-
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathtree.js
More file actions
3854 lines (3842 loc) · 382 KB
/
tree.js
File metadata and controls
3854 lines (3842 loc) · 382 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// Decision-tree data. Edit nodes here, then run `npm run validate-tree`.
// Node shapes: choice | question (yes/no) | info | result.
// ---------------------------------------------------------------------------
// Shared mini-card breakdowns
//
// These constants are referenced from multiple umbrella questions so we only
// maintain the source-of-truth in one place. Edit here once and every
// question that references them (the upstream Defender / Purview umbrella +
// the "ALSO need..." breadth follow-ups) picks up the change.
//
// DEFENDER_SUITE_MINI_CARDS — used by `q_defender` (the admin's own-Defender
// trigger check) and `q_purview_e5_breadth` (the "after Purview Yes, do you
// ALSO need Defender?" follow-up). Five cards: Defender for Office 365 P2,
// Defender for Endpoint P2, Defender for Identity (tenant-wide *
// informational), Defender for Cloud Apps, Defender XDR.
//
// PURVIEW_E5_BREADTH_MINI_CARDS — used by `q_defender_breadth` (the "after
// Defender Yes, do you ALSO need Purview?" follow-up). Four focused cards
// covering the most common per-user Purview E5 triggers: IRM, Communication
// Compliance, eDiscovery (Premium), Audit (Premium). The full 12-card
// Purview breakdown lives inline on `q_purview_e5` (the upstream umbrella);
// the breadth-question version is a focused recap, not a duplicate.
//
// INTUNE_SUITE_MINI_CARDS — used by `q_intune_suite` (admin's own Intune Suite
// trigger check) and `q_intune_breadth` (bundle-vs-standalone follow-up).
// Six cards: Remote Help (unique helper+sharer rule), EPM, Tunnel for MAM
// (Suite-only, no standalone), Cloud PKI, EAM, Advanced Analytics.
// ---------------------------------------------------------------------------
const DEFENDER_SUITE_MINI_CARDS = [
{
name: "Defender for Office 365 Plan 2",
sku: "M365 E5 / M365 E5 Security / Defender for Office 365 P2 standalone / Office 365 E5",
scope: "tenant-wide-scopeable",
scopeNote:
"Tenant-wide by default but scopeable down to licensed mailboxes. Microsoft's Defender for Office 365 service description and the Standard / Strict preset security policies apply Safe Links, Safe Attachments, anti-phishing impersonation protection, Safe Attachments for SharePoint / OneDrive / Teams, Threat Explorer, Automated Investigation and Response (AIR), and Attack Simulation Training across the whole tenant unless you scope them. Admins should scope each policy (Safe Links, Safe Attachments, anti-phish, ASR Training campaigns) to only the user mailboxes / shared mailboxes / resource mailboxes / Microsoft 365 groups that actually hold a Defender for Office 365 P2 entitlement \u2014 either by using the preset policy 'Users, groups, and domains' include lists, or by building custom policies with explicit recipient scoping. Microsoft Product Terms require a per-mailbox licence for every mailbox covered by the scope you configure (user mailbox, shared mailbox, resource mailbox, room, or equipment).",
inScopeMeans:
"this user's Exchange Online mailbox falls inside the recipient scope of a Safe Links / Safe Attachments / anti-phish policy (or the Standard / Strict preset), OR they are enrolled in Attack Simulation Training as a trainee.",
notInScopeMeans:
"every Defender for Office 365 P2 policy explicitly excludes this user's mailbox (or they have no Exchange Online mailbox at all), AND they are not enrolled in any ASR Training campaign. They still get the always-on EOP anti-malware / anti-spam baseline that comes with every Exchange Online mailbox SKU.",
examples: [
"Yes (licensed correctly): this user holds M365 E5; their mailbox is in scope of the Strict preset, so Safe Links rewrites their URLs and Safe Attachments sandboxes their attachments.",
"Yes (under-licensed \u2014 needs uplift): this user holds M365 E3 only and the tenant's Safe Links policy is scoped to 'all users' \u2014 silently covering them. Per Product Terms, each protected mailbox needs a P2 entitlement; either uplift to E5 / E5 Security / Defender Suite add-on, or exclude their mailbox from the policy.",
"Yes: this user is enrolled as a trainee in an Attack Simulation Training campaign \u2014 ASR Training requires a P2 entitlement on the trainee.",
"No (current licence already covers it): this user holds M365 E3 and every Defender for Office 365 policy is scoped to the 'mdo-p2-licensed' group; their mailbox is explicitly excluded. They keep the EOP baseline at no extra cost.",
"No (tenant-vs-user note \u2014 unlicensed user): this user has no Exchange Online mailbox at all (e.g. an Entra-only break-glass account); Defender for Office 365 has no mailbox footprint to protect them and the licence trigger never fires."
],
docs: [
["Microsoft Defender for Office 365 service description", "https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description#microsoft-defender-for-office-365"],
["Recipient filters for Defender for Office 365 policies", "https://learn.microsoft.com/defender-office-365/recipient-filters-in-preset-security-policies"],
["Preset security policies (Standard / Strict)", "https://learn.microsoft.com/defender-office-365/preset-security-policies"],
["Defender for Office 365 plans and pricing", "https://learn.microsoft.com/defender-office-365/mdo-security-comparison"]
]
},
{
name: "Defender for Endpoint Plan 2",
sku: "M365 E5 / M365 E5 Security / Defender for Endpoint P2 standalone (per-user or per-device)",
scope: "per-device",
scopeNote:
"Per onboarded endpoint. Microsoft's Defender for Endpoint licensing guide allows two purchase models: per-user (each user covers up to 5 devices \u2014 the M365 E5 / E5 Security / Defender Suite add-on path) or per-device standalone (typically used for shared / kiosk / OT endpoints). EDR, attack-surface-reduction reporting, automated investigation, advanced hunting on device data, vulnerability management, and threat-and-vulnerability remediation all require a P2 entitlement on the device. Defender for Endpoint Plan 1 (bundled in M365 E3 / E5 / F3 / Business Premium) provides next-gen AV + manual response / ASR rules only \u2014 no EDR / AIR / advanced hunting.",
inScopeMeans:
"this user's Windows, macOS, Linux, iOS, or Android device is onboarded to Defender for Endpoint and shows up in Device Inventory under their identity, AND the Defender for Endpoint experience the device reports is P2 (EDR + AIR + advanced hunting), not Plan 1.",
notInScopeMeans:
"this user has no Defender for Endpoint sensor on any device they use, OR every device they use runs Plan 1 only (next-gen AV + ASR rules, no EDR / advanced hunting).",
examples: [
"Yes (licensed correctly): this user holds M365 E5; their managed laptop is onboarded to Defender for Endpoint P2 and shows up in Device Inventory under their identity.",
"Yes (under-licensed \u2014 needs uplift): this user holds M365 E3 and their laptop is silently onboarded to Defender for Endpoint P2 via group-based onboarding. P2 needs an E5 / E5 Security / Defender Suite add-on / per-user P2 entitlement on the user (or per-device on the endpoint) \u2014 uplift, or move the device back to Plan 1.",
"No (current licence already covers it): this user holds M365 E3, which bundles Defender for Endpoint Plan 1. Their laptop reports Plan 1 telemetry only \u2014 no EDR / advanced hunting \u2014 and no P2 licence trigger fires.",
"No: this user only ever uses an unmanaged personal device with no Defender sensor of any plan, or an Azure VM jumpbox that has no Defender for Endpoint sensor installed."
],
docs: [
["Defender for Endpoint licensing options", "https://learn.microsoft.com/defender-endpoint/minimum-requirements#licensing-requirements"],
["Compare Defender for Endpoint plans (P1 vs P2)", "https://learn.microsoft.com/defender-endpoint/defender-endpoint-plan-1-2"]
]
},
{
name: "Defender for Identity",
sku: "M365 E5 / M365 E5 Security / EMS E5 / Defender for Identity standalone",
scope: "tenant-wide-not-scopeable",
scopeNote:
"Technically tenant-wide and not scopeable. The Microsoft Defender service description states verbatim that \u201CMicrosoft Defender for Identity features are enabled at the tenant level for all users within the tenant\u201D and that the service \u201Cisn't currently capable of limiting benefits to specific users.\u201D The sensor on Domain Controllers / AD FS / AD CS / Entra Connect observes every account in the monitored forest \u2014 you cannot scope it to a subset. Microsoft Product Terms still require a per-user Defender for Identity / EMS E5 / M365 E5 / E5 Security / Defender Suite add-on licence for every user who benefits from the service. Microsoft's Secure Future Initiative (Secure by Default principle) recommends enabling identity-threat protection like MDI on every tenant that has on-premises AD.",
inScopeMeans:
"the tenant has deployed any Defender for Identity sensor (on a Domain Controller, AD FS, AD CS, or Entra Connect server) \u2014 every user monitored by that sensor benefits, including this user.",
notInScopeMeans:
"the tenant has not deployed any Defender for Identity sensor on any Domain Controller, AD FS, AD CS, or Entra Connect server.",
examples: [
"Yes: any Defender for Identity sensor is running anywhere in the tenant's monitored forest \u2014 this user (along with every other monitored user) is a beneficiary and needs a licence.",
"No: a greenfield / cloud-only tenant with no on-prem AD and no Defender for Identity sensors deployed; the licence is not yet triggered for anyone."
],
docs: [
["Microsoft Defender for Identity service description", "https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description#microsoft-defender-for-identity"],
["Defender for Identity prerequisites (licensing)", "https://learn.microsoft.com/defender-for-identity/deploy/prerequisites-sensor-version-2#licensing-requirements"],
["Microsoft Product Terms", "https://www.microsoft.com/licensing/terms/"],
["Microsoft Secure Future Initiative (SFI)", "https://www.microsoft.com/en-us/trust-center/security/secure-future-initiative"]
]
},
{
name: "Defender for Cloud Apps",
sku: "M365 E5 / M365 E5 Security / EMS E5 / Defender for Cloud Apps standalone",
scope: "tenant-wide-scopeable",
scopeNote:
"Tenant-wide by default but scopeable. The Microsoft Defender service description states \u201CBy default, Microsoft Defender for Cloud Apps is enabled at the tenant level for all users within the tenant\u201D and then provides an explicit Scoped Deployment capability so admins can limit the service to licensed users / groups. Microsoft Product Terms require a per-user licence for every user covered by the scope you configure \u2014 Conditional Access App Control sessions, file / activity / OAuth-app policies, and attributed Cloud Discovery activity all count.",
inScopeMeans:
"this user's identity is included in the configured Scoped Deployment (or no Scoped Deployment is configured, so the tenant default applies), AND Defender for Cloud Apps activity / file / OAuth / session policies cover them.",
notInScopeMeans:
"a Scoped Deployment explicitly excludes this user's identity, AND no Conditional Access App Control or activity policy targets them.",
examples: [
"Yes (licensed correctly): this user holds M365 E5; a Conditional Access App Control policy routes their Salesforce / ServiceNow sessions through the Defender for Cloud Apps reverse-proxy for download restrictions.",
"Yes (under-licensed \u2014 needs uplift): this user holds M365 E3 and the tenant has no Scoped Deployment configured \u2014 so Defender for Cloud Apps is silently watching them. Either uplift to E5 / E5 Security / Defender Suite add-on, or configure Scoped Deployment to exclude them.",
"No (current licence already covers it): Scoped Deployment is configured to include only the Sales group; this user is in IT and explicitly excluded.",
"No: the tenant has Defender for Cloud Apps disabled / has never connected any apps; no per-user licence is triggered for anyone."
