E5 Value Realisation
The question it answers: Are the capabilities that make E5 more expensive than E3 actually configured and used?
Microsoft 365 E5 costs substantially more than E3 because of PIM, Identity Protection, Defender for Office 365 P2, Defender for Endpoint P2, Defender for Identity, Defender for Cloud Apps and Purview Premium. If those capabilities are not switched on and used, the organisation pays for them anyway. Use this at renewal - or to justify E3 plus the add-ons you actually use.
At a glance
Section titled “At a glance”| Where in the app | Licensing › Licence Value & Entitlements › E5 Value Realisation |
| Workload | Licensing |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | E5-class licences (the report shows what is used whatever you own). |
| Report id (API and MCP) | entra.licensing.e5-value |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Product | Category | Text |
| Capability | Subject | Link |
| Check | Setting | Text |
| In use | Value | Text |
| Finding | Finding | Text |
| Evidence | Detail | Text |
| Date | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: E5-class licences (the report shows what is used whatever you own).
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Organization.Read.All | Microsoft Graph | Read organization information | |
RoleManagement.Read.Directory | Microsoft Graph | Read all directory RBAC settings | |
Policy.Read.All | Microsoft Graph | Read your organization’s policies | |
AccessReview.Read.All | Microsoft Graph | Read all access reviews | |
AttackSimulation.Read.All | Microsoft Graph | Read attack simulation data of an organization | |
eDiscovery.Read.All | Microsoft Graph | Read all eDiscovery objects | |
InformationProtectionPolicy.Read.All | Microsoft Graph | Read all published labels and label policies for an organization | |
SecurityIdentitiesSensors.Read.All | Microsoft Graph | Read all identity security sensors | |
ThreatHunting.Read.All | Microsoft Graph | Run hunting queries and read shared saved hunting queries |
Data sources it reads
GET /v1.0/subscribedSkuscached: PIM, CA policies, access reviews, attack simulations, eDiscovery casesGET /beta/security/informationProtection/sensitivityLabelsGET /beta/security/identities/sensorsPOST /v1.0/security/runHuntingQuery (DeviceInfo, CloudAppEvents)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.licensing.e5-value?size=100An AI assistant reads it with the MCP tool get_report and the id entra.licensing.e5-value. The client needs the Read grant for Licensing. See Using the API.