Appendix C: Licensing & Compliance Matrix

The choice between Microsoft 365 G3 (E3) and G5 (E5) is not merely a feature decision: it is a "manual effort vs. automated enforcement" decision for compliance. For an executive-level overview of the CRAWL-WALK-RUN licensing path and when to upgrade, see License Tiers: G3 vs. G5 Decision Guide.

GCC High

G3 vs. G5 for CMMC Level 2

G3 can form part of a CMMC Level 2 implementation when all required outcomes are met. G5 adds automation and telemetry, but no license automatically satisfies a practice. Configuration, operating procedures, and evidence remain necessary.

Microsoft's government Defender for Endpoint licensing states that G3 includes Plan 1. Plan 2 requires an eligible higher-tier or standalone entitlement, as it does in Commercial.

CMMC Practice	Capability	M365 GCC High G3	M365 GCC High G5	Compliance Impact
AC.L2-3.1.5 (Least Privilege)	Privileged Identity Management (PIM)	No (Manual admin accounts)	Yes (JIT Elevation)	G5 automates "Just-in-Time" access, removing standing admin risk.
AC.L2-3.1.1 (Authorized Access)	Entitlement Management	No (Manual invitations)	Yes (Access Packages)	G5 provides self-service access requests with automated expiry.
AU.L2-3.3.1 (System Auditing)	Audit Log Retention	180 days (Standard)	1 year for eligible users and covered workloads	Set retention from contractual and operational requirements. CMMC Rev. 2 does not impose a universal one-year period.
AU.L2-3.3.5 (Audit Analysis)	Purview Audit Premium	No	Yes	Premium adds retention and investigation capabilities. MailItemsAccessed is also available in Audit Standard; it is not an E5-only entitlement.
SC.L2-3.13.16 (CUI at Rest)	Information Protection	Manual Labeling Only	Auto-Labeling	G5 can automatically encrypt CUI based on content scan (SITs).
SI.L2-3.14.7 (Identify Unauthorized)	Defender for Identity / Cloud Apps	Add-on Required	Included	G5 provides behavioral analytics across identity and SaaS apps.
IR.L2-3.6.1 (Incident Handling)	Automated Investigation (AIR)	No	Yes	Configure supported investigation/remediation actions and approval levels; automation supports the organization's incident-handling process.

The "E5 Security" Middle Ground

For organizations on G3 that need the security features but not the compliance features (Audit Premium/Insider Risk), the M365 G5 Security Add-on is the most common path. It includes the full Defender XDR suite and Entra ID P2 (PIM), but excludes the advanced Purview compliance tools.

Commercial

E3 vs. E5 for NIST SP 800-171 Rev. 3

While NIST SP 800-171 compliance can be achieved on an E3 license, it requires significant manual overhead for audit log retention and privileged access gating. E5 automates several high-friction requirements through advanced telemetry, behavioral analytics, and automated enforcement.

Commercial E3 includes Defender for Endpoint Plan 1. E5 adds Plan 2 EDR and investigation capabilities; the same Plan 1 versus Plan 2 distinction applies to GCC High G3 versus the eligible higher-tier offers.

NIST 800-171 Requirement	Capability	M365 Commercial E3	M365 Commercial E5	Compliance Impact
3.14.2 / 3.14.6 (Malicious Code / System Monitoring)	Defender for Endpoint	Plan 1	Plan 2 (EDR)	Plan 2 expands detection and response. Rev. 3 specifies security outcomes, not a Microsoft product or license.
3.1.5 (Least Privilege)	Entra ID P2 (PIM)	No	Yes	E3 requires separate "Admin-only" accounts with standing access.
3.3.3 (Audit Record Generation and Retention)	Purview Audit	180 days	1 year for covered workloads and licensed users	Configure the retention period required by policy; route or export records where native retention is insufficient.
3.13.8 (Transmission and Storage Confidentiality)	Purview Auto-labeling	No	Yes	E5 automatically finds and encrypts data, reducing "human error" risk.
3.11.2 (Vulnerability Monitoring and Scanning)	Defender Vulnerability Management	Separate entitlement needed	Core capabilities through MDE Plan 2	Premium vulnerability-management capabilities can require a further add-on.
3.14.6 (System Monitoring)	Insider Risk Management	No	Yes	E5 detects data exfiltration patterns (USB copy, large downloads) natively.

Decision Summary: When to Upgrade

• Stay on E3 if: You have a small user count and a robust SIEM (Sentinel) strategy to handle log retention and manual account gating.
• Move to E5 if: You have a distributed workforce, handle high volumes of CUI/PII, and want to reduce "Total Cost of Compliance" by automating incident response and access reviews.

---

Technical Comparison Reference

Feature	G3 / E3	G3 / E3 + G5 / E5 Security	Full G5 / E5
Entra ID P2 / PIM	Add-on	Included	Included
Defender for Endpoint	Plan 1	Plan 2	Plan 2
Defender for Office 365 Plan 2	Add-on	Included	Included
Defender for Identity	Add-on	Included	Included
Defender for Cloud Apps	Add-on	Included	Included
Purview Audit Premium	Add-on	Separate Purview entitlement	Included
Purview service-side auto-labeling	Add-on	Separate Purview entitlement	Included
Insider Risk Management	Add-on	Separate Purview entitlement	Included
Endpoint Privilege Management	Check Intune add-on entitlement	Security add-on alone does not establish entitlement	Included in the 2026 suite expansion; verify the applicable government offer and tenant rollout

Check the Purview service description, 2026 packaging FAQ, and Intune government availability against the actual purchased SKU. Entra ID P2 does not include every Entra ID Governance feature. Audit retention depends on the user generating the event and its workload, not merely the administrator's license. MailItemsAccessed is documented as Audit Standard functionality.