],
docs: [
["Microsoft Defender for Cloud Apps service description", "https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description#microsoft-defender-for-cloud-apps"],
["Defender for Cloud Apps scoped deployment", "https://learn.microsoft.com/defender-cloud-apps/scoped-deployment"],
["Defender for Cloud Apps editions and licensing", "https://learn.microsoft.com/defender-cloud-apps/editions-cloud-app-security"]
]
},
{
name: "Microsoft Defender XDR (correlation and incident layer)",
sku: "Auto-entitled by any qualifying license; no separate per-user SKU",
scope: "tenant-wide-scopeable",
scopeNote:
"Tenant-level entitlement, layered. Defender XDR is the cross-workload correlation, incident grouping, advanced hunting (KQL over 30 days of raw alert + signal data), automated investigation & response (AIR), automatic attack disruption, threat analytics, and unified portal experience at security.microsoft.com. There is no separate per-user Defender XDR SKU \u2014 customers are entitled automatically when at least one qualifying license is present in the tenant. Per Microsoft's official prerequisites, qualifying licenses include: M365 E5 / A5, M365 E3 + Defender Suite add-on, M365 E3 + EMS E5 add-on, M365 A3 + M365 A5 Security add-on, M365 Business Premium, Defender for Business, Windows 10/11 Enterprise E5 / A5, EMS E5 / A5, Office 365 E5 / A5, and any of the four per-user component SKUs (Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity, Defender for Cloud Apps). Crucially: Plan 1 versions (Defender for Endpoint P1, Defender for Office 365 P1, Defender for Business basic-only) do NOT qualify \u2014 they surface basic telemetry in the Defender portal but no XDR correlation / AIR / advanced hunting. Per-user visibility scope follows the underlying components: a SOC analyst's hunt only sees signals from identities / mailboxes / devices that hold qualifying licenses, and two XDR-tier features have a stricter dependency \u2014 Automatic Attack Disruption and Threat Analytics require Defender for Endpoint Plan 2 specifically.",
inScopeMeans:
"this user holds at least one qualifying license (any M365 E5 / A5 family SKU, M365 Business Premium, Defender for Business, E3 + Defender Suite add-on, EMS E5, O365 E5, or any of the four P2-tier Defender component SKUs); Defender XDR is automatically entitled for them with no extra cost, and incidents correlate across whichever components they hold.",
notInScopeMeans:
"this user holds no qualifying license \u2014 only Plan 1 / entry-level Defender (e.g., M365 E3 base with DfE P1 + DfO P1 only) or no Defender entitlement at all (Exchange Online Plan 1 standalone, M365 Apps for Business, F1 with no DfE assignment). They have nothing for Defender XDR to correlate beyond basic component telemetry.",
examples: [
"Yes (E5 path): this user holds M365 E5; all four Defender components light up in the unified Defender portal and incidents span email + endpoint + identity + cloud apps for them. Attack disruption and threat analytics fully available (E5 includes DfE P2).",
"Yes (E3 + Defender Suite add-on): this user holds M365 E3 + Microsoft Defender Suite add-on \u2014 functionally equivalent XDR experience to E5, layered on the E3 base.",
"Yes (SMB path \u2014 Business Premium / Defender for Business): this user holds M365 Business Premium (bundles Defender for Business). Defender XDR is entitled; correlation covers Defender for Business endpoint signals plus any Defender for Office 365 P1 / P2 they hold. Attack disruption requires explicitly uplifting to Defender for Endpoint P2 (Business Premium ships DfB, not full DfE P2).",
"Yes (partial \u2014 single-component standalone uplift): this user holds M365 E3 + Defender for Endpoint Plan 2 standalone add-on (no Defender Suite). XDR is entitled, but their correlation is limited to endpoint signals \u2014 their mailbox and identity signals stay at P1 / Entra-Free tier and are NOT pulled into XDR incidents.",
"Mixed-license tenant: 200 users on M365 E5, 800 users on M365 E3 (no add-on). Defender XDR is enabled tenant-wide because qualifying licenses exist. The 200 E5 users contribute full cross-workload signals; the 800 E3 users contribute only DfE P1 device telemetry (visible in Device Inventory but not in XDR incident correlation, AIR, or advanced hunting joins on those identities). A SOC analyst can only USE the XDR portal if THEY personally hold a qualifying license (typically E5).",
"No (only Plan 1 components): this user holds M365 E3 with no Defender add-on. They have DfO P1 (anti-malware / Safe Links / Safe Attachments) and DfE P1 (next-gen AV) only. Neither P1 SKU qualifies for XDR \u2014 they can see basic component telemetry in security.microsoft.com but get no incident correlation, no advanced hunting, no AIR, no attack disruption.",
"No (no Defender entitlement at all): this user holds Exchange Online Plan 1 standalone, or M365 Apps for Business, or an F1 frontline assignment with no Defender for Endpoint allocation. They have zero qualifying components \u2014 Defender XDR has nothing to correlate, surface, or hunt for them."
],
docs: [
["Microsoft Defender XDR prerequisites \u2014 official licensing list", "https://learn.microsoft.com/defender-xdr/prerequisites#licensing-requirements"],
["What is Microsoft Defender XDR (correlates only licensed and provisioned signals)", "https://learn.microsoft.com/defender-xdr/microsoft-365-defender"],
["Defender for Office 365 Plan 1 vs Plan 2 cheat sheet (only P2 qualifies for XDR)", "https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet"],
["Defender for Endpoint Plan 1 vs Plan 2 (only P2 qualifies for XDR + Attack Disruption)", "https://learn.microsoft.com/defender-endpoint/defender-endpoint-plan-1-2"],
["Configure automatic attack disruption (requires DfE P2)", "https://learn.microsoft.com/defender-xdr/configure-attack-disruption"],
["Microsoft Product Terms \u2014 Microsoft 365 Online Services", "https://www.microsoft.com/licensing/terms/productoffering/MicrosoftOffice365/EAEAS"]
]
}
];
const PURVIEW_E5_BREADTH_MINI_CARDS = [
{
name: "Insider Risk Management (IRM)",
sku: "M365 E5 / E5 Compliance / IRM standalone",
scope: "per-user",
scopeNote:
"Per-user feature. Microsoft Purview IRM policies score user signals (data theft by departing users, security policy violations, healthcare PHI, data leaks by priority users, risky AI usage). Microsoft Product Terms require a per-user E5 / E5 Compliance / IRM-standalone licence for every user whose activity an IRM policy is allowed to score. Adaptive Protection adds no independent licence requirement beyond IRM.",
inScopeMeans:
"this user (or their device) is included in the In-Scope users list of at least one IRM policy, or in a Priority Users group used by an IRM policy.",
notInScopeMeans:
"this user is not in the In-Scope list of any IRM policy AND not in any Priority Users group \u2014 their activity isn't scored.",
examples: [
"Yes (licensed correctly): this user holds M365 E5 and is in the 'Priority Users \u2014 IT staff' IRM group.",
"Yes (under-licensed \u2014 needs uplift): this user holds M365 E3 only but the tenant silently put them in an IRM Priority Users group. Uplift to E5 / E5 Compliance / IRM standalone, or remove them from scope.",
"No: this user holds M365 E3 and the tenant excludes them from every IRM policy \u2014 no E5 trigger fires."
],
docs: [
["IRM service description", "https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-tenantlevel-services-licensing-guidance#microsoft-purview-insider-risk-management"],
["IRM licensing prerequisites", "https://learn.microsoft.com/purview/insider-risk-management-configure-settings#prerequisites"]
]
},
{
name: "Communication Compliance",
sku: "M365 E5 / E5 Compliance / Communication Compliance standalone",
scope: "per-user",
scopeNote:
"Per-user feature. Microsoft Purview Communication Compliance policies scan Exchange / Teams / Yammer / Viva Engage messages (plus optional connectors like Slack, Bloomberg, WhatsApp) for the users you scope in, looking for harassment, threats, regulatory violations, IP leaks. Microsoft Product Terms require a per-user E5 / E5 Compliance / CC-standalone licence for every user whose communications a CC policy scans.",
inScopeMeans:
"this user is in the user-scope of at least one Communication Compliance policy \u2014 their Exchange / Teams / Viva Engage messages are scanned.",
notInScopeMeans:
"this user is excluded from every Communication Compliance policy \u2014 none of their messages are scanned.",
examples: [
"Yes (licensed correctly): this user holds M365 E5; their Teams DMs are scanned by the 'Workplace conduct' CC policy.",
"Yes (under-licensed \u2014 needs uplift): this user holds M365 E3 only and is silently in scope of a FINRA / SEC CC policy. Uplift to E5 / E5 Compliance / CC standalone, or remove them from scope.",
"No: this user holds M365 E3 and is excluded from every CC policy."
],
docs: [
["Communication Compliance service description", "https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-tenantlevel-services-licensing-guidance#microsoft-purview-communication-compliance"],
["Communication Compliance licensing", "https://learn.microsoft.com/purview/communication-compliance-solution-overview#subscriptions-and-licensing"]
]
},
{
name: "eDiscovery (Premium)",
sku: "M365 E5 / E5 Compliance / E5 eDiscovery & Audit / eDiscovery Premium standalone",
scope: "per-user",
scopeNote:
"Per-user (custodian + reviewer) feature. Microsoft Purview eDiscovery (Premium) provides advanced case workflow \u2014 custodian holds, advanced collection, review-set analytics, near-duplicate / threading, predictive coding (ML relevance), export to Relativity. Microsoft Product Terms require a per-user Premium licence for every named custodian and every reviewer who opens Review Sets. eDiscovery (Standard) \u2014 basic search + holds without the custodian workflow \u2014 is bundled in E3.",
inScopeMeans:
"this user is either (a) named as a custodian on at least one Premium eDiscovery case, OR (b) a reviewer who opens / works inside Review Sets.",
notInScopeMeans:
"this user is neither a Premium eDiscovery custodian nor a Review-Set reviewer. They can still be searched via Standard eDiscovery, which is included in E3.",
examples: [
"Yes (licensed correctly): this user holds M365 E5; they are a Premium eDiscovery reviewer working inside Review Sets on a litigation matter.",
"Yes (under-licensed \u2014 needs uplift): this user holds M365 E3 only and is added as a custodian on a Premium case. Uplift to E5 / E5 Compliance / E5 eDiscovery & Audit / Premium standalone \u2014 or downgrade the case to eDiscovery (Standard).",
"No (current licence already covers it): this user holds M365 E3 and is only ever searched via eDiscovery (Standard) \u2014 included in E3, no Premium custodian status."
