Price Microsoft 365 security bundles with automatic SKU overlap detection. Covers Defender, Entra ID and Intune, with comparison charts and PDF export.
This builder turns a list of Microsoft security SKUs and a headcount into a costed quote: line items, monthly and annual totals, professional services hours, a shareable link, and PDF, CSV and text exports. Its most useful feature is not the arithmetic — it is that it catches you paying twice for the same product, which is the single most common error in a Microsoft security quote.
Everything is computed in your browser. Saved quotes live in your own browser storage and never leave the machine. The one thing that does get sent anywhere is the contact form at the bottom of the quote tab, which is explicit about it: fill it in and your quote details reach us so a real person can price it properly through distribution. Skip the form and the tool is a purely local calculator.
Thirty SKUs ship with the tool, each with a list price in USD, a billing unit, and a declared set of products it includes. They fall into these groups:
The prices are Microsoft list prices as the tool ships them, in USD. List pricing changes, and what you pay depends on your agreement, term, region and channel — so read every figure here as a planning baseline, not as a quote you can sign. Two of the SKUs are priced on units that a per-user quote cannot honestly represent: Sentinel is per GB ingested and Security Copilot is per SCU-hour. The tool models Security Copilot as a per-user line as a simplification, on the assumption it is provisioned per analyst. If Security Copilot is a material part of your spend, price it separately.
Each bundle declares what it contains, and the tool resolves those relationships transitively. Microsoft 365 E3 includes Entra ID P1, Intune P1, AIP P1, and the Standard tiers of eDiscovery and Audit. E5 includes E3 and therefore everything E3 includes, plus Entra ID P2, Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity, Defender for Cloud Apps and AIP P2. Business Premium includes Defender for Business, Defender for Office 365 P1, Intune P1, Entra ID P1 and AIP P1.
When you select a SKU that is contained in another selected SKU, the builder flags it and forces its line total to zero rather than silently adding it. Add E3 and then add Entra ID P1 and the Entra line appears at $0.00 with an overlap warning attached. This catches the classic quote error where someone lists E5 and then itemises Defender for Endpoint P2 underneath it, inflating a 500-seat quote by tens of thousands of dollars a year.
The same logic runs on prerequisites in the other direction: a SKU that requires something you have not selected raises a missing-prerequisite warning rather than quietly pricing an unbuyable configuration.
Take 200 users, USD, annual billing, no negotiated discount, and a stack of Microsoft 365 E3 plus Defender for Endpoint P2 plus Defender for Office 365 P2. None of the three overlaps — E3 contains Endpoint P1, not P2, and contains no Defender for Office tier at all — so all three lines price in full:
| Line item | Unit price | Quantity | Monthly |
|---|---|---|---|
| Microsoft 365 E3 | $36.00 / user | 200 users | $7,200.00 |
| Defender for Endpoint P2 | $5.20 / user | 200 users | $1,040.00 |
| Defender for Office 365 P2 | $5.00 / user | 200 users | $1,000.00 |
| Total | — | — | $9,240.00 |
That is $110,880 a year, or $46.20 per user per month. The comparison every buyer at this size actually wants: E5 alone at $57.00 × 200 is $11,400 a month, $136,800 a year — $25,920 more, but it brings Entra ID P2, Defender for Identity, Defender for Cloud Apps, AIP P2 and the Purview premium tiers with it. Whether that spread is worth it is a real decision, and building both quotes side by side takes about thirty seconds here.
Three modifiers sit on top of the line items, and it is worth knowing the order they apply in and what each assumes.
