Do You Need Microsoft 365 E5 for CIS Benchmark Compliance?

“Do we need E5?” comes up in the first week of almost every Microsoft 365 hardening project, and it usually gets answered with a guess. The benchmark answers it precisely. Every one of the 160 controls in the CIS Microsoft 365 Foundations Benchmark v7.0.0 carries a profile label that names two things at once: the licensing tier the recommendation is scoped to, and its level. There are exactly four labels — E3 Level 1, E3 Level 2, E5 Level 1, and E5 Level 2.

Counted across the full catalogue, 137 of the 160 controls carry an E3 profile and 23 carry an E5 profile. That ratio is the real answer to the licensing question, and it is worth knowing before you build a remediation plan — or before you commit budget to an upgrade you may not need yet.

The four profiles, by the numbers

The split across the four profile labels is:

• E3 Level 1 — 100 controls
• E3 Level 2 — 37 controls
• E5 Level 1 — 14 controls
• E5 Level 2 — 9 controls

Two readings fall out of that. Across licensing tiers, it is 137 E3 to 23 E5. Across levels, it is 114 Level 1 to 46 Level 2 — Level 1 being the profile CIS describes as safe and minimally disruptive, Level 2 being the stricter, security-focused one that usually needs a conversation with the business before you enforce it.

The most useful observation is that the two axes are not correlated the way people assume. The E5-scoped controls are not simply “the advanced ones”: 14 of the 23 are Level 1, meaning CIS places them in its baseline, minimal-impact profile. What gates them is licensing, not risk appetite.

Where the 23 E5 controls actually live

They are not spread evenly. Of the benchmark’s 9 sections, only six contain any E5-profile control at all:

• Section 1 — Microsoft 365 admin center: 1 of 15 controls is E5
• Section 2 — Microsoft Defender / Defender for Office 365: 10 of 21
• Section 3 — Microsoft Purview: 2 of 5
• Section 4 — Microsoft Intune: 0 of 2
• Section 5 — Microsoft Entra (Identity): 8 of 63
• Section 6 — Microsoft Exchange Online: 0 of 13
• Section 7 — SharePoint Online & OneDrive: 1 of 12
• Section 8 — Microsoft Teams: 1 of 17
• Section 9 — Microsoft Fabric / Power BI: 0 of 12

Sections 4, 6 and 9 — Intune, Exchange Online, and Fabric / Power BI — contain no E5-profile controls whatsoever. All 27 of their controls are in scope on E3. Section 2 is the outlier in the other direction: Defender for Office 365 accounts for 10 of the 23 E5 controls, nearly half the total, out of a section that is only 21 controls deep.

Zoom in one level and the concentration is sharper still. Five subsections are entirely E5-scoped: 2.2 (1 control), 2.4 (5), 5.3 (5), 7.3 (1), and 8.6 (1). Subsection 5.3 is the one that tends to surprise people — every control in the Privileged Identity Management and access-review subsection carries an E5 profile. If privileged-access governance is the reason you are running the benchmark, that is the single most consequential fact in this post.

The full list of E5-scoped controls

Here are all 23, with their recommendation numbers, titles, profiles, and whether the benchmark assesses them automatically or by hand.

Section 1 — Microsoft 365 admin center

• 1.3.6 — Ensure the customer lockbox feature is enabled (E5 Level 2, Automated)

Section 2 — Microsoft Defender / Defender for Office 365

• 2.1.1 — Ensure Safe Links for Office Applications is Enabled (E5 Level 2, Automated)
• 2.1.4 — Ensure Safe Attachments policy is enabled (E5 Level 2, Automated)
• 2.1.5 — Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled (E5 Level 2, Automated)
• 2.1.7 — Ensure that an anti-phishing policy has been created (E5 Level 2, Automated)
• 2.2.1 — Ensure emergency access account activity is monitored (E5 Level 1, Manual)
• 2.4.1 — Ensure Priority account protection is enabled and configured (E5 Level 1, Automated)
• 2.4.2 — Ensure Priority accounts have ‘Strict protection’ presets applied (E5 Level 1, Automated)
• 2.4.3 — Ensure Microsoft Defender for Cloud Apps is enabled and configured (E5 Level 2, Manual)
• 2.4.4 — Ensure Zero-hour auto purge for Microsoft Teams is on (E5 Level 1, Automated)
• 2.4.5 — Ensure ‘AIR’ remediation is enabled (E5 Level 1, Manual)