],
docs: [
["eDiscovery (Premium) service description", "https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-tenantlevel-services-licensing-guidance#microsoft-purview-ediscovery-premium"],
["eDiscovery (Premium) subscriptions and licensing", "https://learn.microsoft.com/purview/ediscovery-premium-get-started#subscriptions-and-licensing"]
]
},
{
name: "Audit (Premium)",
sku: "M365 E5 / E5 Compliance / E5 eDiscovery & Audit / Audit Premium standalone",
scope: "per-user",
scopeNote:
"Per-user feature, tenant-enabled. Audit (Premium) is enabled tenant-wide by default once an eligible SKU is present, but the service description states explicitly: \u201C1-year retention of audit logs and the auditing of crucial events only apply to users with the appropriate license\u201D and \u201C10-year retention of audit logs only applies to users with the appropriate add-on license.\u201D Crucial events (MailItemsAccessed, SearchQueryInitiated, Send, MessageBind) and 1-year (or optional 10-year) retention require a per-user Premium licence on the audited user. Tenant-vs-user note: an unlicensed user (no mailbox SKU at all) generates only limited Entra-level audit signals regardless of what the tenant holds, because the high-value events are workload-bound (Exchange / SharePoint) and need a mailbox / OneDrive licence to even exist.",
inScopeMeans:
"this user's role or regulatory context requires (a) MailItemsAccessed / SearchQueryInitiated / Send / MessageBind crucial events, OR (b) >180-day audit-log retention (1-year default with Audit Premium, 10-year with the audit-log retention add-on).",
notInScopeMeans:
"Audit (Standard) at 180-day retention covers this user's investigation / compliance needs (Standard event set + 180 days are bundled into M365 E3).",
examples: [
"Yes (licensed correctly): this user holds M365 E5 + a privileged role \u2014 their session / mailbox / search events need MailItemsAccessed-grade forensics on demand.",
"Yes (under-licensed \u2014 needs uplift): this user holds M365 E3 only and an investigation requires MailItemsAccessed beyond what Standard provides. Uplift to E5 / E5 Compliance / E5 eDiscovery & Audit / Audit Premium standalone, or accept the Standard-tier signals.",
"No (current licence already covers it): this user holds M365 E3; Audit (Standard) at 180-day retention covers their needs with no crucial-event requirement.",
"No (tenant-vs-user note \u2014 unlicensed user): this user is an Entra-only break-glass account with no mailbox SKU. Even with Audit Premium enabled tenant-wide, there's no Exchange / SharePoint footprint to record MailItemsAccessed / SearchQueryInitiated for them \u2014 assign a mailbox first if mailbox-level forensics are required."
],
docs: [
["Audit (Premium) service description", "https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-tenantlevel-services-licensing-guidance#microsoft-purview-audit-premium"],
["Auditing solutions overview", "https://learn.microsoft.com/purview/audit-solutions-overview"],
["Manage audit log retention policies", "https://learn.microsoft.com/purview/audit-log-retention-policies"]
]
}
];
// INTUNE_SUITE_MINI_CARDS — used by `q_intune_suite` (admin's own Intune Suite
// trigger check) and `q_intune_breadth` (the "do you need 2+ Suite features?"
// bundle-vs-standalone follow-up). Six cards: Remote Help (the unique
// helper-AND-sharer rule), Endpoint Privilege Management, Microsoft Tunnel
// for MAM, Microsoft Cloud PKI, Enterprise App Management, Advanced Endpoint
// Analytics. Every Intune Suite add-on requires Microsoft Intune Plan 1 or
// Plan 2 as a prerequisite base license — the Suite is layered on top, not
// a replacement. Tunnel for MAM has no standalone SKU (Suite-only); the
// other five are also sold as per-user standalone add-ons.
const INTUNE_SUITE_MINI_CARDS = [
{
name: "Remote Help (helper + sharer license rule)",
sku: "Microsoft Intune Suite / Remote Help standalone add-on (per-user). Requires Microsoft Intune Plan 1 or Plan 2 base.",
scope: "per-user",
scopeNote:
"Per-user, with a UNIQUE dual-licensing rule that does not exist elsewhere in the Intune Suite. Microsoft's Remote Help planning documentation states verbatim under Prerequisites: 'A Remote Help license for everyone targeted to use the service \u2014 both helpers (IT support workers) and sharers (users).' This means a Remote Help / Intune Suite license must be assigned to BOTH (a) the admin / helpdesk operator's own user account when they run support sessions AND (b) every end-user account whose device receives a session. Intune RBAC role assignment (Help Desk Operator built-in role, or a custom role with the Remote Help permissions) controls WHAT the helper can do (view only, full control, elevation, unattended on Android) \u2014 but RBAC is not a substitute for the per-user license. Both must be in the same Entra tenant; cross-tenant Remote Help is not supported.",
inScopeMeans:
"this user is either (a) a helpdesk / IT support worker who will RUN Remote Help sessions from the Intune admin center (helper role), OR (b) an end user whose device may RECEIVE a Remote Help session (sharer role).",
notInScopeMeans:
"this user is neither a helper nor a sharer \u2014 they neither run Remote Help sessions nor have a device that receives them.",
examples: [
"Yes (helper \u2014 admin's own account): Helpdesk admin holds Help Desk Operator role and uses Remote Help from intune.microsoft.com to take full control of a struggling user's laptop. License the admin's own account with Remote Help / Intune Suite, even though they themselves aren't the end user of the protected workload.",
"Yes (sharer \u2014 end user): Field engineer's enrolled Windows laptop receives a Remote Help session from IT. License the engineer's account.",
"Yes (under-licensed \u2014 needs uplift): Tenant has Intune Plan 1 only; admin tries to launch Remote Help and the session fails with a licensing error. Buy Remote Help standalone or Intune Suite for the admin (and every sharer).",
"No: SOC analyst who never runs Remote Help, and whose device is supported by a separate helpdesk where the analyst themselves is just a sharer-eligible end user (no helper role assignment). They still need the license as a sharer if anyone might run a session against their device."
],
docs: [
["Remote Help \u2014 plan (Prerequisites: license required for both helpers and sharers)", "https://learn.microsoft.com/intune/remote-help/plan#prerequisites"],
["Remote Help overview", "https://learn.microsoft.com/intune/remote-help/remote-help"],
["Intune RBAC for Remote Help (Help Desk Operator built-in role)", "https://learn.microsoft.com/intune/remote-help/plan#role-based-access-control-rbac"]
]
},
{
name: "Endpoint Privilege Management (EPM)",
sku: "Microsoft Intune Suite / EPM standalone add-on (per-user). Requires Microsoft Intune Plan 1 or Plan 2 base.",
scope: "per-user",
scopeNote:
"Per-user. EPM lets standard users elevate approved applications without holding local administrator rights on the device. License the USER whose elevation requests will be evaluated by an EPM elevation rule \u2014 the agent on their device is what consumes the entitlement, but the license is attached to the user identity. An Intune admin who AUTHORS elevation rules but is not themselves a standard user whose elevations are governed does NOT need an EPM license. EPM standalone exists for tenants that want just this feature without the rest of the Suite.",
inScopeMeans:
"this user signs in as a standard (non-admin) user on a Windows device that has the EPM agent and is targeted by an EPM elevation rule (e.g., approved apps allowed to elevate without UAC admin prompt).",
notInScopeMeans:
"this user either (a) doesn't use a Windows device with EPM enabled, OR (b) only OPERATES the EPM policy authoring UI in the Intune admin center under an Intune Administrator role without their own device being in scope of any elevation rule.",
examples: [
"Yes (end user): Standard-user developer needs to install npm packages that require admin elevation; their device is in an EPM elevation policy for approved tools. License their account.",
"Yes (admin's own device): Intune admin's own laptop is a standard-user device covered by an EPM elevation rule for diagnostic tools. License the admin's account.",
"No (admin operates the policy authoring UI only): Intune admin authors EPM elevation rules for 5,000 standard users but signs in to their own admin workstation as a local admin (no EPM elevation rule applies). No EPM license needed for the admin themselves \u2014 the 5,000 users still each need one."
],
docs: [
["Endpoint Privilege Management overview", "https://learn.microsoft.com/intune/epm/overview"],
["EPM licensing requirements", "https://learn.microsoft.com/intune/epm/epm-overview#licensing-requirements"]
]
},
{
name: "Microsoft Tunnel for MAM",
sku: "Microsoft Intune Suite ONLY (per-user) \u2014 no standalone SKU. Requires Microsoft Intune Plan 1 or Plan 2 base.",
scope: "per-user",
scopeNote:
"Per-user. Microsoft Tunnel for MAM extends the Microsoft Tunnel VPN gateway to UNMANAGED iOS and Android devices that are not enrolled in Intune MDM but are protected by Mobile Application Management (MAM) policies (e.g., personal / BYOD devices running Outlook + Edge with App Protection Policies). License the USER whose unmanaged device runs the Tunnel for MAM client to reach corporate resources. The base Microsoft Tunnel for ENROLLED devices is part of Intune Plan 1 / Plan 2 itself \u2014 only the MAM extension requires Suite. Tunnel for MAM is uniquely Suite-only; there is no Tunnel-MAM standalone add-on.",
inScopeMeans:
"this user uses an UNMANAGED (Entra-registered only, not enrolled) iOS or Android device running an MAM-protected app (Outlook, Edge, Teams, Word, Excel, etc.) that needs to reach internal corporate resources through Microsoft Tunnel.",
notInScopeMeans:
"this user either (a) doesn't use Tunnel at all, OR (b) only uses Tunnel from FULLY ENROLLED iOS / Android / Windows / macOS devices (managed Tunnel, included in Intune Plan 1 / Plan 2, no Suite uplift needed).",
examples: [
"Yes: Consultant uses Outlook on their personal iPhone (MAM-protected, not enrolled) and needs to reach an internal SharePoint server through Microsoft Tunnel. License them for Intune Suite.",
"Yes (under-licensed \u2014 needs uplift): Tenant deploys Tunnel for MAM to 200 BYOD users without buying Intune Suite. Connections fail at the licensing-check stage. Uplift the 200 users to Intune Suite (no standalone available).",
"No (managed device path): Field engineer uses Tunnel from their fully-enrolled corporate iPhone \u2014 that's the base Microsoft Tunnel feature included in Intune Plan 1 / Plan 2, no Suite needed.",
"No: this user doesn't use Tunnel of any kind."
],
docs: [
["Microsoft Tunnel for MAM overview (Suite-only)", "https://learn.microsoft.com/intune/device-security/microsoft-tunnel/mam"],
["Microsoft Tunnel base (for enrolled devices, included in Intune Plan 1/2)", "https://learn.microsoft.com/intune/protect/microsoft-tunnel-overview"]
]
},
{
name: "Microsoft Cloud PKI",
sku: "Microsoft Intune Suite / Cloud PKI standalone add-on (per-user). Requires Microsoft Intune Plan 1 or Plan 2 base.",
scope: "per-user",
scopeNote:
"Per-user. Microsoft Cloud PKI is a managed certificate authority that issues, renews, and revokes user / device certificates for Intune-managed endpoints, replacing legacy on-prem AD CS + NDES + Intune Connector for SCEP / PKCS deployments. License the USER whose Intune-managed device receives a certificate from Cloud PKI \u2014 e.g., for Wi-Fi 802.1X, VPN, Entra ID certificate-based authentication, S/MIME mail signing, or app authentication. Cloud PKI standalone exists for tenants that only want managed PKI without the rest of the Suite.",
inScopeMeans:
"this user has an Intune-managed device that is targeted by a SCEP or PKCS certificate profile pointing to a Cloud PKI issuing CA (for Wi-Fi, VPN, CBA, S/MIME, or app auth).",
notInScopeMeans:
"this user either (a) has no device-issued certificates from Cloud PKI, OR (b) receives certificates from an on-prem ADCS + NDES + Intune Connector deployment instead, OR (c) only ADMINISTERS Cloud PKI CA configurations in the Intune admin center under an Intune Administrator role without holding any Cloud-PKI-issued certificate themselves.",
examples: [
"Yes: Marketing user's enrolled Windows laptop receives an 802.1X authentication certificate from a Cloud PKI issuing CA so it can connect to corporate Wi-Fi. License them for Cloud PKI standalone or Intune Suite.",
"Yes (admin's own device): Intune admin's enrolled MacBook is configured with a Cloud-PKI-issued certificate for Entra CBA sign-in. License the admin's account.",
"No (admin operates Cloud PKI config only): Intune admin onboards a Cloud PKI issuing CA and authors certificate profiles for 10,000 users, but their own admin workstation uses a legacy ADCS-issued certificate. No Cloud PKI license needed on the admin's account \u2014 the 10,000 user-devices still each need one.",
"No (legacy on-prem path): User's device gets certificates from a SCEP / PKCS profile pointing at ADCS + NDES + Intune Connector. No Cloud PKI license required."
