From 1 July 2026, the contents of almost every Microsoft 365 plan change. Intune Suite features, Security Copilot and URL time-of-click protection become included in existing licences — but your IT team won't get them automatically. What does each tier gain, what changes in pricing, and which steps should you take this month?
From 1 July 2026, Microsoft is rolling out the most significant package change in the history of Microsoft 365. It is not only prices going up — almost every plan gains functionality that organisations previously had to purchase as an expensive, separate add-on. Intune Suite modules that used to require a separate purchase, Microsoft Security Copilot that was offered as a premium extra, and enhanced email protection layers are now becoming part of the base licence.
The rollout of the new package contents began in June 2026 and must be fully complete by 1 August. Existing customers receive at least thirty days' notice via the Microsoft 365 Message Center before the changes become active in their tenant. IT teams that take no action now risk leaving functionality they are already paying for sitting unused.
The package update touches four segments simultaneously: the Business plans (Basic, Standard and Premium), the Office 365 enterprise line, and the Microsoft 365 enterprise line (E3 and E5). Each segment receives different additions. The price changes vary considerably: Business Premium has no price increase while it does gain features, whereas Business Basic sees the largest percentage price rise — but with a matching expansion of mailbox capacity and defence layers.
Existing customers retain their current price until their next renewal date after 1 July 2026. New customers and customers renewing after 1 July pay the new rates. This makes the planning of renewal dates strategically relevant for many IT budgets over the coming weeks.
For Microsoft 365 Business Basic and Business Standard the changes are identical. The primary mailbox grows by fifty gigabytes, giving users a total of one hundred gigabytes of mailbox space. On top of that, URL time-of-click protection is added — a security layer that evaluates links in emails and documents not only at the moment they arrive in the inbox, but again at the moment a user actually clicks them. This is effective against so-called delayed-detonation attacks, where a link appears safe on delivery but is later redirected to malicious content.
Both plans also receive improved Copilot Chat functionality and Copilot Chat Analytics, giving administrators insight into how employees use Copilot — which prompts are popular, which departments are active users, and where adoption is lagging. That is actionable management information for anyone looking to justify the Copilot investment.
Microsoft 365 Business Premium is an exception in this package: the price stays at its current level. That is notable, because the mailbox expansion and Copilot Chat Analytics are added here too. For organisations currently weighing whether Business Premium is worth the premium over Business Standard — the answer becomes even more clearly yes. Business Standard with Copilot and Business Premium with Copilot also become permanent, officially named SKUs in the Microsoft catalogue as of 1 July.
The changes in Microsoft 365 E3 are the most substantial for IT teams doing day-to-day device management. Until now the plan was classified as sufficient for modern device management, but lacked features that were only available through the Intune Suite add-on. That boundary disappears.
From 1 July 2026, Intune Remote Help, Intune Advanced Analytics and Intune Plan 2 are included in Microsoft 365 E3. Intune Remote Help lets IT staff remotely take over a managed device and resolve issues through an integrated, logged session — without external tools like TeamViewer or Quick Assist that fall outside the management model. All sessions are automatically audited and linked to the user identity.
Intune Advanced Analytics adds AI-driven insights about the health of devices in the fleet. It detects anomalies, flags devices that carry a heightened risk of failure, and gives concrete recommendations based on historical data. For IT teams that currently work reactively — only taking action when a user calls in — this is a shift towards predictive maintenance.
Intune Plan 2 rounds out the set with extended certificate management capabilities, Microsoft Tunnel VPN integration for mobile app management, and additional privilege management features. Organisations that previously did not activate these features because of the add-on cost can now do so immediately.
Office 365 E3 — the plan without the full Microsoft 365 components — receives Microsoft Defender for Office 365 Plan 1 as an addition. This brings protection against advanced phishing, malware in attachments, and malicious links directly into the enterprise email infrastructure, without a separate Defender purchase.
The most striking addition for E5 customers is Microsoft Security Copilot. Until now, Security Copilot was only available as a standalone add-on with its own pricing structure that formed a barrier for many organisations. From 1 July it becomes part of the existing E5 licence — without any additional purchase.
Security Copilot is an AI-powered security assistant that synthesises signals from Microsoft Defender, Microsoft Sentinel, Intune, and Microsoft Purview. In practice this means a security analyst can ask via a simple prompt for a summary of all active incidents, an explanation of a specific attack chain, or a targeted analysis of a suspicious user — and receive directly usable output that would normally require hours of manual investigation.
Beyond Security Copilot, E5 also receives Intune Endpoint Privilege Management, which allows specific applications or tasks to be run with elevated rights without users being local administrators. This drastically reduces the attack surface while productivity remains intact. Microsoft Cloud PKI takes over the on-premises certificate infrastructure as a cloud service, and Intune Enterprise Application Management provides a managed application catalogue with automated patching cycles for popular business applications.
The percentage price increases vary. Business Basic rises by approximately sixteen percent in relative terms. Business Standard follows at twelve percent. Business Premium is the only plan with no price increase. In the enterprise line, Office 365 E3 rises by thirteen percent and Microsoft 365 E3 by eight percent. Microsoft 365 E5 has the smallest percentage increase at five percent — while being the tier with the most substantial content expansion, including Security Copilot that was previously billed separately.
The published rates are based on Microsoft's US dollar catalogue prices. European euro rates are set by the regional Microsoft entity and may differ. Your Microsoft partner or licence reseller can calculate the exact euro impact for your specific agreement. Existing customers are protected until their next renewal date after 1 July.
Six concrete actions for the next four weeks. First: check when your current Microsoft 365 licences expire. Renewals before 1 July keep the current price for another year. Renewals after 1 July automatically fall under the new rates. For many organisations, this is the critical decision of the summer.
Second: inventory which new features are coming to your tier and assign an owner per feature. Intune Remote Help requires an IT administrator to manage sessions and configure reporting. Security Copilot requires onboarding the security analyst and integration with existing workflows. New features do not activate themselves.
Third: for E3 customers, plan an activation project for Intune Remote Help and Intune Advanced Analytics. Start with a pilot group of ten to fifteen devices, evaluate the reports, and then scale. These are capabilities where value only becomes visible after a period of accumulated data.
Fourth: E5 customers who have not yet used Security Copilot should set up an internal test immediately. Select two or three security analysts, give them access, and have them run existing incident investigations alongside Security Copilot. The time saving per investigation becomes directly measurable that way.
Fifth: keep a close eye on the Microsoft 365 Message Center. Microsoft sends a notice at least thirty days in advance when the new package contents are rolled out to your tenant. That notice is the starting signal for the activation planning. Set up an alert or assign an administrator to actively monitor the Message Center.
Sixth: review mailbox limits in the Exchange Online Admin Center. The expansion to one hundred gigabytes for Business plans is welcome, but also calls for a review of your retention policy. Larger mailboxes mean more data to which Purview policy applies and that exposes more in the event of a data breach.
The July 2026 package change is a rare opportunity where the licence investment your organisation is already making suddenly delivers substantially more functionality. Want help activating the new Intune Suite features, onboarding Security Copilot, or assessing whether a different licence tier becomes more attractive after the change? Zarioh helps IT teams get the most out of Microsoft 365. Contact us for a no-obligation conversation.
Zarioh Digital Solutions
IT specialists from Utrecht, the Netherlands. We help businesses with Microsoft 365, AI agents, hosting and telephony — and share what we learn in practice. Follow us on LinkedIn