Licensing is the visible cost; deployment is the one that surprises people. Turn on implementation costs and each SKU contributes hours from a formula of base hours + ceil(users / 100) × hours-per-hundred-users, at a default rate of $175 an hour. Server products use a per-server figure instead. A few examples of the shipped baselines:
| Product | Base hours | Per 100 users | What the hours cover |
|---|---|---|---|
| Business Premium | 12 | 2 | Security policies, Defender config, Intune setup |
| Microsoft 365 E3 | 16 | 3 | Enterprise config, compliance policies, Intune |
| Microsoft 365 E5 | 32 | 5 | Full security stack, advanced policies, EDR tuning |
| Defender for Endpoint P2 | 14 | 3 | EDR tuning, threat hunting setup, playbooks |
| Defender for Office 365 P2 | 12 | 2 | Threat Explorer, AIR config, simulations |
| Microsoft Sentinel | 60 | 6 | Data connectors, analytics rules, playbooks, SOC training |
| Purview Insider Risk | 20 | 4 | Policy templates, HR integration, workflows |
On the 200-user example: E3 contributes 16 + 2×3 = 22 hours, Defender for Endpoint P2 contributes 14 + 2×3 = 20, Defender for Office 365 P2 contributes 12 + 2×2 = 16. That is 58 hours, or $10,150 at the default rate — roughly a tenth of the first year's licensing, and a line item that a licence-only spreadsheet would have shown as zero.
The same overlap suppression applies to hours as to licences: a product bundled inside another selected SKU does not contribute its own deployment hours. You can also exclude individual SKUs from the implementation estimate, or override any SKU's hours with your own figure, which is what you want when the customer already has half the stack running.
For MSPs and multi-tenant deployments there is a tenant count with an additional-tenant rate (default 60%): the first tenant costs full hours and each additional tenant costs a fraction, on the reasoning that scripts, policies and documentation get reused. Server-based products are excluded from that multiplier because servers belong to one tenant. Note that multi-tenant mode also lifts the 300-user cap on Business plans, since the cap is per tenant.
These hour figures are estimates calibrated against SMB professional-services baselines. They are a starting point for a scoping conversation, not a fixed-price statement of work.
Sentinel is priced per GB per day, which means quoting it requires guessing your ingestion volume — a guess most people get wrong by an order of magnitude. The tool estimates it from the products you have selected, using per-user-per-day rates for each data source, and it counts bundled products too, so selecting E5 lights up the Defender sources automatically.
| Data source | GB per user per day |
|---|---|
| Defender for Endpoint | 0.100 |
| Defender for Cloud Apps | 0.030 |
| Defender for Identity | 0.025 |
| Defender for Office 365 | 0.020 |
| M365 audit logs | 0.015 |
| Entra ID sign-ins | 0.010 |
| Intune device logs | 0.010 |
On the 200-user E3 + Endpoint P2 + Office P2 example, five sources trigger: M365 audit at 3.0 GB/day, Entra sign-ins at 2.0, Defender for Endpoint at 20.0, Defender for Office at 4.0, and Intune at 2.0 — 31 GB a day, about 930 GB a month. At the shipped Sentinel rate of $2.46 per GB that is roughly $2,288 a month, which is a bigger number than most people expect and is precisely why the estimator exists. Endpoint telemetry dominates: it is ten times the volume of sign-in logs per user.
The estimate is advisory — the Sentinel line item prices off the GB/day figure you enter, not off the estimate — so you can accept it, or override it with real numbers from a pilot workspace. Real ingestion varies enormously with what connectors you enable and how noisy your environment is.
A thirteen-question wizard walks through org size, existing Microsoft 365 licences, antivirus and EDR needs, servers, email security, phishing simulation, identity protection, ZTNA, cloud app security, compliance requirements and SIEM, then builds a starting selection you can edit on the quote tab. Five one-click bundle presets cover the common shapes: SMB Essentials, SMB Advanced Security, Enterprise Foundation, Enterprise Zero Trust, and Enterprise SIEM/XDR.
There are also four read-only comparison tabs — Defender tiers, Entra ID tiers, Intune tiers and the M365 plans — for settling the P1-versus-P2 questions the wizard raises.
Save it and it goes into your browser's local storage, where you can name it, reload it later, and compare two saved quotes side by side. Clear your browser data and the saved quotes go with it — export anything you need to keep.