],
docs: [
["Microsoft Cloud PKI overview", "https://learn.microsoft.com/intune/cloud-pki/overview"],
["Cloud PKI prerequisites and licensing", "https://learn.microsoft.com/intune/cloud-pki/quickstart-create-pki"]
]
},
{
name: "Enterprise App Management (EAM)",
sku: "Microsoft Intune Suite / EAM standalone add-on (per-user). Requires Microsoft Intune Plan 1 or Plan 2 base.",
scope: "per-user",
scopeNote:
"Per-user. Enterprise App Management provides a Microsoft-hosted Enterprise App Catalog of pre-packaged Win32 applications (and select macOS apps) with built-in install commands, detection rules, and \u2014 critically \u2014 auto-update detection / update push from the Intune admin center. It replaces the manual Win32 app packaging + repackaging cycle for the catalog's covered apps. License the USER whose Intune-managed device receives apps from the Enterprise App Catalog with EAM update tracking enabled. An Intune admin who ADMINISTERS the catalog (selects apps, configures deployments) but whose own device doesn't receive EAM-managed apps does not need an EAM license.",
inScopeMeans:
"this user has an Intune-managed Windows / macOS device that is deployed any application from the Enterprise App Catalog with EAM auto-update detection enabled (so Intune tracks newer versions in the catalog and pushes updates).",
notInScopeMeans:
"this user either (a) only receives manually-packaged Win32 / DMG apps (legacy path, no EAM), OR (b) only ADMINISTERS the Enterprise App Catalog in the Intune admin center under an Intune Administrator role without their own device being deployed any EAM-managed app.",
examples: [
"Yes (end user): Engineer's enrolled Windows laptop receives Zoom, 7-Zip, and Notepad++ from the Enterprise App Catalog with auto-update tracking enabled. License them for EAM standalone or Intune Suite.",
"Yes (admin's own device): Intune admin's enrolled laptop is targeted by an EAM-managed deployment of Slack. License the admin's account.",
"No (admin curates the catalog only): Intune admin builds the catalog of 50 EAM apps and assigns them to 8,000 users, but their own admin workstation uses legacy MSI / Win32 packages with no EAM auto-update tracking. No EAM license needed on the admin's account \u2014 the 8,000 users still each need one.",
"No (legacy Win32 path): User's device gets apps via classic Win32 .intunewin packages or LOB apps with no catalog auto-update tracking. No EAM license required."
],
docs: [
["Enterprise App Management overview", "https://learn.microsoft.com/intune/app-management/deployment/enterprise-app-management"],
["EAM licensing requirements", "https://learn.microsoft.com/intune/app-management/deployment/enterprise-app-management#licensing-requirements"]
]
},
{
name: "Advanced Endpoint Analytics",
sku: "Microsoft Intune Suite / Advanced Analytics standalone add-on (per-user). Requires Microsoft Intune Plan 1 or Plan 2 base.",
scope: "per-user",
scopeNote:
"Per-user. Advanced Endpoint Analytics (now branded as 'Advanced Analytics' in the Intune admin center) extends the base Endpoint Analytics product (included in Intune Plan 1) with anomaly detection on device health metrics, a per-device timeline view showing changes / events over time, proactive remediation script scheduling (run a custom remediation when a detection script flags a problem), advanced battery health insights, and richer Windows reliability reports. License the USER whose Intune-managed device is enrolled in Advanced Analytics scoring / scripting. Plain Endpoint Analytics (boot performance, anti-malware overhead aggregates) is base Intune and free. Advanced Analytics standalone exists for tenants that only want this feature.",
inScopeMeans:
"this user has an Intune-managed Windows device that is in scope of an Advanced Analytics proactive remediation script, has its anomaly-detection data scored, or whose device timeline is viewed by an admin in the Advanced Analytics workspace.",
notInScopeMeans:
"this user either (a) only contributes data to base Endpoint Analytics (free, included), OR (b) only ADMINISTERS Advanced Analytics scripts and views aggregate data without their own device being scored / remediated.",
examples: [
"Yes (end user): Developer's enrolled Windows laptop is targeted by a proactive remediation script (detect outdated WSL, remediate with reinstall). License them for Advanced Analytics standalone or Intune Suite.",
"Yes (admin's own device): Intune admin's enrolled laptop is in the Advanced Analytics anomaly-detection cohort \u2014 their device timeline is monitored. License the admin's account.",
"No (admin views aggregate base Endpoint Analytics only): Intune admin checks Endpoint Analytics scores for the fleet but their own device is excluded from Advanced Analytics scoring / scripting. No Advanced Analytics license needed on the admin's account.",
"No: this user's device only contributes to base Endpoint Analytics (boot performance / anti-malware overhead aggregates), no anomaly detection or proactive remediation."
],
docs: [
["Advanced Endpoint Analytics overview", "https://learn.microsoft.com/intune/advanced-analytics/overview"],
["Intune advanced capabilities (Plan 2 / Suite / standalone matrix)", "https://learn.microsoft.com/intune/fundamentals/advanced-capabilities"]
]
}
];
export const TREE = {
gov_cloud: {
choice: true,
step: { major: 1, label: "Government cloud", secondary: true },
question: "Which US sovereign cloud is the tenant in?",
help: "Microsoft 365 Government tenants run in separately accredited environments. Feature availability, compliance accreditations, and licensing parity differ for each — this selection drives a sovereign-cloud caveat shown on every result.",
helpLink: { label: "Background — sovereign cloud feature parity & compliance", target: "info_sovereign_cloud" },
choices: [
{
label: "GCC (Government Community Cloud)",
sublabel: "FedRAMP High / DoD IL2. Multi-tenant on commercial Azure with US-only data residency. Most M365 commercial features land in GCC with a multi-week to multi-month delay.",
icon: "1",
tone: "primary",
value: "gcc",
target: "start_choice"
},
{
label: "GCC High",
sublabel: "FedRAMP High / DoD IL4 / DFARS 7012 / ITAR / EAR. Isolated cloud, preferred for the Defense Industrial Base and CMMC Level 2 / 3 contractors handling CUI. Feature parity lags commercial.",
icon: "2",
tone: "primary",
value: "gcc_high",
target: "start_choice"
},
{
label: "DoD",
sublabel: "DoD IL5. US Department of Defense only — isolated cloud, most restrictive feature parity of the unclassified clouds.",
icon: "3",
tone: "primary",
value: "dod",
target: "start_choice"
},
{
label: "Microsoft 365 Air-Gapped (Top Secret / DoD IL6)",
sublabel: "Classified workloads on physically separated infrastructure. Commercial-feature parity is intentionally limited — verify every premium SKU on the Air-Gapped product page before purchase.",
icon: "4",
tone: "primary",
value: "il6",
target: "start_choice"
}
]
},
info_sovereign_cloud: {
info: true,
badge: "Background",
badgeClass: "badge-info",
title: "US Government clouds — feature parity & compliance",
sub: "Microsoft's government clouds are separately accredited environments with different feature roadmaps.",
paragraphs: [
"GCC (Government Community Cloud) is a multi-tenant environment that runs on commercial Microsoft 365 infrastructure with FedRAMP High accreditation, DoD IL2 reauthorization, and US-only data residency. Most M365 commercial features are available, usually with a feature-parity delay measured in weeks to months.",
"GCC High is a physically and logically isolated cloud accredited at FedRAMP High and DoD IL4. It supports DFARS 7012, ITAR, and EAR controls — making it the preferred environment for the Defense Industrial Base (DIB) and CMMC Level 2 / Level 3 contractors who handle Controlled Unclassified Information (CUI). Feature parity lags commercial by 6–18 months for many capabilities; Microsoft 365 Copilot, parts of the Entra Suite (Global Secure Access, Verified ID), and the newest Defender XDR features ship later — or not at all.",
"DoD is the most restricted unclassified cloud — DoD IL5, US Department of Defense only. Feature roadmap typically trails GCC High by another quarter or two.",
"Microsoft 365 Air-Gapped (Top Secret / DoD IL6) serves classified workloads on physically separated infrastructure. Commercial-feature parity is intentionally limited — verify every premium SKU against the Air-Gapped product page before purchasing.",
"Compliance context: CMMC Level 2 / Level 3 contractors handling CUI typically need GCC High or DoD, not GCC. Commercial M365 tenants generally cannot meet DFARS 7012 export-control requirements regardless of which premium SKUs are added."
