Microsoft is packaging its biggest AI and security bets into a single SKU. On May 1, 2026, Microsoft 365 E7 — the Frontier Suite — becomes generally available at $99 per user per month. It bundles Microsoft 365 E5, Microsoft 365 Copilot, Agent 365, the full Microsoft Entra Suite, and the advanced tiers of Defender, Intune, and Purview under one roof.
For IT admins who manage endpoints, identities, and compliance, this is not just a licensing reshuffle. E7 is the first SKU where the AI layer and the management layer are designed as a single product rather than bolted together after the fact. That changes how you should think about it and what you should watch out for.
What’s Actually in the Box
E7 is best understood as three things merged: E5 security and compliance, Copilot AI assistants, and agent-based automation. The headline components are:
- Microsoft 365 E5 baseline — Defender for Endpoint Plan 2, Purview compliance, advanced Entra ID P2 features, full Intune Suite
- Microsoft 365 Copilot Wave 3: next-generation agentic experiences in Word, Excel, PowerPoint, and Outlook, plus Copilot chat with artifact creation
- Agent 365: a separate agent platform also available standalone at $15/user/month, for building custom AI workflows
- Microsoft Entra Suite: Verified ID, Private Access, Internet Access, and External ID under one identity umbrella
- Security Copilot agents: embedded directly inside the Intune admin center, Defender, Entra, and Purview
Wave 3 Copilot also brings something that matters to IT: Claude from Anthropic is now available inside mainline Copilot chat through the Frontier program, alongside the latest OpenAI models. This is the first time a non-Microsoft model sits natively in the M365 chat surface.
Security Copilot Agents in Intune: What Changes Day to Day
The most operationally significant change for endpoint managers is the embedding of Security Copilot agents directly inside the Intune admin center. These are not chat windows. They are purpose-built agents that execute specific tasks with access to live telemetry.
The three production-ready agents at launch:
Change Review Agent evaluates approval requests in Intune and generates recommendations before you commit a change. If you’re deploying a new compliance policy across 10,000 devices, this agent surfaces predicted impact before you click Deploy.
Policy Configuration Agent takes a plain-language document or instruction set and maps it to matching settings in the Intune settings catalog with recommended values. You can then push those settings directly into a new policy from the same pane. This cuts the time to baseline a new device category from hours to minutes.
Vulnerability Remediation Agent pulls Defender vulnerability data and surfaces remediation priorities by device, group, and risk score. It doesn’t stop at listing CVEs. The agent suggests which Intune policies or patch rings to update and can initiate the remediation workflow.
One agent is going away: the Device Offboarding Agent is being retired. After April 30, 2026 you can no longer configure it, and it is fully removed from the admin center on June 1, 2026. If you’ve built any automated workflows around that agent, flag it now.
There’s also a newer arrival worth tracking: the Intune Policy Intelligence Agent, announced April 1, 2026, which works without requiring a full Security Copilot license. This means some of the AI-assisted policy tooling trickles down to organizations not yet on E5 or E7.
Entra Changes That Affect Identity Workflows
E7 includes the full Entra Suite with a few capabilities rolling out through 2026:
Passkey registration campaigns let admins push targeted nudges to users who haven’t enrolled a passkey yet, with configurable reminder intervals and enforcement thresholds. This changes how security teams approach phishing-resistant authentication rollouts. Instead of a one-time push, you get a configurable nudge-and-enforcement loop managed from the portal.
Backup and recovery for users and groups is now native. Entra can restore deleted users and groups, which has been a gap that drove many organizations to third-party backup tools.
Centralized tenant governance gives multi-tenant environments a unified governance view. Useful for MSPs and large enterprises running multiple tenants.
External MFA via OpenID Connect is expected by September 2026. This lets you integrate a third-party MFA provider without abandoning Entra Conditional Access.
