Reading time:
6 min

Nine Ways to Maximize the Value of an Office 365 E5 License


There are many Microsoft Office 365 licenses to choose from, with the high-end E5 standing out as the Cadillac of offerings. At $35 a month or $420 annually, an E5 is not cheap. However, if you maximize the value of an E5, it pays for itself rather easily.

In fact, Microsoft believes in the value of E5, and has an E5 ROI calculator to prove it. “On average, organizations that implement Microsoft 365 E5 can achieve an ROI of 123% and a payback of 10 months after they “go-live” according to a 2018 Forrester Consulting TEI study,” Microsoft argues.

Getting this kind of payback is not as easy as just buying the license. You must put it to full, productive use. And here, CoreView offers dramatic help. Our value proposition for Office 365 E5 centers on our following unique capabilities for Office 365. 

1.   Combined data collection from the audit, Graph, application-specific API and Azure AD, giving insight into every single action and all user/device configuration within the platform.

2.    A workflow engine that takes E5 data and triggers playbooks combined with our activity and configuration data collection, dramatically enhancing Flow.

3.    RBAC and virtual tenants based on function, that allow for delegated administration of specific work actions, such as Teams call plan application to users in a specific region.

Here are nine ways CoreView optimizes Office 365 E5 license use, and provides quicker time-to-value for E5 and G5 government licenses.

1. Robust Security – CoreView surfaces Advanced Threat Protection (ATP) Reports for the entire organization, making them searchable (i.e. by department or user), with a one-year retention. ATP is further enhanced with links to user configuration and ancillary actions. 

CoreView also extends the Customer Lockbox functionality to all administrators, internally and externally. For example, delegation of just shared mailbox creation with a single checkbox.

2. Advanced Information Protection (AIP) – CoreView enhances AIP encryption and DLP actions by surfacing historical actions and alerts based on users, groups, and files. Microsoft protects the files and reports on sharing and access options – CoreView surfaces AIP and combines it with comprehensive views of the user activities and devices.

3. Threat Intelligence – CoreView maps threat events surfaced by E5, and then links these events with configuration information, such as if the user has MFA, what conditional access policies were applied (if any), and which methods are being used to attack accounts. This leads to higher MFA and Conditional Access deployments, and when measures fail, a complete forensic analysis of exactly what happened.

4. Intelligent Compliance Solutions – Augment Advanced eDiscovery AI searches for emails and files, with reports that also show user actions such as file access, sharing, user creation, password changes, and email forwarding events. CoreView gives you the complete picture beyond just relevant content.

5. Online Meetings – CoreView reports on meeting activity and includes devices, users, and all Azure AD information. For example, what users are still using Skype, say on an iPhone, to attend and schedule meetings. CoreView can then target those users with specific information on installing Teams on iPhone, and how to schedule meetings on Teams vs. how this was done on Skype.

CoreView also has functional RBAC for Teams PSTN functionality, providing delegation securely by region or any other Azure AD property – This is not yet available from the Microsoft O365 Admin Center for Teams.

6. File Storage and Sharing – CoreView provides extensive OneDrive reports on activity, sharing, and access, as well as data-driven adoption campaigns. For example, one could do an adoption campaign tilted “Communicate OneDrive videos, stored in SharePoint Groups and surfaced through Teams, to users in the marketing department who send large email attachments instead of using OneDrive”. 

7. Enterprise Video Service – CoreView has targeted adoption campaigns based on data that can incorporate and surface customers’ Stream content, Microsoft content, partner content, and CoreView’s Just in Time learning content. A workflow engine detects new user creation and targets them with information on Exchange Online, Teams, OneDrive, etc., as well as customer-specific information for acceptable use, VPN configuration and the employee handbook.

8. Optimize Power BI – The inclusion of Power BI is a powerful incentive to buy an E5 or G5. However, much of Power BI’s tremendous functionality is never tapped. CoreView, in contrast, helps truly optimize the use of Power BI.

Much of that stems from understanding how workers use Power BI, and here CoreView provides deep reports unavailable through the O365 Admin Center. CoreView shows what users are viewing and creating views in Power BI, and who is using the software. The Microsoft O365 shows that some clicked on Power BI, but it cannot show which users are creating the most reports, and who are just reading reports, nor can the native Admin Center show what those Power BI reports are, and how widespread their impact is across the user community.

Having this detailed information enhances the deployment and adoption of Power BI.

At the same time, CoreView has an extensive library of Power BI training videos that can tied to adoption campaigns, and viewed from within Power BI.

9. Enhancing E5 eDiscovery – Office 365 E5 licenses come with advanced eDiscovery features that are deeply enhanced by CoreView features, especially how CoreView can forensically show everything that happened with a file that may be the subject of an eDiscovery investigation.

When IT, HR or the corporate legal teams searches for everybody who received an email that contained the word project X, there may be thousands of responses. Advanced eDiscovery, which is an E5 add on, allows you to do more Boolean searches for items like relevance, and filters those thousands of responses with more relevant requests.

Besides reading the content, how else does the organization determine which responses are truly relevant. With CoreView, you can take the list of users, and export it to an Excel spreadsheet. CoreView then shows what activities those users did around that file. If they did anything external with that file, CoreView shows the date, time, and the IP address it came from. In contrast, the O365 Admin Center only shows an email was received and forward.

CoreView can show that user accessed a file, copied it locally, and shared it via OneDrive to specific groups of people. CoreView shows the full discovery chain of events that occurred with the asset the organization was looking for, thus completing the picture for eDiscovery. In addition, CoreView can show admin activities, such as creating user, changing a password, and deleting the user. If an admin deletes a user seven hours after created them, it could raise flags.

Sharing a file anonymously on OneDrive could also raise eyebrows. With CoreView, IT knows who accessed that file, the IP address number, etc.


E5 surfaces critical security information and additional voice and video functions. CoreView provides a cost-efficient solution that eases deployment, makes E5 security data actionable, and enhances compliance.

Understand Your O365 Tenant for Free Get your O365 user workload usage and security profile FREE with our new CoreDiscovery solution. You can get your free software now at the CoreDiscovery sign up page:

See how CoreView can help you with this

Learn more about securing and optimizing your M365 and other SaaS applications.