],
docs: [
["GCC High and DoD service description", "https://learn.microsoft.com/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc-high-and-dod"],
["Microsoft 365 Government — GCC service description", "https://learn.microsoft.com/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc"],
["US Government CMMC compliance", "https://learn.microsoft.com/compliance/us-government/gov-cmmc"],
["Compliance between Commercial, Government, DoD & Secret offerings (Microsoft TechCommunity)", "https://techcommunity.microsoft.com/blog/publicsectorblog/understanding-compliance-between-commercial-government-dod--secret-offerings---m/4225436"]
],
actions: [
{ label: "Continue → pick your government cloud", target: "gov_cloud", tone: "primary" },
{ label: "← Back to who it's for", target: "start_choice", tone: "secondary" }
]
},
start_choice: {
choice: true,
step: { major: 1, label: "Who it's for" },
question: "Who are you buying this license for?",
help: "Pick the option that best describes the person. We'll use Microsoft Learn and m365maps.com to recommend the right license.",
helpLink: { label: "Not sure what counts as an admin account? Read this first", target: "info_privileged_admins" },
choices: [
{
label: "Privileged (dedicated) admin account",
sublabel: "Industry standard for separation of duties. Used only for privileged work — no mailbox, no Teams, no Office consumption. Runs the full admin licensing tree.",
icon: "1",
tone: "primary",
target: "start"
},
{
label: "Primary daily-use account that also holds admin roles",
sublabel: "Same identity does email/Teams/Office AND privileged work. Microsoft does not recommend this.",
icon: "2",
tone: "warning",
target: "result_primary_account"
},
{
label: "Information / knowledge worker (end user)",
sublabel: "Office, Teams, Outlook, OneDrive, SharePoint user on a desktop or laptop. Two short questions → exact E3 / E3+Copilot / E5 / E7 recommendation.",
icon: "3",
tone: "primary",
target: "q_iw_platform"
},
{
label: "Frontline worker (F1 / F3)",
sublabel: "Shift / deskless / field worker — retail, manufacturing, healthcare, hospitality. Step-by-step wizard walks Microsoft's eligibility criteria, then asks one question per E-vs-F feature gap, tracks add-on costs, and recommends F1 / F3 / F3 + add-ons / E3 / E5 by best total value.",
icon: "4",
tone: "primary",
target: "q_frontline_eligibility"
},
{
label: "Education (faculty / student)",
sublabel: "Qualifying academic institution. Two short questions → exact A1 / A3 / A5 recommendation.",
icon: "5",
tone: "primary",
target: "q_edu_security"
},
{
label: "Government (GCC / GCC High / DoD / Air-Gapped)",
sublabel: "US public-sector sovereign clouds. Pick a cloud + tier → exact G1 / G3 / G5 / Air-Gapped recommendation with cloud-specific caveats.",
icon: "6",
tone: "primary",
target: "q_gov_profile_cloud"
},
{
label: "Nonprofit (validated eligibility)",
sublabel: "Charitable / nonprofit org enrolled in Microsoft Nonprofits. Two short questions → exact Business Premium grant / E3 NSP / E5 NSP recommendation.",
icon: "7",
tone: "primary",
target: "q_npo_seats"
},
{
label: "Small / mid-size business (≤ 300 seats)",
sublabel: "Commercial business with no more than 300 seats. Two short questions → exact Business Basic / Standard / Premium recommendation.",
icon: "8",
tone: "primary",
target: "q_smb_collab"
},
{
label: "External ID / B2B guest / CIAM",
sublabel: "Partner / vendor / contractor / customer identity. Pick the scenario → exact MAU free / P1 / P2 / Verified ID / CIAM recommendation.",
icon: "9",
tone: "primary",
target: "q_extid_features"
},
{
label: "Don't see your scenario? Suggest one",
sublabel: "Opens a new GitHub issue — tell us the role / persona / SKU pattern we're missing and we'll add it to the tree.",
icon: "+",
tone: "ghost",
href: "https://github.com/billmcilhargey/m365-profiles/issues/new?labels=missing-profile&title=Missing%20profile%3A%20%5Bdescribe%20role%20%2F%20persona%5D&body=Profile%20%2F%20persona%3A%0A%0AWhy%20the%20current%20decision%20tree%20didn%27t%20fit%3A%0A%0ASuggested%20SKU%28s%29%20%28optional%29%3A%0A%0AReference%20%28Microsoft%20Learn%20%2F%20m365maps%20URL%29%3A"
}
]
},
info_privileged_admins: {
info: true,
badge: "Background",
badgeClass: "badge-info",
title: "Why privileged (dedicated) admin accounts?",
sub: "Microsoft's privileged access strategy is built on separation of duties.",
paragraphs: [
"A privileged admin account is a separate cloud-only identity (typically admin-firstname@tenant.onmicrosoft.com) that is used only for privileged work — Global Admin, Privileged Role Admin, Identity / Security / Compliance / Intune / Teams / Exchange Admin, etc.",
"The user's primary account holds their mailbox, Teams chats, OneDrive, and Office apps. The privileged account holds the role assignments. Two identities = two blast radii. If the primary mailbox is phished, the attacker doesn't automatically get Global Admin.",
"Because the privileged account has no mailbox or Teams to consume, it doesn't need a Microsoft 365 service license. Most privileged admin accounts can run on Entra ID Free indefinitely — they only need a premium tier when they cross into PIM, Identity Protection, Defender XDR, Purview E5, Intune Suite, Teams Premium, Entra Suite, Copilot, or Agent 365.",
"Portal access vs. license assignment — IMPORTANT: most Microsoft admin portals (Entra admin center, Intune admin center, Microsoft 365 admin center, Microsoft Defender portal, Microsoft Purview portal, Microsoft Sentinel, Security Copilot) enforce ROLE-GROUP permissions, not per-user license checks on the admin. A SOC analyst can triage Defender XDR incidents, an Insider Risk admin can manage IRM alerts and policies, an Intune admin can configure EPM / Cloud PKI / EAM policies — all without a per-user license assigned to the admin's account. The per-user license applies to the USERS / DEVICES being protected or monitored, not the admin operating the portal. The questions below test whether the admin's own account crosses into a scoped population.",
"Notable exceptions where the admin's OWN account IS the licensed party (not just configuring for others): (1) Intune Remote Help — helper AND sharer both need the license per Microsoft planning docs; (2) Teams Premium admin-only features (Advanced collaboration analytics, aggregated Teams Premium usage views) — the Teams admin's own account must have Teams Premium assigned; (3) Microsoft Entra ID Governance — the Governance FAQ explicitly counts the admin who CONFIGURES Lifecycle Workflows / Entitlement Management as needing a license ('1 license for the Lifecycle Workflows Administrator'); (4) PIM eligible / approver / reviewer scenarios — each requires Entra ID P2 on the admin; (5) Identity Protection when the admin's own sign-ins are evaluated by risk policies; (6) M365 Copilot when the admin themselves invokes Copilot in apps or Copilot Chat work mode; (7) Global Secure Access — if the admin's own laptop runs the GSA client.",
"Notable cases that DO NOT require a per-user license on the admin even though premium portals are involved: Microsoft Sentinel (GB-based Azure consumption, role-gated), Microsoft Security Copilot (SCU tenant capacity + Security Copilot role, no per-user SKU), Microsoft Entra Verified ID issuance (the FAQ states 'no special licensing requirements'), Defender XDR / Purview portal operation by SOC / IRM admins (role-gated; license applies to the users / devices being protected), and pure GSA policy configuration without the admin's device being a GSA client.",
"Microsoft recommends at least two break-glass / emergency-access Global Administrator accounts on top of your day-to-day privileged admin accounts, stored offline with FIDO2 keys."
],
docs: [
["Microsoft Entra best practices for admin roles", "https://learn.microsoft.com/entra/identity/role-based-access-control/best-practices"],
["Securing privileged access — overview", "https://learn.microsoft.com/security/privileged-access-workgroup/overview"],
["Privileged access accounts", "https://learn.microsoft.com/security/privileged-access-workgroup/privileged-access-accounts"],
["Emergency access accounts", "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access"],
["Remote Help — plan (helpers AND sharers both need a license)", "https://learn.microsoft.com/en-us/intune/remote-help/plan"],
["Teams Premium — organizer / attendee / admin license matrix", "https://learn.microsoft.com/microsoftteams/teams-add-on-licensing/licensing-enhance-teams#which-features-are-applied-to-organizers-attendeesusers-or-admins"],
["Entra ID Governance FAQ — admin who CONFIGURES needs a license", "https://learn.microsoft.com/entra/id-governance/licensing-fundamentals#do-licenses-need-to-be-assigned-to-users-to-use-identity-governance-features"],
["PIM licensing fundamentals — every category of P2-required user", "https://learn.microsoft.com/entra/id-governance/licensing-fundamentals#privileged-identity-management"],
["Identity Protection — required roles vs license scope", "https://learn.microsoft.com/entra/id-protection/overview-identity-protection#required-roles"],
["Verified ID FAQ — no special licensing requirements", "https://learn.microsoft.com/entra/verified-id/verifiable-credentials-faq#what-are-the-licensing-requirements"],
["Security Copilot FAQ — SCU pricing model (no per-user license)", "https://learn.microsoft.com/copilot/security/faq-security-copilot#how-is-security-copilot-priced"],
["Microsoft Sentinel billing — GB-based, role-gated", "https://learn.microsoft.com/azure/sentinel/billing"],
["Microsoft Purview service description — which users need a license", "https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description#which-users-need-a-license"],
["Microsoft Product Terms — Universal License Terms (admin-without-license rule & per-user assignment)", "https://www.microsoft.com/licensing/terms/product/UniversalLicenseTerms/all"]
],
actions: [
{ label: "Continue with a privileged admin →", target: "start", tone: "primary" },
{ label: "See the full admin capability map (free vs P1 vs P2 vs E5)", target: "info_admin_capability_map", tone: "secondary" },
{ label: "I have a primary account instead", target: "result_primary_account", tone: "secondary" },
{ label: "← Back to account-scope choice", target: "start_choice", tone: "secondary" }
]
},
info_admin_capability_map: {
info: true,
badge: "Capability map",
badgeClass: "badge-info",
title: "Privileged admin capability map — what's free, what's P1, what's P2, what's E5",
sub: "Cross-referenced against Microsoft Learn AND m365maps.com — built so you don't over-license a dedicated admin account.",
paragraphs: [
"This card answers the question we hear most often: 'My privileged admin account doesn't have a mailbox and doesn't use Office — but it DOES manage Conditional Access, MFA, Intune, Defender, and Purview. What license does it need?' The short answer is almost always 'nothing more than Entra ID Free' — as long as the admin only CONFIGURES things rather than being IN SCOPE of policies that target them. The long answer is below, organized by capability category.",
"Each capability is tagged with (a) the license the admin's OWN account needs to USE the feature, (b) the Microsoft Learn documentation that defines that requirement, and (c) the m365maps.com visual map that shows where the feature is bundled. Where a capability is role-gated and free to configure but per-user to consume, both rows are called out. The walk-through tree below uses these same definitions.",
"Three license tiers cover almost everything: Entra ID Free (included with every M365 tenant — no extra purchase), Entra ID P1 (bundled in M365 E3 / E5 / Business Premium / A3 / A5 / G3 / G5, sold standalone), and Entra ID P2 (bundled in M365 E5 / A5 / G5 / Entra Suite, sold standalone). M365 E5 layers Defender Suite + Purview E5 + Entra ID P2 on top of E3. The catch is that Microsoft Product Terms target the licence at the USER WHO BENEFITS — for an admin, 'benefits' means 'is in the policy's user scope', not 'opens the admin portal'."
],
breakdownIntro: "Each row is one capability. The 'Scope' badge tells you whether the admin's own account needs a license to USE the capability (per-user / per-mailbox / per-device) or whether the capability is tenant-wide / role-gated (admin operates it free, but every USER it protects is licensed separately). Click through to Microsoft Learn for the technical doc and to m365maps.com for the visual licensing map.",
productBreakdown: [
{
name: "Conditional Access — POLICY CONFIGURATION",
sku: "Entra ID Free (role-gated: Conditional Access Administrator)",
scope: "tenant-wide-scopeable",
scopeNote: "Configuring CA policies in the Entra admin center is role-gated, not license-gated. Any user with the Conditional Access Administrator (or Security Administrator) role can author policies on Entra ID Free.",
inScopeMeans: "the admin OPENS the Entra portal and creates / edits / disables Conditional Access policies. Role membership is the only requirement.",
notInScopeMeans: "the admin is in the user/group scope of a CA policy themselves — that's the P1 row below, not this one.",
examples: [
"Free: Admin under the Conditional Access Administrator role authors policies for 50,000 users. No license required on the admin.",
"Not free: Admin's account is in the user scope of a CA policy that requires phishing-resistant MFA for admins — that's the P1 row."
],
docs: [
["Conditional Access Administrator role", "https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference#conditional-access-administrator"],
["Conditional Access overview", "https://learn.microsoft.com/entra/identity/conditional-access/overview"]
]
},
{
name: "Conditional Access — USER IN POLICY SCOPE",
sku: "Entra ID P1 (per-user, bundled in M365 E3 / E5 / Business Premium / EMS E3+)",
scope: "per-user",
scopeNote: "Every user TARGETED by a CA policy (included in user/group/role scope and not excluded) must have Entra ID P1 or higher assigned. Microsoft's CA licensing FAQ is explicit on this.",
inScopeMeans: "the admin's own account is in the included scope of at least one CA policy (and not excluded). This is the most-missed admin licensing trigger.",
notInScopeMeans: "the admin is a break-glass / emergency-access account explicitly excluded from every CA policy.",
examples: [
"Per-user: Tenant has CA policy 'Require MFA for all directory roles' that targets the Global Administrators role group. Admin holds GA → P1 required on the admin.",
"Not per-user: Admin's account is excluded from every CA policy (break-glass pattern). Stays on Entra ID Free."
