1.11 Licensing and Lab Setup
Licensing quick reference
This table summarises which licence tier unlocks which capabilities. It consolidates the licensing notes from each subsection into a single reference you can bookmark.
| Component | Business Premium | E3 | E5 | Add-On Available |
|---|---|---|---|---|
| Defender for Endpoint | P1 | P1 | P2 | P2 |
| Defender for Office 365 | P1 | — | P2 | P1, P2 |
| Defender for Identity | — | — | Yes | Yes |
| Defender for Cloud Apps | — | — | Yes | Yes |
| Entra ID | P1 | P1 | P2 | P2 |
| Intune | P1 | P1 | P1 | Suite |
| Sentinel | — | — | — | Azure subscription |
| Purview (Premium Audit) | — | — | Yes | E5 Compliance |
| Purview (DLP, Insider Risk) | — | — | Yes | E5 Compliance |
| Defender XDR (full) | Partial | Partial | Yes | Via product add-ons |
Microsoft licensing changes frequently. Check your M365 admin centre under Billing and Licences to see exactly what your organisation has. Last verified: March 2026.
Lab setup
For the free modules (1 through 4), no lab is needed. The content is self-contained with annotated screenshots and code examples.
For paid modules, you will need a lab environment. Here is how to set one up:
Step 1: Create a Microsoft 365 Developer Tenant. Go to developer.microsoft.com and sign up for the Microsoft 365 Developer Programme. You receive a free E5 tenant with 25 user licences. This gives you full access to all Defender products, Entra ID P2, and every feature covered in this course.
Step 2: Load sample data packs. In the developer programme dashboard, load the sample data packs. These populate your tenant with realistic-looking users, groups, email, and activity data. This makes the environment feel like a real organisation rather than an empty tenant.
Step 3: Verify access to all portals. Confirm you can reach: the Microsoft Defender portal at security.microsoft.com, the Entra admin centre at entra.microsoft.com, the Intune admin centre at intune.microsoft.com, the Purview portal at purview.microsoft.com, and the Azure portal at portal.azure.com (for Sentinel setup in Module 5).
Step 4: Lab setup checklist. Developer tenant created and active. Sample data packs loaded. Global admin access confirmed. All five portals accessible. Defender for Endpoint licences assigned. Defender for Office 365 licences assigned. Entra ID P2 licences assigned.
Your lab environment is ready. Module 2 starts using it immediately for KQL queries against the sign-in logs and Defender tables.
Module 1 references: Microsoft Defender for Endpoint documentation, Microsoft Defender for Office 365 documentation, Microsoft Defender for Identity documentation, Microsoft Defender for Cloud Apps documentation, Microsoft Entra ID Protection documentation, Microsoft Sentinel documentation, Microsoft Purview documentation, Microsoft Intune documentation.