Microsoft just moved the goalposts. Again.
On March 9th they announced Microsoft 365 E7 — branded “The Frontier Suite” — the first new enterprise tier since E5 launched in 2015. It goes GA on May 1st at $99 per user per month.
I’ve spent 18 years watching Microsoft licensing evolve. Every few years the pattern repeats: take existing capabilities, add one genuinely new thing, repackage the bundle, and price it just high enough that you feel anxious about being on the old tier.
E7 is no different. There’s real substance in here. There’s also a lot of “things you were already paying for separately, now bundled at a modest discount.” Let’s break down which is which.
What E7 Actually Is
E7 bundles four products into one SKU:
| Component | Standalone Price | What It Does |
|---|---|---|
| Microsoft 365 E5 | $60/user/mo (from Jul 2026) | Everything you already know — the full security, compliance, and productivity stack |
| Microsoft 365 Copilot | $30/user/mo | AI assistant across Word, Excel, Teams, Outlook, etc. |
| Microsoft Entra Suite | $12/user/mo | Full identity suite — Private Access (ZTNA), Internet Access (SWG), beyond E5’s Entra ID P2 |
| Agent 365 | $15/user/mo | Governance control plane for AI agents |
| E7 Bundle | $99/user/mo | ~15% discount vs buying separately ($117) |
So the “discount” is $18/user/month. For a 1,000-seat organisation, that’s $18,000/month saved versus buying everything a la carte. Real money. But only if you actually need every component.
What’s Genuinely New
Two things in E7 don’t exist in any current tier:
1. Agent 365 — Identity Management for Bots
This is the interesting one. As organisations deploy AI agents (Copilot agents, custom agents, third-party agents), someone needs to govern them. Agent 365 is essentially Entra ID for non-human identities.
It assigns identities to agents, audits their actions, enforces compliance policies, monitors for risky behaviour, auto-expires abandoned agents, and flags agents without owners. If you’ve spent any time managing service accounts and application registrations in Entra ID, you know exactly why this matters. Ungoverned automation is a security incident waiting to happen.
Whether you need it right now depends entirely on how far your organisation has gone with AI agents. If you have three Copilot agents built by enthusiastic staff with no oversight — yes, you probably need governance. If you haven’t deployed any agents yet, this is a solution for a problem you don’t have.
2. Copilot Cowork — Built with Anthropic (Claude)
This one caught my attention. Copilot Cowork is Microsoft’s agentic AI capability, and it’s built in collaboration with Anthropic — the company behind Claude. It runs within your M365 tenant with enterprise data protection, moving beyond “assistant” (you ask, it answers) to autonomous task execution (you delegate, it acts).
I use Claude daily for infrastructure work, content creation, and code. The model is genuinely excellent. Seeing it embedded within the M365 enterprise harness is significant — this isn’t ChatGPT with a Microsoft skin. It’s a different model with different strengths, particularly around careful reasoning and instruction following.
What’s Just Repackaged
The rest of E7 is existing products bundled together:
- E5 — you’re already on this or evaluating it
- Copilot — available as a $30 add-on since 2024 (adoption is still only ~3.3% of M365 users)
- Entra Suite — available standalone since 2024
Microsoft is betting that bundling these at a discount creates upgrade pressure. And they’re right — procurement teams love bundles because they simplify billing, and Microsoft’s licensing complexity is deliberately painful enough that “just buy the bundle” becomes the path of least resistance.
The Question Microsoft Doesn’t Want You to Ask
Here’s where my self-hosting brain kicks in.
Every component in E7 solves a real problem. But Microsoft isn’t the only answer to any of them. And at $99/user/month — $1,188 per user per year — it’s worth asking what you’re actually paying for versus what you could own.
| E7 Feature | What It Solves | Self-Hosted / Open Source Alternative |
|---|---|---|
| Copilot | AI assistant | Ollama + Open WebUI (free, runs on your hardware, your data never leaves) |
| Entra Private Access (ZTNA) | VPN replacement | WireGuard + Tailscale/Netbird (free or low-cost, you control the mesh) |
| Entra Internet Access (SWG) | Web filtering/security | Pi-hole + CrowdSec + firewall rules (free, runs on a Raspberry Pi) |
| Agent 365 | AI agent governance | … nothing yet (this is genuinely new territory) |
| Work IQ | Activity intelligence | You probably don’t want your employer tracking your work patterns anyway |
| Advanced compliance | DLP, eDiscovery | Depends on regulatory requirements — sometimes Microsoft IS the answer |
I’m not suggesting you rip out Microsoft 365 and replace it with a homelab. I architect Azure migrations for enterprises — I know why organisations choose Microsoft. Compliance requirements, integration with existing AD, vendor support contracts, insurance liability — these are real factors that don’t have open-source equivalents.