],
docs: [
["CA licensing requirements (per-user-in-scope)", "https://learn.microsoft.com/entra/identity/conditional-access/overview#license-requirements"],
["Emergency access accounts — recommended CA exclusion", "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access"],
["M365 Maps — Entra ID P1", "https://m365maps.com/Microsoft%20Entra%20ID%20P1.htm"]
]
},
{
name: "Security Defaults",
sku: "Entra ID Free (tenant-wide on/off; mutually exclusive with Conditional Access)",
scope: "tenant-wide-not-scopeable",
scopeNote: "Security Defaults are tenant-wide and free. When enabled, they force Authenticator MFA enrollment for all users, block legacy auth, and require MFA for privileged actions — without any P1 license.",
inScopeMeans: "the tenant has Security Defaults enabled — every user (including the admin) gets baseline MFA enforcement at no licensing cost.",
examples: [
"Free: New tenant under 300 seats uses Security Defaults to enforce MFA and block legacy auth. No P1 / E3 / Business Premium needed for the admin's account."
],
docs: [
["Security Defaults — Entra ID Free", "https://learn.microsoft.com/entra/fundamentals/security-defaults"]
]
},
{
name: "Multi-Factor Authentication (Authenticator push / TOTP / FIDO2)",
sku: "Entra ID Free (per-user MFA, Security Defaults, or as part of any CA policy)",
scope: "tenant-wide-not-scopeable",
scopeNote: "Basic MFA via Microsoft Authenticator (push / TOTP) and FIDO2 security keys are free on Entra ID Free. The 'per-user MFA' enforcement model and Security Defaults both enable MFA at no additional cost. Advanced features (number matching, system-preferred MFA method, location-based granularity) are also free since 2023.",
inScopeMeans: "every user signs in with MFA — the admin can require Authenticator app or FIDO2 keys on their own account at no licensing cost.",
examples: [
"Free: Admin requires FIDO2 (YubiKey) for sign-in via Authentication Methods policy. No P1 required.",
"Free: Admin enables phishing-resistant MFA via Authentication Strengths and applies through a CA policy — Authentication Strength config is free; the CA policy is where P1 kicks in if the admin's own account is in scope."
],
docs: [
["MFA licensing — free with Entra ID Free", "https://learn.microsoft.com/entra/identity/authentication/concept-mfa-licensing"],
["Authentication methods policy", "https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage"]
]
},
{
name: "Self-Service Password Reset (SSPR) — cloud users only",
sku: "Entra ID Free (cloud-only password reset)",
scope: "tenant-wide-not-scopeable",
scopeNote: "Cloud-only SSPR (Entra-mastered accounts, no on-prem AD writeback) is free for all cloud users on Entra ID Free.",
inScopeMeans: "the admin's cloud-only account can reset its own password via aka.ms/sspr at no licensing cost.",
examples: [
"Free: Cloud-only admin account uses SSPR to reset their password. No P1 required.",
"Not free: Admin's account is synced from on-prem AD and SSPR writes back to AD — see SSPR writeback row below for P1 requirement."
],
docs: [
["SSPR licensing (cloud users free)", "https://learn.microsoft.com/entra/identity/authentication/concept-sspr-licensing"]
]
},
{
name: "Self-Service Password Reset (SSPR) — with on-prem writeback",
sku: "Entra ID P1 (per-user, bundled in M365 E3 / E5 / Business Premium / EMS E3+)",
scope: "per-user",
scopeNote: "When SSPR writes back to on-prem AD via Entra Connect / Cloud Sync password writeback, every user with writeback enabled needs Entra ID P1.",
inScopeMeans: "the admin's hybrid account uses SSPR and the new password syncs back to on-prem AD.",
examples: [
"Per-user: Hybrid admin account, password change via SSPR writes back to on-prem AD → P1 required."
],
docs: [
["SSPR password writeback (P1 required)", "https://learn.microsoft.com/entra/identity/authentication/howto-sspr-writeback"]
]
},
{
name: "Application Proxy — admin who configures the connector",
sku: "Entra ID Free (role-gated: Application Administrator)",
scope: "tenant-wide-scopeable",
scopeNote: "Installing and configuring App Proxy connectors and publishing on-prem apps is role-gated. The publisher does not need a license.",
inScopeMeans: "the admin under Application Administrator role installs connectors and publishes on-prem apps through Entra App Proxy.",
examples: [
"Free: Admin publishes the on-prem helpdesk app through App Proxy for remote users."
],
docs: [
["Application Proxy admin role", "https://learn.microsoft.com/entra/identity/app-proxy/application-proxy"]
]
},
{
name: "Application Proxy — connecting USER",
sku: "Entra ID P1 (per-user)",
scope: "per-user",
scopeNote: "Every user who CONNECTS through Entra App Proxy to an on-prem app needs Entra ID P1.",
inScopeMeans: "the admin's account connects through App Proxy to an on-prem app (e.g., SCCM console, legacy admin tool).",
examples: [
"Per-user: Admin connects via App Proxy to on-prem SCCM console → P1 required on the admin."
],
docs: [
["App Proxy licensing (connecting users)", "https://learn.microsoft.com/entra/identity/app-proxy/overview-what-is-app-proxy"]
]
},
{
name: "Privileged Identity Management (PIM)",
sku: "Entra ID P2 (per ELIGIBLE user, bundled in M365 E5 / A5 / G5 / Entra Suite)",
scope: "per-user",
scopeNote: "Per PIM licensing fundamentals: 'an Entra ID P2 license is required for any user who is an eligible / active / approver / reviewer / requestor in PIM.' This includes the admin themselves when their role assignments are eligible-not-active.",
inScopeMeans: "the admin's role assignments are configured as PIM-eligible (not permanent-active), OR the admin is an approver / reviewer for someone else's PIM elevation.",
examples: [
"Per-user: Admin's Global Administrator role is configured as PIM-eligible — they activate just-in-time. P2 required on the admin.",
"Per-user: Admin is an approver for someone else's GA elevation. P2 required.",
"Free: Admin's GA role is permanent-active (NOT recommended) and they don't approve anyone else's PIM. No P2 — but Microsoft's privileged access guidance strongly recommends PIM eligibility."
],
docs: [
["PIM licensing fundamentals", "https://learn.microsoft.com/entra/id-governance/licensing-fundamentals#privileged-identity-management"],
["M365 Maps — Entra ID P2", "https://m365maps.com/Microsoft%20Entra%20ID%20P2.htm"]
]
},
{
name: "Identity Protection — sign-in / user risk policies",
sku: "Entra ID P2 (per-user, bundled in M365 E5 / A5 / G5 / Entra Suite)",
scope: "per-user",
scopeNote: "Identity Protection risk policies (sign-in risk, user risk) and full remediation (require password change, require MFA on risky sign-in) license each user IN POLICY SCOPE. Viewing the risky users / risky sign-ins reports is role-gated and free.",
inScopeMeans: "the admin's own account is in the user/group scope of a sign-in risk or user risk policy with remediation actions.",
notInScopeMeans: "the admin only VIEWS the risky users / risky sign-ins reports under the Security Reader role and is not themselves in any risk policy's scope.",
examples: [
"Per-user: All-users risk policy includes the admin → P2 required on the admin.",
"Free (viewing only): Admin under Security Reader role views the Risky Sign-Ins report but is not in any risk policy's scope. No P2."
],
docs: [
["Identity Protection required roles vs license scope", "https://learn.microsoft.com/entra/id-protection/overview-identity-protection#required-roles"]
]
},
{
name: "Defender XDR portal (security.microsoft.com)",
sku: "Free for admin (role-gated). Per-user license required for protected USERS.",
scope: "tenant-wide-scopeable",
scopeNote: "Opening the Defender XDR portal, triaging incidents, and running advanced hunting queries is role-gated (Security Reader / Security Operator / Security Administrator). The admin's own account needs NO Defender / E5 license to operate the portal. The per-user Defender Suite or M365 E5 license is required on USERS / MAILBOXES / DEVICES that are being protected.",
inScopeMeans: "admin opens security.microsoft.com to triage incidents, run hunting queries, manage alerts. Role gives access; no license needed on the admin.",
notInScopeMeans: "admin's own mailbox is in scope of a Defender for Office 365 Safe Links policy — then they're in the protected population.",
examples: [
"Free: SOC analyst under Security Operator role triages 500 incidents/day in Defender XDR for 50,000 protected users. No license on the analyst's account.",
"Per-user: Admin's own mailbox is covered by Safe Attachments / Safe Links → Defender for Office 365 P1/P2 required on the admin's mailbox."
],
docs: [
["Defender XDR — role-based access", "https://learn.microsoft.com/defender-xdr/m365d-permissions"],
["M365 Maps — Defender XDR", "https://m365maps.com/Microsoft%20Defender%20XDR.htm"]
]
},
{
name: "Microsoft Sentinel",
sku: "Azure GB-based consumption (NOT per-user). Role-gated for admin operation.",
scope: "tenant-wide-not-scopeable",
scopeNote: "Sentinel is billed via Azure GB-ingested pricing, not per-user. Admin operates it under the Sentinel Contributor / Reader / Responder Azure roles. No per-user license on the admin or anyone else.",
inScopeMeans: "admin operates Sentinel workspaces, runs KQL queries, manages analytics rules, triages incidents.",
examples: [
"Free (per-user): Admin operates Sentinel across 5 workspaces. Azure consumption bill applies to the WORKSPACE, not per analyst or per protected user."
],
docs: [
["Sentinel billing — GB-based", "https://learn.microsoft.com/azure/sentinel/billing"]
]
},
{
name: "Microsoft Security Copilot",
sku: "SCU (Security Compute Unit) tenant capacity. NOT per-user. Role-gated.",
scope: "tenant-wide-not-scopeable",
scopeNote: "Security Copilot is billed at the tenant level via SCU capacity provisioning. Admin operates it under the Copilot Owner / Contributor role. No per-user license assignment.",
inScopeMeans: "admin uses Security Copilot standalone or embedded experiences (Defender XDR, Sentinel, Intune) to investigate incidents.",
examples: [
"Free (per-user): SOC analysts under Copilot Contributor role use Security Copilot to summarize Defender XDR incidents. SCU capacity bill applies; no per-analyst license.",
"Bundled: M365 E5 and E7 customers get Security Copilot SCU capacity included at no extra cost."
