MS-900 Describe Microsoft 365 apps and services Practice Question
Which THREE Microsoft 365 capabilities are included in Microsoft 365 E5 that are NOT included in Microsoft 365 E3?
⚠ Common exam trap
Candidates often confuse Microsoft Defender for Office 365 Plan 1 (included in E3) with Plan 2 (included in E5), or mistakenly think that Purview Audit (Standard) is an E5-only feature when it is actually available in both E3 and E5.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365 Plan 2
Microsoft Defender for Office 365 Plan 2 is included in Microsoft 365 E5 but not in E3. It provides advanced threat protection capabilities such as automated investigation and response (AIR), threat hunting with Threat Explorer, and simulation training, which are not available in Plan 1 or E3.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Audit (Standard)
Why it's wrong here
Microsoft Purview Audit (Standard) is a baseline auditing capability that ships with Microsoft 365 E3, providing only 90 days of audit log retention and core event search in the Purview portal. Because the question targets capabilities exclusive to E5, Standard Audit is incorrect; the E5-specific offering is Advanced Audit, which extends retention and adds higher-value event detection. Standard Audit therefore does not distinguish E5 from E3.
- ✗
Microsoft Defender for Office 365 Plan 1
Why it's wrong here
Microsoft Defender for Office 365 Plan 1 is included in Microsoft 365 E3 and focuses on email and collaboration protection through Safe Attachments, Safe Links, and anti-phishing policies. It lacks the incident investigation, advanced hunting, and automated response capabilities that are unique to Plan 2, so selecting it as an E5-only capability would be inaccurate. Plan 1 is a prerequisite layer in E3, not the E5 differentiator.
- ✓
Microsoft Defender for Office 365 Plan 2
Why this is correct
Microsoft Defender for Office 365 Plan 2 is a true E5 component: it builds on Plan 1 by adding threat hunting in the advanced hunting schema, automated investigation and response (AIR) across email, Teams, and SharePoint, and full access to Threat Explorer's real-time detections. These capabilities are not bundled with E3, making Plan 2 the security-operations answer for this question. It is the choice that specifically represents E5's expanded threat-investigation posture.
- ✓
Microsoft Purview Advanced Audit
Why this is correct
Microsoft Purview Advanced Audit is another E5-only capability, offering up to one year of audit log retention for all events, ten years for privileged access and executive actions, and higher bandwidth for log ingestion via the Office 365 Management Activity API. It also surfaces high-value events such as mail access and eDiscovery activities that Standard Audit's 90-day retention would miss. This longer retention and intelligent insight is why Advanced Audit, not Standard Audit, belongs to the E5 suite.
- ✓
Microsoft Power BI Pro
Why this is correct
Microsoft Power BI Pro is a key differentiator for Microsoft 365 E5. While Microsoft 365 E3 includes basic Power BI capabilities, it does not bundle the Pro licence required for advanced features like sharing, collaboration, and data governance. Therefore, Power BI Pro specifically satisfies the condition of being a capability included in E5 but not in E3, providing enhanced business intelligence and analytics functionalities exclusively within the E5 suite.
Go deeper
Related to this question
Learn chapter
Microsoft Defender for Business
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.