Section 3 — Microsoft Purview

• 3.2.2 — Ensure DLP policies are enabled for Microsoft Teams (E5 Level 1, Automated)
• 3.2.3 — Ensure DLP policies are published for Copilot users (E5 Level 1, Automated)

Section 5 — Microsoft Entra (Identity)

• 5.2.2.6 — Enable Identity Protection user risk policies (E5 Level 1, Automated)
• 5.2.2.7 — Enable Identity Protection sign-in risk policies (E5 Level 1, Automated)
• 5.2.2.8 — Ensure ‘sign-in risk’ is blocked for medium and high risk (E5 Level 2, Automated)
• 5.3.1 — Ensure privileged role assignments are activated and not assigned (E5 Level 2, Automated)
• 5.3.2 — Ensure ‘Access reviews’ for guest users are configured (E5 Level 1, Automated)
• 5.3.3 — Ensure ‘Access reviews’ for privileged roles are configured (E5 Level 1, Automated)
• 5.3.4 — Ensure approval is required for Global Administrator role activation (E5 Level 1, Automated)
• 5.3.5 — Ensure approval is required for Privileged Role Administrator activation (E5 Level 1, Automated)

Section 7 — SharePoint Online & OneDrive

• 7.3.1 — Ensure Office 365 SharePoint infected files are disallowed for download (E5 Level 2, Automated)

Section 8 — Microsoft Teams

• 8.6.1 — Ensure users can report security concerns in Teams (E5 Level 1, Automated)

Three themes, not twenty-three problems

Read the list end to end and the 23 collapse into three clusters.

Defender for Office 365 threat protection. Safe Links, Safe Attachments, an anti-phishing policy, Zero-hour auto purge for Teams, Defender for Cloud Apps, AIR remediation, and the two priority-account controls. Ten of the 23 sit here, plus the SharePoint infected-file control in 7.3.1, which is the same idea applied to a different surface.

Risk-based identity and privileged access. The three Identity Protection controls in 5.2.2 and the five Privileged Identity Management and access-review controls in 5.3. This is the cluster that decides whether your privileged-access story is “standing Global Administrators with MFA” or “time-bound, approval-gated activation with periodic review”.

Data protection and tenant transparency. DLP for Teams and for Copilot users in 3.2, and customer lockbox in 1.3.6.

Framed that way, the licensing decision stops being about a control count. It is about whether those three capabilities are ones your risk profile requires. A 200-seat professional services firm with no regulated data and a flat admin structure may reasonably decide they are not. A firm with 40 privileged accounts and client data under contractual obligations will find the 5.3 cluster hard to substitute.

What a realistic E3 baseline looks like

Because CIS scopes these 23 to E5, on an E3 tenant they sit outside your scope rather than failing inside it. That distinction matters for how you report. A useful E3 baseline is a 137-control scorecard — not a 160-control scorecard carrying 23 permanent red rows that no amount of configuration work will ever clear.

Those 137 are not a consolation prize. They include 55 of the 63 Entra identity controls: MFA, password protection, Conditional Access, and authentication methods are almost entirely E3-scoped. They also include every one of the 13 Exchange Online controls, all 12 Fabric / Power BI tenant settings, both Intune controls, 16 of the 17 Teams controls, and 11 of the 12 SharePoint and OneDrive controls. The overwhelming majority of the benchmark’s surface area is reachable without an upgrade.

One thing worth planning around: 14 of the 137 E3-scoped controls are assessed manually rather than automatically, against 3 of the 23 E5 ones. Across the whole benchmark that is 143 automated and 17 manual. Manual controls need a person to look at something and make a judgement, so they are the ones that quietly stall an audit when nobody has been assigned to them.

Answer the question with your own tenant data

The honest version of “do we need E5?” is “how many of those 23 would we actually fail today, and does that matter to us?” That is a question about your tenant, not about the benchmark, and it is answerable before you buy anything.

ConfigCobra assesses all 160 v7.0.0 controls against a live tenant over read-only Microsoft Graph permissions — no agents to install, no admin passwords to share. A scan finishes in 20 to 25 minutes, with 90%+ of controls assessed automatically and each result tagged with the benchmark’s own severity and its Level 1 or Level 2 profile. Findings arrive with a copy-paste remediation script or the admin-portal steps to fix them, and the run exports as a CIS-certified PDF report with evidence and a timestamped tenant snapshot. Schedule it daily, weekly, or monthly and you are emailed when a control regresses, instead of finding out at the next review.

Start the free trial — 14 days with full access to all 160 controls — to see where your tenant stands before the licensing conversation starts. If you already know the scope you need, the pricing page breaks the tiers down by licensed user count.