The share button encodes the whole configuration into the URL — SKUs, users, servers, discount, currency, billing term, Sentinel volume, tenant count and implementation settings — so the link reconstructs the exact quote for whoever you send it to. Nothing is stored server-side to make that work; the state is in the link itself.
Three export formats: PDF (a formatted proposal with line items, features per product, overlap warnings and the implementation breakdown), CSV (the line items for a spreadsheet), and a plain-text summary for pasting into email. All three are generated locally.
The contact form is the deliberate exception. Microsoft licences here are sold through distribution, so submitting the form sends your configuration and contact details so the quote can be priced against real agreement terms — which is the part a browser calculator genuinely cannot do. Using the calculator does not submit anything; only pressing the button on the form does.
This calculator covers Microsoft 365 Business and Enterprise plans (Basic, Standard, Premium, E3, E5), all Defender products (Endpoint P1/P2, Office 365 P1/P2, Identity, Cloud Apps, Server P1/P2, Vulnerability Management), Microsoft Entra ID (P1, P2, Suite), Microsoft Intune (P1, P2, Suite), Microsoft Sentinel, and Security Copilot. Prices reflect current list pricing with July 2026 changes noted.
Security Copilot is Microsoft's AI-powered security assistant that helps analysts investigate threats, summarize incidents, and automate responses. Starting November 2025, all M365 E5 customers receive 400 Security Compute Units (SCUs) per 1,000 users per month at no additional cost. Additional SCUs cost $6 each. Security Copilot includes 40+ AI agents across Defender, Entra, Intune, and Purview.
The calculator automatically identifies when you select a standalone product that is already included in a bundle. For example, if you select both Microsoft 365 E5 and Defender for Endpoint P2, it will flag that Defender P2 is already included in E5 and exclude it from the price calculation. This prevents double-counting and helps optimize your licensing costs.
Effective July 1, 2026, Microsoft 365 E3 increases from $36 to $39/user/month and E5 from $57 to $60/user/month. However, E3 will now include Intune Remote Help, Advanced Analytics, and Plan 2 features, while E5 adds the full Intune Suite (EPM, EAM, Cloud PKI) and Security Copilot. Renewing before July 1 locks in current pricing.
E3 ($36 to $39/user/month from July 2026) includes Entra ID P1, Intune P1 plus new Intune features (Remote Help, Analytics, Plan 2). E5 ($57 to $60/user/month) adds Entra ID P2, all Defender products (Endpoint P2, Office 365 P2, Identity, Cloud Apps), Security Copilot with 400 SCUs/1K users, full Intune Suite, Power BI Pro, and Phone System.
Microsoft 365 Defender (Enterprise) at $12/user/month requires M365 E3 as a base license. Defender Suite for Business Premium at $10/user/month requires Business Premium. Defender Vulnerability Management at $2/user/month requires Defender for Endpoint P2. Intune P2 and Intune Suite require Intune P1. The calculator flags missing prerequisites automatically.
Prices are based on Microsoft published list prices. Actual pricing varies by region, volume licensing agreement type (Open, EA, CSP), commitment term (monthly vs annual), and Microsoft Partner discounts. Until June 30, 2026, partners can offer 10-15% discounts on E3/E5 subscriptions. Government and education customers have different pricing.
Defender for Business ($3/user/month) is a simplified endpoint protection solution designed for SMBs up to 300 users. It is included in Business Premium. Defender for Endpoint P1 provides next-gen protection and attack surface reduction. P2 adds full EDR, automated investigation, threat hunting, and vulnerability management. Endpoint P2 is included in M365 E5.
If you already have E3 licenses, step-up licenses are almost always more cost-effective. E5 step-up costs approximately $21/user/month (the difference between E3 and E5) versus $60/user/month for a full E5 license. This applies when upgrading existing E3 users. New users would need full licenses.
Yes, you can export your configured quote as a PDF with branded formatting suitable for client proposals, or as a CSV file for spreadsheet analysis. The PDF export includes line item breakdown, overlap warnings, totals, and a pricing disclaimer. Both exports include the configured user/server counts and any applied discounts.