Microsoft Purview pricing: what E3 covers, what E5 costs you
Most teams researching Microsoft Purview pricing are trying to answer one question: do we have to move the whole tenant to E5 just to know when someone downgrades a sensitivity label? This page breaks down how Purview is licensed, where the E5 line sits, and the cheaper monitoring-only path.
How Microsoft Purview is licensed
Purview is not a single SKU. It is a family of compliance capabilities bundled into Microsoft 365 plans and add-ons, priced per user, per month:
- Microsoft 365 E3 / Business Premium. Sensitivity labels you create and publish, manual labelling, basic retention, eDiscovery (Standard) and the standard unified audit log.
- Microsoft 365 E5. Adds automatic and recommended labelling, Insider Risk Management, Communication Compliance, advanced DLP, Advanced Audit and Adaptive Protection.
- E5 add-ons. If you don't want the full E5 jump, Microsoft sells the E5 Compliance and Information Protection & Governance add-ons — still per user, still tenant-wide.
Current list prices change by region and agreement — check the official Microsoft Purview pricing page for the figures that apply to your tenant.
The real cost problem: paying tenant-wide for one capability
Advanced compliance uplift is charged for every licensed user, not just the ones who touch confidential material. A 500-seat organisation that only needs label change auditing pays the uplift 500 times over — and still has to build the reporting on top of raw audit data.
E3 vs E5 vs Label Master
| Capability | E3 | E5 | E3 + Label Master |
|---|---|---|---|
| Create and publish sensitivity labels | |||
| Manual labelling in Office apps | |||
| Automatic and recommended labelling | |||
| Sensitivity label change detection & history | |||
| Downgrade risk scoring by label rank | |||
| Real-time alerts on risky label changes | |||
| External & anonymous sharing feed | |||
| Guest / external user activity view | |||
| Daily activity digest email | |||
| Priced per user across the whole tenant |
Label Master is a monitoring layer, not a labelling engine — you keep creating and publishing labels in Purview.
Purview-grade monitoring without E5 licensing
Label Master connects to your own Azure app registration in your tenant and reads sensitivity label activity from the Microsoft Graph and Office 365 Management APIs. Your labels, your data, your tenant. On top of that stream it gives you:
- • Label change history with the user, file and location for every event.
- • Rank-based risk scoring so a downgrade from a higher-priority label is flagged, while an upgrade is recorded as low risk.
- • Alerts on risky downgrades and bulk or mass label actions.
- • External and anonymous sharing visibility, including guest activity.
- • A daily digest email and an exportable audit trail.
Pricing is a flat per-workspace subscription rather than a per-user compliance uplift — see the plans on the homepage.
Frequently asked questions
- Is Microsoft Purview included in Microsoft 365 E3?
- E3 includes the foundations: manual sensitivity labels, basic retention, eDiscovery (Standard) and audit (Standard). The advanced Purview capabilities — automatic labelling, Insider Risk Management, Communication Compliance, Advanced Audit and Adaptive Protection — are licensed with E5 or the E5 Compliance / Information Protection & Governance add-ons.
- Why is Purview E5 expensive for label monitoring?
- Purview add-ons are priced per user, per month across your whole tenant. If your only goal is to know when someone downgrades or removes a sensitivity label, you end up paying an org-wide advanced-compliance uplift for one capability.
- Do I need E5 to see sensitivity label changes?
- No. Label change activity is written to the Microsoft 365 unified audit log, which Label Master reads through the Microsoft Graph and Office 365 Management APIs using your own Azure app registration. You keep your existing licences and labels.
- Does Label Master replace Microsoft Purview?
- No. Purview stays your labelling and policy engine. Label Master is a focused monitoring layer on top of it: label change detection, downgrade risk scoring, external sharing visibility, alerts and an audit trail.