],
docs: [
["Security Copilot — SCU pricing", "https://learn.microsoft.com/copilot/security/faq-security-copilot#how-is-security-copilot-priced"]
]
},
{
name: "Microsoft Purview portal (purview.microsoft.com)",
sku: "Free for admin operation (role-gated). Per-user E5/E5 Compliance/Purview Suite required for PROTECTED USERS and admins IN MONITORED SCOPE.",
scope: "tenant-wide-scopeable",
scopeNote: "Opening the Purview portal and triaging IRM / DLP / eDiscovery / Communication Compliance alerts is role-gated (Insider Risk Management role group, eDiscovery Manager, Compliance Administrator, etc.). License applies to users IN MONITORED SCOPE — including the admin if they're added as a test user.",
inScopeMeans: "admin under Compliance Administrator / IRM role triages alerts and tunes policies. No license needed on the admin unless they're in a monitored user scope.",
notInScopeMeans: "admin is added as a TEST USER inside an IRM policy during pilot → they're in the monitored population, needs E5 Compliance / Purview Suite license.",
examples: [
"Free (admin only operates): IRM analyst triages 5,000 monitored users' alerts. Their own account is excluded from every IRM policy. No license on the analyst.",
"Per-user: Admin added as test user inside Data Theft IRM policy → license required on the admin's account."
],
docs: [
["Purview service description — who needs a license", "https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description#which-users-need-a-license"],
["M365 Maps — Purview E5", "https://m365maps.com/Microsoft%20Purview%20E5.htm"]
]
},
{
name: "Microsoft Intune admin center",
sku: "Free for admin operation (role-gated: Intune Administrator). Per-USER Intune Plan 1+ for managed users / devices.",
scope: "tenant-wide-scopeable",
scopeNote: "Opening the Intune admin center (intune.microsoft.com), authoring configuration profiles, compliance policies, app deployments, and Autopilot setups is role-gated under Intune Administrator. The admin's own account does NOT need an Intune license to operate the portal.",
inScopeMeans: "admin manages 10,000 devices via Intune policies and runs Autopilot enrollments. No license on the admin needed.",
notInScopeMeans: "admin's own device is enrolled in Intune as a managed device → admin needs an Intune license (Plan 1 / Plan 2 / Suite) on their own account.",
examples: [
"Free (admin operates only): Intune admin manages 10,000 user-devices but their own admin workstation is a pure cloud-only device not enrolled in Intune. No Intune license on the admin.",
"Per-user (admin's device managed): Admin's own laptop is enrolled in Intune with a compliance policy applied → Intune Plan 1+ required on the admin's account."
],
docs: [
["Intune RBAC roles", "https://learn.microsoft.com/intune/intune-service/fundamentals/role-based-access-control"],
["Microsoft Intune licensing", "https://learn.microsoft.com/intune/intune-service/fundamentals/licenses"],
["M365 Maps — Microsoft Intune Suite", "https://m365maps.com/Microsoft%20Intune%20Suite.htm"]
]
},
{
name: "Intune Remote Help (helpers AND sharers)",
sku: "Remote Help standalone or Intune Suite — required on BOTH the helper admin's account AND the end-user sharer's account.",
scope: "per-user",
scopeNote: "Microsoft's Remote Help planning doc states verbatim: 'A Remote Help license for everyone targeted to use the service — both helpers (IT support workers) and sharers (users).' This is a UNIQUE dual-licensing rule in the Intune Suite.",
inScopeMeans: "admin will RUN Remote Help sessions from the Intune admin center (helper role) — license required on the admin's account.",
examples: [
"Per-user (helper): Helpdesk admin holds Help Desk Operator role and runs Remote Help sessions → Remote Help / Intune Suite license required on the admin."
],
docs: [
["Remote Help — plan (helpers AND sharers)", "https://learn.microsoft.com/intune/remote-help/plan"]
]
},
{
name: "Microsoft Entra ID Governance — admin who CONFIGURES",
sku: "Entra ID Governance per-user (bundled in Entra Suite / M365 E7) — required on the admin who configures Lifecycle Workflows / Entitlement Management.",
scope: "per-user",
scopeNote: "The Entra ID Governance FAQ is explicit: 'A license is needed for any user who configures Lifecycle Workflows' — that includes the admin who builds the workflow.",
inScopeMeans: "admin authors Lifecycle Workflows or Entitlement Management access packages.",
examples: [
"Per-user: Identity admin builds Lifecycle Workflows for joiner/leaver automation → Entra ID Governance / Entra Suite / M365 E7 license required on the admin's own account."
],
docs: [
["Entra ID Governance FAQ — admin licensing", "https://learn.microsoft.com/entra/id-governance/licensing-fundamentals#do-licenses-need-to-be-assigned-to-users-to-use-identity-governance-features"]
]
},
{
name: "Teams Premium — admin-only features (Advanced collaboration analytics)",
sku: "Teams Premium per-user — required on the Teams admin's own account.",
scope: "per-user",
scopeNote: "Per the Teams Premium licensing matrix, Advanced collaboration analytics and aggregated Teams Premium usage views require Teams Premium assigned to the Teams admin's OWN account.",
inScopeMeans: "admin uses Teams admin center features that require Teams Premium (analytics dashboards, premium config UIs).",
examples: [
"Per-user: Teams admin uses Advanced collaboration analytics → Teams Premium required on the admin's account."
],
docs: [
["Teams Premium admin license matrix", "https://learn.microsoft.com/microsoftteams/teams-add-on-licensing/licensing-enhance-teams#which-features-are-applied-to-organizers-attendeesusers-or-admins"]
]
},
{
name: "Microsoft 365 Copilot — admin who USES Copilot",
sku: "Microsoft 365 Copilot per-user add-on, OR M365 E7 (bundles Copilot).",
scope: "per-user",
scopeNote: "Per the M365 Copilot licensing doc, Copilot in apps (Word/Excel/PowerPoint/Outlook/Teams) and Copilot Chat work mode check for the per-user M365 Copilot license on the signed-in user — including the admin.",
inScopeMeans: "admin invokes Copilot in any M365 app or runs work-mode Copilot Chat prompts.",
notInScopeMeans: "admin only MANAGES Copilot rollout in the M365 admin center (license assignment, restricted SharePoint sites, Copilot governance) but never uses Copilot themselves.",
examples: [
"Per-user: Admin opens Copilot Chat in Teams to draft a status report → M365 Copilot required on the admin.",
"Free (admin manages only): Admin configures Copilot license assignment and SharePoint Restricted Sites in the M365 admin center but never invokes Copilot. No Copilot license needed on the admin."
],
docs: [
["M365 Copilot licensing", "https://learn.microsoft.com/microsoft-365/copilot/microsoft-365-copilot-licensing"],
["M365 Maps — Microsoft 365 Copilot", "https://m365maps.com/Microsoft%20365%20Copilot.htm"]
]
},
{
name: "Microsoft Entra Verified ID",
sku: "Free — no special licensing requirements (per Verified ID FAQ).",
scope: "tenant-wide-not-scopeable",
scopeNote: "Microsoft's Verified ID FAQ states verbatim: 'There are no special licensing requirements to issue verifiable credentials.' Issuance is free; Verified ID is bundled in Entra Suite as a value-add but does not itself require a per-user license.",
inScopeMeans: "admin issues verifiable credentials for HR onboarding, helpdesk verification, etc.",
examples: [
"Free: Admin sets up Verified ID issuance pipeline for new-hire onboarding. No license required."
],
docs: [
["Verified ID FAQ — no licensing requirements", "https://learn.microsoft.com/entra/verified-id/verifiable-credentials-faq#what-are-the-licensing-requirements"]
]
},
{
name: "Global Secure Access (Internet Access + Private Access)",
sku: "Microsoft Entra Suite per-user (or standalone GSA license) — required on EVERY USER whose device runs the GSA client.",
scope: "per-user",
scopeNote: "GSA is licensed per user whose client routes through the GSA edge. Configuring GSA policies in the Entra portal is role-gated and free.",
inScopeMeans: "admin's own laptop runs the GSA client and routes traffic through Entra Internet Access / Private Access.",
notInScopeMeans: "admin configures GSA traffic-forwarding profiles for other users but their own laptop is NOT a GSA client.",
examples: [
"Per-user: Admin's laptop runs GSA client → Entra Suite required on the admin's account.",
"Free (config only): Admin configures GSA Internet Access for 5,000 users but their own laptop bypasses GSA. No GSA license on the admin."
],
docs: [
["Global Secure Access overview", "https://learn.microsoft.com/entra/global-secure-access/overview-what-is-global-secure-access"],
["M365 Maps — Entra Suite", "https://m365maps.com/Microsoft%20Entra%20Suite.htm"]
]
},
{
name: "Microsoft Entra Connect / Cloud Sync — admin who configures",
sku: "Entra ID Free (role-gated: Hybrid Identity Administrator)",
scope: "tenant-wide-not-scopeable",
scopeNote: "Installing and operating Entra Connect (legacy) and Cloud Sync (modern) is role-gated. The admin who configures sync needs no license; synced USERS may need P1 for writeback features.",
inScopeMeans: "admin installs Entra Connect or Cloud Sync and configures attribute filtering, scoping filters, and writeback.",
examples: [
"Free: Hybrid Identity Administrator configures Cloud Sync to sync on-prem AD users to Entra. No license required on the admin."
],
docs: [
["Entra Connect / Cloud Sync overview", "https://learn.microsoft.com/entra/identity/hybrid/cloud-sync/what-is-cloud-sync"]
]
},
{
name: "Cross-tenant access settings & B2B / B2B Direct Connect",
sku: "Entra ID Free for admin config. Per-MAU billing for guests (External ID), free baseline.",
scope: "tenant-wide-scopeable",
scopeNote: "Configuring cross-tenant access settings, B2B invitations, and B2B Direct Connect trust is role-gated. External users are billed per MAU (Monthly Active User) at the External ID pricing tier; first 50,000 MAU free per Microsoft pricing.",
inScopeMeans: "admin configures cross-tenant B2B trust and invites partners.",
examples: [
"Free: Admin invites 100 contractors as B2B guests. First 50,000 MAU free."
],
docs: [
["Cross-tenant access settings", "https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview"],
["External ID pricing (MAU model)", "https://learn.microsoft.com/entra/external-id/external-identities-pricing"]
]
},
{
name: "Microsoft 365 admin center & Power Platform admin center",
sku: "Free — Global Administrator and Power Platform Administrator administer WITHOUT a license.",
scope: "tenant-wide-not-scopeable",
scopeNote: "Microsoft's documented policy: 'Global Administrators and Power Platform Administrators can administer without a license assigned.' Unlicensed admins land in Administrative access mode for Dynamics 365 / Power Platform.",
inScopeMeans: "admin operates the M365 admin center, Power Platform admin center, and Dynamics 365 admin center under GA / PPA role.",
examples: [
"Free: GA-only admin account manages tenant settings, license assignment, mailbox creation, Teams settings. No license required on the admin's account."
