Microsoft 365 Arrives (July 2017): Security Bundled Into the Productivity Suite

Retrospective: this article looks back at events from July 2017, written in 2026 with the benefit of hindsight.

In July 2017, Microsoft announced Microsoft 365: a single subscription bundling Office 365, Windows 10 Enterprise and Enterprise Mobility + Security. For the first time, many organizations got identity protection, device management and threat protection in the same license as email and Office.

What changed

Microsoft 365 came in tiers. E3 covered productivity, Windows and core security such as Azure AD Premium P1 (now Entra ID P1), Intune and basic information protection. E5 added advanced capabilities: risk-based identity protection, privileged identity management, advanced threat protection for email and endpoints, cloud app security and advanced compliance tools. A Business edition for smaller organizations followed.

Why it mattered

Security tools had been bought one product at a time. Bundling changed the economics: if you already paid for a capability, deploying it was cheaper than buying a third-party product. It also shifted Microsoft from a productivity vendor into one of the largest security vendors in the world.

The catch

Licensing a feature is not the same as using it. Many organizations paid for E3 or E5 for years without configuring Conditional Access, Defender for Office 365 policies or data loss prevention. Unused licenses gave a false sense of security.

In hindsight

Microsoft 365's bundling strategy succeeded — and created a new job: mapping what you own to what you have actually turned on. Product names changed repeatedly (Azure AD became Entra ID; Advanced Threat Protection became Defender), but the gap between "licensed" and "configured" remains one of the most common findings in Microsoft 365 assessments today.