mediumMultiple ChoiceObjective-mapped
Microsoft 365 E5 Security Add-On — Adding Advanced Threat Protection and EDR to E3
A company with 1,000 users currently has Microsoft 365 E3 licenses. They need to add advanced threat protection for email (including anti-phishing and anti-malware) and endpoint detection and response (EDR) for all devices. What is the most cost-effective licensing addition?
Quick Answer
The Microsoft 365 E5 Security add-on is the cost-effective path here because it delivers exactly the two capabilities requested — advanced email threat protection and endpoint detection and response — without requiring the organisation to purchase a full E5 license for every user. The add-on bundles Defender for Office 365 Plan 2, which adds anti-phishing, safe attachments, and safe links on top of the baseline email protection E3 already includes, together with Defender for Endpoint Plan 2, which provides EDR capability across devices. Buying these as a targeted add-on to an existing E3 base avoids paying for the compliance, voice, and analytics features bundled into a full E5 upgrade that this scenario never asked for. The recurring lesson across these licensing questions is the same: when a requirement names one category of capability — security here, compliance in other scenarios — the matching add-on to the existing base license is virtually always more cost-effective than a full tier upgrade.
⚠ Common exam trap
Many exam-takers confuse the E5 Security add-on with the full E5 upgrade, not realizing the add-on provides the same security features at a lower cost, or they mistakenly think the E5 Compliance add-on includes security capabilities like EDR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 E5 Security add-on
The Microsoft 365 E5 Security add-on provides advanced threat protection (including anti-phishing and anti-malware for email via Defender for Office 365 Plan 2) and endpoint detection and response (EDR) via Microsoft Defender for Endpoint Plan 2, all without requiring a full E5 license upgrade. This is the most cost-effective solution for adding these specific security capabilities to existing E3 users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft 365 E5 Security add-on
Why this is correct
Correct. This add-on bundles Defender for Microsoft 365 Plan 2 and Defender for Endpoint Plan 2, providing the needed capabilities at a lower cost than other options.
- ✗
Microsoft 365 E5 Compliance add-on
Why it's wrong here
This add-on provides compliance features like eDiscovery and Auditing, not the advanced threat protection and EDR required.
- ✗
Upgrade all users to Microsoft 365 E5
Why it's wrong here
Upgrading to E5 adds many extra features (e.g., advanced compliance, analytics) that are not needed, making it more expensive than the Security add-on.
- ✗
Microsoft Defender for Microsoft 365 Plan 1 standalone
Why it's wrong here
This provides only basic email protection, not the full anti-phishing/anti-malware required, and does not include EDR.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Defender for Endpoint
Microsoft Defender for Endpoint is a cloud-delivered enterprise security solution designed to protect devices from cyber threats using behavioral analysis, machine learning, and automated investigation.
About these practice questions
This MS-900 question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company with 500 Microsoft 365 E3 users wants to add the highest level of threat protection and advanced investigation capabilities for their security team. Which licensing add-on should they purchase?
medium- ✓ A.Microsoft 365 E5 Security
- B.Microsoft 365 E5 Compliance
- C.Microsoft 365 E5
- D.Microsoft Defender for Microsoft 365 Plan 2 only
Why A: Microsoft 365 E5 Security is the correct add-on because it bundles the highest level of threat protection (Microsoft Defender for Office 365 Plan 2, Microsoft Defender for Endpoint Plan 2, and Microsoft Defender for Identity) along with advanced investigation capabilities like automated investigation and response (AIR), threat analytics, and advanced hunting in Microsoft 365 Defender. This meets the requirement for top-tier threat protection and advanced investigation without upgrading the entire E3 base license to E5.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.