],
docs: [
["GA / PPA can administer without a license", "https://learn.microsoft.com/power-platform/admin/global-service-administrators-can-administer-without-license"]
]
}
],
docs: [
["Microsoft Entra plans & pricing (Free vs P1 vs P2)", "https://www.microsoft.com/security/business/microsoft-entra-pricing"],
["Microsoft Entra service description", "https://learn.microsoft.com/office365/servicedescriptions/azure-active-directory"],
["Microsoft 365 security & compliance licensing guidance", "https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-365-security-compliance-licensing-guidance"],
["Microsoft Product Terms — Universal License Terms", "https://www.microsoft.com/licensing/terms/product/UniversalLicenseTerms/all"],
["M365 Maps — full licensing map index", "https://m365maps.com/"],
["M365 Maps — Microsoft 365 and Office 365 plans comparison", "https://m365maps.com/files/Microsoft-365-and-Office-365-Plans.htm"],
["M365 Maps — Microsoft Entra ID Free / P1 / P2", "https://m365maps.com/Microsoft%20Entra%20ID%20P1.htm"],
["M365 Maps — Microsoft 365 E3", "https://m365maps.com/Microsoft%20365%20E3.htm"],
["M365 Maps — Microsoft 365 E5", "https://m365maps.com/Microsoft%20365%20E5.htm"],
["M365 Maps — Microsoft Intune Suite", "https://m365maps.com/Microsoft%20Intune%20Suite.htm"],
["M365 Maps — Microsoft Defender XDR", "https://m365maps.com/Microsoft%20Defender%20XDR.htm"],
["M365 Maps — Microsoft Purview E5", "https://m365maps.com/Microsoft%20Purview%20E5.htm"],
["M365 Maps — Microsoft Entra Suite", "https://m365maps.com/Microsoft%20Entra%20Suite.htm"]
],
actions: [
{ label: "← Back to privileged admin overview", target: "info_privileged_admins", tone: "primary" },
{ label: "Start the admin walk-through →", target: "start", tone: "secondary" },
{ label: "← Back to account-scope choice", target: "start_choice", tone: "secondary" }
]
},
info_teams_phone: {
info: true,
badge: "Add-on deep-dive",
badgeClass: "badge-info",
title: "Teams Phone licensing — the four flavors",
sub: "Cloud control plane vs. minutes — how to pick Teams Phone Standard, Calling Plan, Direct Routing, or Operator Connect.",
paragraphs: [
"Microsoft Teams Phone replaces a PBX with a cloud calling stack inside Microsoft Teams. The confusing part is that there are FOUR ways to license it, and you have to pick the cloud control plane separately from how Microsoft Teams gets to the PSTN (the phone network).",
"STEP 1 — pick the cloud control plane. Teams Phone Standard (~$8 / user / month) is the basic license: it gives the user a Teams phone number, voicemail, call queues, auto attendants, and the ability to make and receive PSTN calls — but does NOT include any minutes. Teams Phone with Calling Plan bundles Standard PLUS Microsoft as the carrier with included minutes (Domestic ~$12 / user / month — 3,000 outbound domestic minutes; Domestic + International ~$24 / user / month — 600 international minutes added). Microsoft 365 E5 / E7 include Teams Phone Standard at no extra cost (you still need to add a Calling Plan or BYO carrier to actually make calls).",
"STEP 2 — pick how calls reach the PSTN. Option A: Microsoft Calling Plan (the bundled-minutes SKUs above). Microsoft is your carrier; available in ~33 countries; cheapest if Microsoft sells it where you operate. Option B: Direct Routing — bring your own SIP trunks via a certified Session Border Controller (SBC) and pair it with Teams Phone Standard. Most flexible (any carrier in any country), most operational overhead (you run the SBC). Option C: Operator Connect — a curated marketplace of telco carriers (AT&T, BT, Verizon, Telstra, etc.) that integrate directly with Teams Phone Standard; you sign a contract with the carrier, they handle the SBC and provisioning. Lower lift than Direct Routing, fewer countries than DR but more than Calling Plan.",
"STEP 3 — pick add-ons. Microsoft Teams Shared Devices (~$8 / device / month) is a device license for shared phones (lobby, conference rooms) — it covers Teams Phone Standard for that device. Common Area Phone is the Standard equivalent for shared phones. Communication Credits cover overage minutes, international toll, and inbound toll-free.",
"RULE OF THUMB. ≤ 500 users in a Microsoft Calling-Plan country with predictable domestic-only calling → Teams Phone with Domestic Calling Plan. Larger / international / regulated industries → Direct Routing or Operator Connect with Teams Phone Standard. Already on Microsoft 365 E5 / E7 → Standard is included, just add a calling path."
],
docs: [
["Teams Phone — overview", "https://www.microsoft.com/microsoft-teams/microsoft-teams-phone"],
["Teams Phone — plans and pricing", "https://www.microsoft.com/microsoft-teams/compare-microsoft-teams-options"],
["Teams Phone Standard vs Calling Plan vs Direct Routing vs Operator Connect (PSTN comparison)", "https://learn.microsoft.com/microsoftteams/pstn-connectivity"],
["Microsoft Calling Plans — country and region availability", "https://learn.microsoft.com/microsoftteams/calling-plan-landing-page"],
["Direct Routing — plan", "https://learn.microsoft.com/microsoftteams/direct-routing-plan"],
["Operator Connect — overview", "https://learn.microsoft.com/microsoftteams/operator-connect-plan"],
["Teams Shared Devices license", "https://learn.microsoft.com/microsoftteams/teams-add-on-licensing/microsoft-teams-rooms-licensing#microsoft-teams-shared-devices-license"],
["Communication Credits — overview", "https://learn.microsoft.com/microsoftteams/what-are-communications-credits"]
],
actions: [
{ label: "← Back to profile selector", target: "start_choice", tone: "secondary" }
]
},
info_windows_365: {
info: true,
badge: "Add-on deep-dive",
badgeClass: "badge-info",
title: "Windows 365 & Cloud PC licensing",
sub: "Windows 365 Business vs. Enterprise vs. Frontline vs. Azure Virtual Desktop — when each is the right choice.",
paragraphs: [
"A Cloud PC is a Windows 11 desktop hosted by Microsoft and streamed to any device (Windows, Mac, iPad, browser). Microsoft sells it in two parallel SKU families that don't interchange: Windows 365 (fixed-price per-user Cloud PC) and Azure Virtual Desktop (per-user license + consumption-priced Azure VM).",
"Windows 365 BUSINESS — ≤ 300 seats hard cap. Sold to small / mid-size business at a fixed per-user / per-month price by VM SKU (2 vCPU / 4 GB / 128 GB starts ~$31; 8 vCPU / 32 GB / 512 GB tops out ~$162). Includes Microsoft Defender Antivirus and the Windows 365 user portal — does NOT require an Intune license or Microsoft 365 E3. Best for SMBs that need a few Cloud PCs without a domain.",
"Windows 365 ENTERPRISE — unlimited seats. Same fixed per-user pricing, but requires the assigned user already have Windows 11 / Windows 10 Enterprise licensing (Microsoft 365 E3 / E5 / F3 / A3 / A5 / Business Premium all include it) AND Microsoft Intune. The Cloud PC is provisioned into your tenant, joins Microsoft Entra (or Hybrid AD-joined), and is managed by Intune like any physical PC. Best for enterprise standardization, BYOD scenarios, contractor workstations, and developer environments.",
"Windows 365 FRONTLINE — shift-worker model. One license covers up to 3 frontline users sharing a Cloud PC pool, with concurrency-based assignment. Sized for shift work where a Cloud PC is only used during the worker's shift. Significantly cheaper per-seat than Windows 365 Enterprise when the use pattern is truly shift-based.",
"AZURE VIRTUAL DESKTOP (AVD) — consumption-priced alternative. The Windows / Microsoft 365 license cost is the same Enterprise inclusion, but the desktop runs on Azure VMs you size and pay for by the hour (with auto-scale, hibernate, and reserved-instance discounts). More flexible than Windows 365 (multi-session Windows 11, custom images, app streaming, RemoteApp), more complex to operate. Best for very large fleets where consumption pricing beats fixed Cloud PC pricing, or for app-streaming and multi-session scenarios Windows 365 doesn't cover."
],
docs: [
["Windows 365 — overview", "https://www.microsoft.com/windows-365"],
["Windows 365 Business vs Enterprise comparison", "https://learn.microsoft.com/windows-365/business/compare-plans"],
["Windows 365 Enterprise — requirements", "https://learn.microsoft.com/windows-365/enterprise/requirements"],
["Windows 365 Frontline — overview", "https://learn.microsoft.com/windows-365/enterprise/windows-365-frontline-overview"],
["Azure Virtual Desktop — pricing", "https://azure.microsoft.com/pricing/details/virtual-desktop/"],
["Choose between Windows 365 and AVD", "https://learn.microsoft.com/windows-365/business/windows-365-business-vs-enterprise"]
],
actions: [
{ label: "← Back to profile selector", target: "start_choice", tone: "secondary" }
]
},
info_workload_addons: {
info: true,
badge: "Add-on deep-dive",
badgeClass: "badge-info",
title: "Workload add-ons — Viva, Project, Visio, Power Platform",
sub: "When to layer Microsoft Viva, Project, Visio, Power BI, Power Apps, or Copilot Studio on top of a base SKU.",
paragraphs: [
"Microsoft sells most workloads (analytics, project, diagramming, BI, low-code, agent platforms) as add-on SKUs on top of a base Microsoft 365 / Office 365 SKU. The decision is always: does the bundled tier in my base SKU cover the use case, or do I need a paid add-on per user?",
"MICROSOFT VIVA. Viva Connections is included with most Microsoft 365 / Office 365 SKUs. Viva Engage core (formerly Yammer) is included. Paid uplift = Viva Suite (~$12 / user / month) bundling Viva Insights (advanced personal + team analytics, Glint integration), Viva Goals (OKRs, formerly Ally.io), Viva Learning (Premium content library), Viva Topics (knowledge AI — now deprecated but still in the Suite), and Viva Engage Premium (Storyline + Leadership Corner). Best fit: HR / People Analytics, OKR-driven orgs, large enterprises with internal learning programs. Microsoft 365 Copilot license is NOT a substitute for Viva Suite — they're complementary.",
"MICROSOFT PROJECT. Project Plan 1 (~$10 / user / month) — web-only project / task list. Project Plan 3 (~$30 / user / month) — Plan 1 + Project desktop app + Resource Management. Project Plan 5 (~$55 / user / month) — Plan 3 + portfolio analytics + demand management. Pick by feature need: most casual PMs only need Plan 1; PMO / portfolio offices need Plan 5.",
"MICROSOFT VISIO. Visio Plan 1 (~$5 / user / month) — web-only diagramming. Visio Plan 2 (~$15 / user / month) — Plan 1 + Visio desktop app + Data Visualizer + Process Advisor. Most architects / engineers / business analysts want Plan 2.",
"POWER BI. Power BI Pro (~$10 / user / month, included in Microsoft 365 E5 / E7 / A5 / G5) — author + share reports in My Workspace and Pro workspaces. Power BI Premium Per User / PPU (~$20 / user / month) — Pro + paginated reports + AI features + 100 GB datasets. Power BI Premium Per Capacity (~$5,000 / capacity / month) — dedicated capacity, no per-user limit for consumers, required for Premium-only features at scale. Microsoft Fabric (capacity-priced from ~$262 / month F2 SKU) — supersedes Power BI Premium Per Capacity for new deployments and adds Data Engineering, Data Science, Real-Time Analytics, and OneLake.",
"POWER APPS & POWER AUTOMATE. Seeded usage rights for premium connectors are NOT included in any Microsoft 365 / Office 365 SKU — base SKUs only include Power Apps for Microsoft 365 (standard connectors only, customizing SharePoint / Teams data). Paid: Power Apps Premium (~$20 / user / month, formerly Per User Plan) — unlimited apps + premium connectors + Dataverse + custom AI. Power Apps Per App (~$5 / user / app / month) — 1 specific app. Power Automate Premium (~$15 / user / month) — premium connectors in flows. Power Automate Process (~$150 / bot / month) — Process Mining + RPA bot. Microsoft Sentinel-style consumption pricing for Power Automate hosted RPA.",