Microsoft E7: what mid-market firms need to know in May

Microsoft’s new Microsoft 365 E7 licence launched on 1 May. Here’s an independent advisory for mid-market IT decision-makers – and not a product review. 

What is Microsoft 365 E7? 

Microsoft 365 E7 is a new enterprise licensing tier that bundles Microsoft 365 E5, Microsoft 365 Copilot, the Microsoft Entra Suite and a new product called Agent 365 into a single subscription. It became generally available on 1 May 2026. 

The product that makes E7 genuinely new, rather than just a new bundling of things that already exist, is Agent 365. It functions as a control plane for AI agents – a governance and visibility layer that lets your IT or security team see, manage and secure every agent operating in your Microsoft 365 environment, in the same way Microsoft Entra manages user identities and Microsoft Intune manages devices. 

E7 is Microsoft’s clearest signal yet that agentic AI is no longer an experiment. It’s meant to be live in infrastructure. 

Why agents matter for mid-market security 

An AI agent, from a security standpoint, is functionally similar to a user or a device. It has an identity. It has access permissions. It can be compromised. 

Every time someone in your business creates an agent through Copilot Studio, Power Automate or a connected third-party tool, they add something to your environment that you or your security team need to have visibility of. That’s not a hypothetical future risk. It’s happening now, in most Microsoft 365 environments, without centralised oversight. 

The risk with any major AI push is that the excitement about what’s possible outpaces the work of securing it properly. “Everybody’s investing all their money in the exciting bit. And then not considering the really dull, boring bit that will cause the whole house of cards to collapse if we’re not careful,” says Garry Owen, Solutions Expert, Softwerx. 

Agent 365 addresses this directly. It extends your existing Microsoft security tools, including Microsoft Defender, Microsoft Entra and Microsoft Purview, to cover agents as well as users. Your team uses the same consoles they already know; the environment just gets richer. 

Does E7 make sense for mid-market businesses? 

The honest answer is: it depends entirely on where your organisation is right now. 

E7 is worth serious consideration if you’re already running Microsoft 365 E5 and using Microsoft 365 Copilot actively; you have AI agents deployed across the business without a governance framework; your identity management genuinely needs advanced Microsoft Entra Suite capabilities; and you have a clear plan for AI adoption over the next 12-18 months. The bundle economics are real, with buying the components separately costing more. 

E7 is probably premature if you’re on Microsoft 365 Business Premium or Microsoft 365 E3 and haven’t yet activated the security features already in your licence; your Microsoft 365 Copilot usage is limited or uneven; your team doesn’t have the operational capacity to govern what E7 introduces.  

As Garry Owen, Cybersecurity Solutions Lead, puts it: “A lot of businesses are barely ready for last year’s AI model, let alone next year’s.” 

The question that comes first 

According to Microsoft’s own Digital Defense Report, multi-factor authentication (MFA) adoption across organisations sits at just 41% — despite Microsoft’s data showing MFA blocks over 99% of account compromises. That figure, in our experience, is entirely consistent with what we see across mid-market Microsoft 365 environments. 

Conditional access policies not configured. Microsoft Defender plans activated but not tuned. Microsoft Purview licences sitting unused. Identity protection controls switched off. 

Before the question of what to add, the more pressing question for most mid-market businesses is: what do you already have, and is it running properly? 

One option that doesn’t require E7 

Agent 365 is available as a standalone add-on, independently of the full E7 bundle. If your immediate concern is that AI agents are running in your environment without oversight, that option exists. It’s worth understanding before committing to the full suite. 

The regulatory background 

The UK Cyber Security and Resilience Bill is currently progressing through Parliament, with Royal Assent expected in 2026. Its most significant provision for mid-market businesses is the supply chain dimension – organisations regulated under the new framework will need to demonstrate that their suppliers meet appropriate security standards. We will cover this in a separate article this month. 

If you sit within a larger organisation’s supply chain, in manufacturing, professional services or public sector contracting, for example, security requirements will increasingly be passed down to you, regardless of whether you’re directly regulated. E7’s governance capabilities are relevant to that pressure. But so is getting your existing Microsoft 365 security configuration right. 

The Softwerx position 

We work exclusively with mid-market businesses on Microsoft Security. Our view on E7 is the same as our view on every licensing decision: the most expensive thing in security is paying for capability you’re not running. 

For some businesses, E7 in 2026 is the right call. For others, the better first move is a clear-eyed look at what’s already in their licence and what’s running. That’s where we start with every client, before any conversation about managed services. Talk to us about our Softwerx Security Assessment for an honest picture of what you have, what’s activated, and what the gaps are. 

Softwerx is a Microsoft Security specialist for mid-market organisations in the UK. We help businesses understand and get more from their existing Microsoft investment – through expert advisory, consultancy and support across Microsoft infrastructure, security and licensing. Our UK-based Security Operations Centre runs 24x7x365 with human analysts monitoring your environment, supported by our managed extended detection and response service, secure365®. www.softwerx.com