The Licensing Math: When E7 Makes Sense
The bundle is priced to win at the fully-loaded knowledge worker level. If you’re currently running M365 E5 ($57/user/month), Copilot ($30/user/month), and Agent 365 ($15/user/month) as separate SKUs under July 2026 pricing, you’re paying $105 per user. E7 brings that to $99. The saving is real but modest at $6/user/month.
The more important calculation is timing. E5 pricing increases on July 1, 2026. Organizations with annual renewals between May 1 and July 1 are in a transition window where locking in current E5 pricing may still be the better short-term move, depending on Copilot adoption readiness. E7 makes the most sense for organizations that have already rolled out Copilot and are seeing sustained usage.
Three things to watch before you sign:
Segment your user population. E7 is not the right SKU for frontline workers, task-based users, or anyone whose job doesn’t involve document creation, analysis, or complex communication workflows. Paying $99/user for a warehouse worker who needs Teams and email is wasteful. Microsoft offers E7 with or without Teams, but the AI tier doesn’t flex. Everyone in the E7 count gets the full Copilot entitlement whether they use it or not.
Copilot Cowork is not GA at launch. Cowork enters research preview in March through the Frontier program. It is not a Day 1 GA feature. If your evaluation includes Cowork as a key deliverable, treat it as directional, not available on May 1.
Audit actual Copilot adoption first. Before committing to E7 at renewal, pull your Copilot usage reports from the Microsoft 365 admin center. If fewer than 60% of your Copilot-licensed users are active monthly, the bundle math doesn’t change the adoption problem.
A Practical Upgrade Workflow
If your organization is actively evaluating E7, here’s how to approach the decision without getting caught off-guard:
- Pull your current SKU mix. Export license assignments from Microsoft 365 admin center or via Graph API. Identify your E5 count, Copilot count, and Agent 365 count separately.
- Segment users by profile. Knowledge workers (Copilot makes sense), task workers (Copilot doesn’t), frontline (different SKU track entirely).
- Check your renewal date. If you renew before July 1, 2026, model both scenarios: lock E5 pricing now versus move to E7 at renewal.
- Enable the Intune Policy Intelligence Agent now. It doesn’t require E7 or Security Copilot. Get your team comfortable with AI-assisted policy management before the full agent suite lands.
- Pilot the Change Review Agent and Vulnerability Remediation Agent in a non-production tenant if you have access through the Frontier program. These are the agents most likely to change day-to-day admin workflows.
- Document your Device Offboarding Agent dependencies by April 30. Anything pointing at that agent needs to be rebuilt before June 1.
Limitations and Caveats
E7 is a compelling bundle, but a few things are worth naming plainly.
Adoption is still the hard part. No SKU change makes Copilot useful if users don’t have the right data hygiene, sensitivity labels applied, or workflows in place. E7 accelerates the licensing math. It doesn’t accelerate readiness.
Agent autonomy needs governance. The Security Copilot agents in Intune can initiate remediation workflows. That’s powerful, and it also means you need to define clear approval gates, especially for the Vulnerability Remediation Agent operating on production devices. Review the role requirements carefully. Microsoft recommends least-privileged roles per agent, but the defaults may be broader than your security team expects.
External MFA integration isn’t there yet. If your evaluation includes replacing a third-party MFA provider with a fully Entra-native stack, that OpenID Connect integration doesn’t land until September 2026 at the earliest.
Regional availability varies. Agent 365 and some Entra Suite features have regional rollout schedules. Verify availability in your tenant’s data region before building deployment timelines around them.
The Bottom Line
Microsoft 365 E7 is the most coherent packaging of Microsoft’s AI and security capabilities to date. For organizations already running E5 with Copilot and seeing genuine adoption, it simplifies the licensing stack and adds meaningful new automation in Intune, Entra, and Defender.
For organizations still working through Copilot adoption or managing large populations of non-knowledge workers, the bundle math is narrower and the operational lift is real. The agents in Intune are worth deploying regardless of which SKU you’re on. Start with the Policy Intelligence Agent now, assess the Security Copilot agents in a pilot, and let actual usage data drive the renewal decision.
May 1 is close. The decision doesn’t have to be.