E5 to E3 Downgrade: Rightsizing Microsoft Licenses

An E5 to E3 downgrade is one of the fastest ways to cut Microsoft 365 spend without touching a single feature your people actually use. E5 costs roughly two to three times more per seat than E3, and in most organizations a meaningful share of E5 seats were assigned once, during a rollout or a sales pitch, and never revisited. Rightsizing means matching the license tier to what someone actually does with it, not what they were handed on day one.

The hard part is not the downgrade itself. Changing a license SKU in the Microsoft 365 admin center takes seconds. The hard part is knowing, with confidence, which of your E5 users would not notice the difference. Guess wrong and you strip someone of Defender for Office 365 or Power BI Pro the week they needed it. Guess too conservatively and you keep paying enterprise prices for mailbox-and-Teams usage.

This article walks through how to build that confidence: what actually separates E3 from E5, what usage signals to look at, and how to run a downgrade project without breaking anyone's workflow.

What E5 actually adds over E3

E3 and E5 share the same core: Exchange, SharePoint, Teams, OneDrive, the full Office desktop and web apps. E5 layers on a set of premium capabilities that not everyone needs:

• Advanced security: Microsoft Defender for Office 365 Plan 2, Defender for Identity, Microsoft Entra ID P2 with identity protection and access reviews.
• Advanced compliance: Insider risk management, communication compliance, advanced eDiscovery, customer lockbox.
• Analytics and voice: Power BI Pro, Microsoft Teams Phone with calling plan, audio conferencing.

If a user's job never touches these, an E3 license plus maybe one targeted add-on gets them everything they need. The trap is that E5 was often assigned as a default tier for a whole department, or bundled in during a Microsoft negotiation, rather than mapped to individual need.

Where E5 genuinely earns its price

Rightsizing is not about eliminating E5. Some roles need it:

• Security and compliance teams who actively use Defender and eDiscovery.
• Executives and legal staff under regulatory retention or investigation holds.
• Anyone on a Teams Phone calling plan who would otherwise need a separate telephony contract.
• Power users who build and share Power BI reports regularly.

The goal of a rightsizing exercise is a clean split: E5 for the people who use its premium layer, E3 (or E3 plus a narrow add-on) for everyone else.

Why over-licensing happens in the first place

Nobody sets out to overpay. It accumulates through a handful of predictable patterns.

Default provisioning

New hires get whatever license the previous person in that role had, or whatever the onboarding template says, regardless of whether their actual tasks require it. Once assigned, nobody revisits it.

Enterprise agreement bundling

Volume licensing deals sometimes make E5 pricing attractive at scale, so an organization standardizes on E5 for a whole tenant "to keep it simple." That simplicity has a real cost per seat, every month, for users who never open Power BI.

Fear of removing something

IT teams are naturally cautious about downgrading a license. Nobody wants to be the reason a director loses access to a compliance hold mid-audit. So licenses drift upward and rarely drift back down.

No feedback loop

Most organizations have no regular process that asks "does this person's assigned license match their actual usage?" Access reviews, when they happen, usually check group membership and app access, not license tier against feature usage.

Finding the candidates: what to measure

A rightsizing project needs evidence, not assumptions. Three signal types matter most.

1. Feature-level usage

Microsoft Graph and the Microsoft 365 usage reports expose activity for specific services: Teams Phone minutes, Power BI report views, Defender alerts triggered per user, Purview compliance actions. A user with zero Power BI opens in 90 days and no calling activity is not using the E5-specific value.

2. Sign-in and app activity

Entra ID's sign-in logs, particularly the signInActivity data available through Graph, show which applications a user actually authenticates into. Combined with feature usage, this tells you whether someone is a light Office user or genuinely working across the premium stack.

3. Role and department pattern

Group membership, department, and job title are strong proxies once you have validated them against real usage for a sample of users. If everyone in "Finance Analyst" with real E5 feature usage clusters around Power BI, that becomes a rule you can apply and monitor, not a one-off manual check.

Signal	What it tells you	Where it lives
Power BI report activity	Genuine E5 analytics use	Microsoft Graph usage reports
Teams Phone / calling minutes	Genuine telephony need	Teams admin usage reports
Defender/Purview alerts and actions	Active security or compliance use	Microsoft 365 Defender / Purview
Last sign-in (signInActivity)	Whether the account is active at all	Entra ID via Graph
Department, job title, group membership	Expected profile, to validate against usage	Entra ID / on-prem AD

Running the downgrade without breaking anyone's day

A rightsizing project fails when IT moves too fast on incomplete data, or too slow to ever finish. A workable sequence:

1. Pull usage data for every E5-licensed user across the feature areas listed above, for a 60 to 90 day window.
2. Flag zero-usage and low-usage users on the premium features as downgrade candidates.
3. Cross-check against role: exclude known compliance holds, legal roles, and security team members even if usage looks quiet that month.
4. Notify before you act. A short heads-up to the manager or the user avoids surprise tickets.
5. Downgrade in batches, not all at once, so you can catch edge cases before they multiply.
6. Re-run the same check quarterly. Usage changes: a project role ends, a person moves teams, and their license needs move with them.

Keep the rule alive, not just the one-time cleanup

The real win is not the first cleanup, it is making over-licensing structurally harder to happen again. If new hires are provisioned from attributes (department, job title, location) instead of copied from a colleague, the license tier that goes with a role stays consistent, and drift stops accumulating between reviews.

Where ServiceChanger fits

ServiceChanger's license module reads real Entra ID sign-in activity and keeps a contract and seat registry alongside it, so you can see assigned E5 seats against actual usage patterns in one place instead of stitching together several admin center reports. It flags unused and under-utilized seats and expiring contracts, and gives right-sizing guidance on which seats look like downgrade candidates. That guidance is reporting and insight: ServiceChanger does not change the license SKU itself, the actual downgrade happens in the Microsoft admin center or through your Microsoft partner, same as today.

Because ServiceChanger also automates access through ABAC, once you settle on which roles genuinely need E5-tied features, that pattern becomes a rule that keeps new joiners and movers correctly sized automatically, rather than something you have to re-audit by hand every quarter.

FAQ

How much can an E5 to E3 downgrade actually save? It depends on your Microsoft agreement and region, but E5 typically runs two to three times the per-seat cost of E3. Even downgrading a modest share of clearly over-licensed users adds up quickly across a few hundred seats, since it is a recurring monthly saving, not a one-time discount.

Will downgrading break Teams Phone or compliance holds? Only if you downgrade without checking first. Always cross-reference calling plans, legal holds, and active compliance cases before removing a license. That is why a usage-based review beats a blanket department-wide downgrade.

Should we downgrade everyone with zero Power BI usage immediately? Verify first. Zero usage in a 60 to 90 day window is a strong signal, but confirm there is no seasonal pattern (quarterly reporting, year-end close) before you act. Treat the list as a starting point for review, not an automatic cutoff.

Does ServiceChanger perform the license downgrade for us? No. ServiceChanger reports on real usage, flags over-licensed seats, and gives right-sizing recommendations. The actual license assignment change happens in the Microsoft 365 admin center or through your licensing partner. ServiceChanger gives you the evidence and the list, you keep control of the change.

Next step

If you want to see how many of your E5 seats are actually using the premium layer, that is exactly the kind of gap the ServiceChanger identity and access platform is built to surface. Read more on license management or browse our Microsoft 365 coverage to see how rightsizing fits into a broader access strategy.