user groups will save money while others will see a net increase. A spreadsheet with columns for current base cost, current add-on cost, new base cost, dropped add-ons, and net change will make the picture clear in about 30 minutes.

5. Lock in changes before your next renewal. If your Microsoft agreement renews between now and December, make adjustments before the renewal date. Remove redundant add-ons, adjust tier assignments, and confirm that your license count matches your actual headcount. Every license audit turns up seats assigned to departed employees, and at E3/E5 pricing those ghost seats cost $500 to $750 each per year.

What to Prioritize Right Now

If you only do one thing from this list, enable the security features that are already in your license. Many organizations pay for security tools and still have gaps because the features were never properly configured. Defender for Office 365 policies require deliberate setup: you need to define Safe Attachments actions (block, replace, or dynamic delivery), configure Safe Links URL scanning policies, and set anti-phishing impersonation thresholds. The license includes the capability, but protection only activates when the policies are configured and applied to every mailbox in your tenant.

For organizations working with a managed IT provider, the license optimization and security configuration should be part of your next quarterly business review. If your provider hasn’t already brought you a comparison of what you’re paying versus what you could be paying after these changes, bring this checklist to your next meeting and ask. The savings are real, but only if someone acts on them before the July price increase takes effect.