But if you’re a smaller team, or you’re evaluating whether every component justifies its cost, some of these have excellent alternatives that cost nothing beyond the hardware.
I run WireGuard for remote access, Pi-hole for DNS filtering, CrowdSec for threat intelligence, and Ollama for local AI — all on hardware that cost less than two months of E7 licensing for a single user. My data stays on my infrastructure. Nothing phones home. Nothing gets trained on.
That’s not a universal answer. But it’s a question worth asking before signing a three-year E7 commitment.
The Career Reality: You Need to Understand This Regardless
Whether your organisation buys E7 or not, you need to know what it does. Here’s why:
If you’re in IT operations or security: Your leadership will ask “should we upgrade to E7?” within the next 6 months. Having an informed opinion — not just “Microsoft says it’s good” but a genuine evaluation of what your org needs — is career capital.
If you’re interviewing: “What do you know about Microsoft 365 E7 and Agent 365?” is coming to an interview near you. Copilot adoption is accelerating. Agent governance is the next wave. Understanding this positions you ahead of candidates who only know E3/E5.
If you’re building skills: The underlying concepts — identity governance for non-human entities, ZTNA architectures, AI agent management — are transferable. Even if you learn them on a self-hosted stack, the principles apply at enterprise scale.
How to Test E7 Features for Free
You don’t need to spend $99/user/month to explore what E7 offers. Here’s how to get hands-on:
- Join the Microsoft 365 Developer Program (free) — gives you an E5 sandbox with 25 user licenses. Renewable as long as you show development activity.
- Add Copilot — Microsoft has been enabling Copilot trials on developer tenants. Check your tenant’s billing options.
- Set up Azure free tier alongside your dev tenant — $200 credit for 30 days plus 12 months of free services. Good for Entra Suite exploration.
- Watch for Agent 365 trials — Microsoft confirmed trial licenses around GA (May 1). The Frontier Preview Programme gave early orgs 25 free Agent 365 licenses through December 2026.
- Use Copilot Studio (included in dev tenant) — build custom agents now. This is the practical entry point even without Agent 365 governance.
I’ll be doing a full walkthrough of setting up a dev sandbox and exploring E7 features in the next post in this series.
The Bottom Line
E7 is a significant move. Agent 365 is genuinely new — nobody else has an enterprise governance plane for AI agents. Copilot Cowork powered by Anthropic’s Claude is a meaningful upgrade to Microsoft’s AI capabilities. The Entra Suite consolidation makes sense for organisations already buying the pieces separately.
But the $99/user/month price point means this is a commitment. A 1,000-seat organisation is looking at $1.19 million per year. That buys a lot of self-hosted infrastructure, a lot of open-source tooling, and a lot of engineers to run it.
The right answer depends on your organisation’s size, compliance requirements, and appetite for vendor dependency. What I’d push back on is the assumption that you need all of it. Evaluate each component individually. Buy what you need. Self-host what you can.
That’s not anti-Microsoft. That’s due diligence.
Next in this series: “How to Test Microsoft 365 E7 Features Without Spending a Penny” — step-by-step sandbox setup with screenshots.
For more on self-hosted alternatives to cloud services, see Why Self-Host in 2026? and Digital Sovereignty for Cloud Professionals.
Some links in this article are affiliate links. I earn a small commission if you purchase through them, at no extra cost to you. I only link to gear I actually use.
ReadTheManual is run, written and curated by Eric Lonsdale.
Eric has over 20 years of professional experience in IT infrastructure, cloud architecture, and cybersecurity, but started with PCs long before that.
He built his first machine from parts bought off tables at the local college campus, hoping they worked. He learned on BBC Micros and Atari units in the early 90s, and has built almost every PC he’s used between 1995 and now.
From helpdesk to infrastructure architect, Eric has worked across enterprise datacentres, Azure environments, and security operations. He’s managed teams, trained engineers, and spent two decades solving the problems this site teaches you to solve.
ReadTheManual exists because Eric believes the best way to learn IT is to build things, break things, and actually read the manual. Every guide on this site runs on infrastructure he owns and maintains.
Enjoyed this guide?
New articles on Linux, homelab, cloud, and automation every 2 days. No spam, unsubscribe anytime.