Microsoft Enterprise Mobility + Security (EMS) is a collection of security and management products from Microsoft that work seamlessly with Office 365. In this article we will go through EMS to outline what is it, why it’s beneficial, what’s included and compare licenses, costs and features between E3 and E5 to help you choose the right version.
Increasing security risks
Many organisations are already using and benefiting from Office 365 and other cloud services, which has enabled staff and organisations to adopt new working behaviours to increase productivity and flexibility. Remote working, increased mobility, BYOD, and instant access to cloud services have empowered staff to work effectively – but this brings new risks, security vulnerabilities and management headaches to IT departments.
Staff can now easily store sensitive company data in places outside of IT control (shadow IT), or access information on personal devices, which can have little to no security protection in place. Situations like these – and many more – make managing your company network, identities and data difficult, as the boundary of your company IT landscape is blurred.
Consequently, companies need to adopt a ‘new’ cyber security model: zero trust networking and move away from the historic perimeter method, which is no longer effective. You can find out more on this in our article ‘The new cyber security model.’ EMS provides a range of products and features to help organisations overcome these challenges, adopt a zero-trust approach and centrally manage and secure data, identities and devices.
EMS can be purchased as a standalone offering and comes in two versions: E3 and E5. E3 costs £6.60 per user per month and E5 costs £11.20 per user per month (commercial ERP pricing). Academic discounted pricing is available and discounted Not for Profit pricing – which includes free ‘donated’ EMS licences as part of Microsoft’s $5,000 Azure donation for charities. If you would like to find out more on this, please contact us.
As well as being able to purchase as a standalone, EMS is available within Microsoft 365. Microsoft 365 combines Office 365, EMS and Windows 10 into one bundle available as Business, E3 and E5. If you do not wish to make the step to Microsoft 365 E5 but want the security capabilities, then there is a security addon (‘Microsoft 365 E5 Security’ addon) that you can purchase on top of Microsoft 365 E3 that comes with the E5 security features across Office 365, EMS and Windows 10.
Comparing E3 and E5
As mentioned, EMS is available in E3 and E5 (as well as a scaled down E3 version included in Microsoft 365 Business, which we haven’t included here). As you would expect, E3 contains the core functionality while E5 provides additional products and capabilities over and above E3. You can what’s included in our comparison table:
Azure Active Directory
Azure AD is a cloud-based identity and access management solution from Microsoft. Azure Active Directory comes in four versions: free (included with an Azure subscription) and an Office 365 edition, which provide more basic functionality and then two premium versions: P1 and P2, which are included with EMS (P1 in E3 and P2 in E5) – you can review the complete list of versions and their features here. Key features of Azure AD include:
- Streamlined user experience and logins with single sign-on (SSO) across thousands of SaaS applications
- Elevate security with built-in MFA and apply conditional access policies based on location, device and more to transition to a zero-trust approach
- Centralise and simplify identity management with advanced administration capabilities, such as group policies and dynamic groups
- Empower staff and reduce IT overhead with self-service capabilities, such as self-service password reset (SSPR) and application requests
- Integrate Azure AD with other Microsoft services, such as Cloud App Security for holistic security, or allow remote device building with Windows Autopilot and Intune
Intune is Microsoft’s Unified Endpoint Management (UEM) solution helps to protect and manage your staff devices and data – across mobiles, tablets, laptops and PCs. Key features include:
- Mobile device management across your entire mobile and PC ecosystem (iOS, Android and Windows) as well as all Windows 10 devices – for a complete solution
- Mobile app management to secure business apps and data on personal devices (BYOD) so staff can work securely on whatever device
- Ensure devices and apps are compliant with company security requirements
- Allow ‘zero touch’ IT – so that staff devices can be remotely deployed, reset or wiped to reduce courier costs and speed up efficiency
- Automatically remove threats across all managed endpoint when integrated with Microsoft Defender Advanced Threat Protection
Advanced Threat Analytics
This is Microsoft’s on-premise threat detection platform that detects and investigates advanced attacks on your network using machine learning to rapidly alert you of any suspicious activity or anomalies. Advanced Threat Analytics (ATA) is included within EMS E3, whereas the cloud-based version is Azure ATP and included with EMS E5. Key features include:
- Learns typical user behaviour so that only anomalies or important issues are sent; greatly reducing alert noise
- Improves speed of detection and picks up suspicious patterns that would otherwise likely go undetected
- Prioritises risks and displays clear incident information with a simple timeline to make investigation much quicker, easier and more efficient
Azure Advanced Threat Protection
Azure ATP is the cloud-based version of Advanced Threat Analytics and included with EMS E5, providing all the above features but delivered via Azure.
Azure Information Protection
Sometimes referred to as AIP, this solution is for information management and protection and available within EMS as P1 or P2. AIP allows organisations to configure policies and classify their data and then provide persistent protection (using Azure Rights Management) to protect the data wherever it goes – especially important for data governance and compliance. Key features include:
- Ability to apply sensitivity labels and configure policies to tightly control data access and determine what is and isn’t allowed for labels (such as printing, forwarding, etc)
- Automatically search, classify and protect your company documents and files
- Ensure persistent protection so that it doesn’t matter where documents go – they are always protected with your configured rules
- Easily share data with external contacts and have peace of mind that access can be revoked at any point- ideal for sharing data with partners and suppliers
- Gain visibility on all data governance and documentation with powerful reporting and logging
Microsoft Cloud App Security (MCAS)
This is a Cloud App Security Broker (CASB) solution that provides visibility and control over your data across cloud services – Microsoft and third-party services, such as Salesforce, Dropbox etc. With MCAS, you can:
- Discover and control shadow IT – identify third-party apps in usage, review associated risks and compliance, analyse usage and then manage access and controls
- Classify and protect data across your cloud apps – apply policies (or automate labelling) with Azure Information Protection to make data self-protecting wherever it goes
- Detect unusual cloud behaviour to identity and remediate threats (such as compromised users and ransomware) with alert scoring and remediation actions
- Review your cloud app compliance – check the compliance risk of various cloud apps and drill into app usage to assess risk
Microsoft 365 Enterprise Guide
To find out more about Microsoft 365, you can download our Microsoft 365 Enterprise Guide – which outlines all the included features, benefits, costs and licensing.
Or, if you would like a trial or demo of Microsoft 365 then please contact us.
EMS is a powerful security and mobility solution and ideal for organisations already using Office 365. While it is available as a standalone, it is worth considering Microsoft 365, which combines the two solutions with Windows 10 – which is especially important with the upcoming end of Windows 7 support in January 2020.