Seat Caps and Mixed Workloads at a 520-Person Manufacturer
Fabrikam Manufacturing has 520 employees. Of these, 320 office staff work on Windows PCs and need desktop Word, Excel, PowerPoint and Outlook, plus Intune management of roughly 400 personally owned phones and Conditional Access policies requiring MFA. Another 180 shop-floor staff work rotating shifts on 40 shared kiosk browsers; they need Teams, Outlook on the web and a time-tracking web app, and nothing may be installed locally. The last 20 are contract engineers who need only email and Teams, for four months. The CFO wants a single annual commitment bought directly from a CSP at the lowest defensible per-user price, and an internal audit note states that no user may be unlicensed and no two people may share credentials.
1. Recommend a licensing mix for the 500 employees and justify the tier boundaries.
Read the worked answer
Start with the cap, not the features. Microsoft 365 Business Premium is limited to 300 seats per tenant, so 320 office staff cannot all sit on it. Two defensible designs:
- 320 Microsoft 365 E3 + 180 Microsoft 365 F3. Cleanest. E3 gives desktop Office, Intune, Entra ID P1 (the prerequisite for Conditional Access), and Defender for Office 365 P1. One security and policy stack for the whole office population.
- 300 Business Premium + 20 E3. Technically allowed, saves money per seat, but produces two SKU sets to administer and a renewal that must never drift past 300.
With only 20 seats over the cap, the saving on the split is small and the operational risk (a new hire pushes you past 300 mid-term) is real. If the CFO insists on the saving, standardise the 20 extra seats on E3 and document the cap in the renewal checklist.
Do not use Business Standard: it has no Intune and no Conditional Access, so the mobile-device and MFA requirements fail.
2. Why is F3 the right tier for the 180 shop-floor staff rather than E3 or a Business SKU?
Read the worked answer
Test each requirement against the tier rather than against habit.
- Shared kiosk, no local install: F3 is built for this. Office is web and mobile only, so nothing lands on the shared device and no shared-computer activation problem exists.
- Deskless but still a real identity: F3 gives each worker their own account (satisfying the audit note), with Teams, Outlook on the web, and a kiosk-sized mailbox.
- Conditional Access: F3 includes Entra ID P1, so the MFA policy that the office staff get can also cover the kiosks.
- Device management: F3 includes Intune, which is what you need to enrol and wipe the 40 kiosks.
E3 would work but buys desktop Office and a larger mailbox that these users never open - pure waste at 180 seats. A Business SKU fails on cost-per-shift-worker and does not fit the shared-device model. Verify the current mailbox size limit for the kiosk tier against the time-tracking vendor's notification volume before signing.
3. How should the 20 contract engineers be licensed, and what must happen at the end of their engagement?
Read the worked answer
Four months is shorter than any annual commitment, so buy monthly-term seats rather than annual. In a CSP, terms are set per seat and per subscription, so the 500 employee seats can stay annual while a separate 20-seat monthly subscription covers the contractors.
- Tier: F3 or an Exchange-only plan, depending on whether they need Teams. Buy no desktop Office for people who need email and chat.
- Identity: each contractor gets a named account in a dedicated contractors group. No shared mailbox logins - the audit note and the licensing terms both forbid it.
- Exit: the monthly term lets you stop billing within days of the last day worked. Pair that with a scheduled task: block sign-in, revoke sessions, convert the mailbox to a shared mailbox so mail is retained, then remove the license.
Budget note: monthly-term seats usually carry a meaningful per-seat premium over annual. Accept it - paying it for four months is cheaper than 20 annual seats that sit idle for eight.