E5 or E5 Compliance Add-On at a 260-Attorney Law Firm
Bishop & Hale has 640 mailboxes and 260 attorneys. A regulator requires seven years of email retention with legal hold on demand. Client contracts require that credit-card numbers and nine-digit client matter IDs be blocked from leaving the tenant by email and by Teams chat. In the last year there were three litigation matters, each requiring holds on 10 to 15 custodians; one of them involved a departing partner suspected of copying 4,000 files to personal cloud storage. The IT director proposes moving all 640 users from Microsoft 365 E3 to E5 to get 'everything'. The CFO has approved E5-class licensing for at most 60 users.
1. Separate the requirements that E3 already satisfies from those that genuinely need E5 or the E5 Compliance add-on, and propose a licensing design.
Read the worked answer
Split by capability, then count who actually touches the E5-only ones.
Already covered by E3:
- Seven-year retention policies and manually applied retention labels.
- DLP policies with sensitive information types across Exchange, SharePoint and OneDrive - this blocks the card numbers and matter IDs.
- Core eDiscovery: content search, case management and holds.
- Litigation hold on mailboxes.
Genuinely E5-class:
- Advanced eDiscovery - licensing attaches to the custodian, not the reviewer. If a matter pulls in 15 custodians, those 15 people need E5 or the E5 Compliance add-on.
- Insider Risk Management - the departing-partner scenario.
- Auto-applying retention labels at scale using trainable classifiers on the legacy archive.
Design: keep 640 on E3. Buy 60 E5 Compliance add-ons sized as: an investigation pool large enough to cover the largest realistic custodian set (say 40), plus the compliance and litigation-support team. Keep a documented headroom buffer, and confirm current licensing terms before purchase - custodian licensing is where firms get surprised mid-matter.
2. The IT director argues that legal hold is an E5 feature and therefore all 260 attorneys need E5. Evaluate that claim.
Read the worked answer
It is wrong, and it is the most expensive error in the proposal.
Preservation is not an E5 gate. Mailbox litigation hold and In-Place Hold come with the Exchange Online archiving and hold capabilities included in E3-class mailboxes. Retention policies and retention labels also exist at E3 - what E5 adds is the automation of labels (trainable classifiers, auto-apply) and the advanced eDiscovery case tooling, not the ability to preserve content.
So 260 E5 seats to preserve 15 mailboxes each quarter is roughly a 4x overspend on a requirement already met.
The judgement call is where to spend the 60 seats instead: on custodians who will be added to advanced eDiscovery cases, and on the compliance team running Insider Risk Management. Practical rule - when a new matter starts, check every proposed custodian against the licence report before adding them to the case, because the case will refuse to operate cleanly on unlicensed custodians and you will be buying seats under time pressure.
3. For the departing partner suspected of copying 4,000 files, what should be in place before the exit interview?
Read the worked answer
Evidence first, then containment - and licence the people who need the E5 tooling before the investigation begins, not during it.
- Preserve: place the mailbox and OneDrive on hold so that deletions by the user during notice period cannot destroy evidence.
- Insider Risk Management (E5-class): assign one of the 60 add-ons to that user so the departing-user and data-exfiltration templates can be applied, and so alerts on mass download, unusual external sharing, and personal cloud upload are generated.
- DLP and endpoint coverage: tenant-wide DLP already blocks card numbers and matter IDs, but endpoint DLP (copying to USB or personal cloud from a firm laptop) is E5-class. If endpoint DLP is required, it must be licensed for the laptop population, not one person.
- Audit: confirm unified audit log retention covers the whole notice period; export the record of the 4,000-file activity before the account is disabled.
- On exit: block sign-in, revoke sessions, convert the mailbox to shared, and reassign the OneDrive so the files follow the matter, not the person.
The lesson to feed back into the E3-versus-E5 decision: these events are episodic, so a custodian pool beats blanket E5.