Microsoft 365 for schools: A1, A3 and A5 in plain English

Part of: IT for schoolsBudgets, devices, cyber and support, planned around terms and the people who run the school.

For most Australian schools, Microsoft 365 A3 is the right staff licence, because it adds desktop apps, device management and conditional access to the basics. A5 adds advanced threat protection, identity risk tools and compliance features. It earns its place only where a school will configure and monitor those features, ideally for a defined group of users.

If you manage the budget for an independent, Lutheran or other faith-based school, licensing is one of those areas where nobody quite owns the detail. This article sits within our IT for schools guidance and is written for the business manager or principal who has to approve a renewal without needing to become a licensing specialist.

You will see what A1, A3 and A5 include as Microsoft publishes them, how to decide between A3 and A5, where schools commonly pay for things they do not use, and how licensing connects to the Essential Eight. There are no prices here. Your price and terms sit in your own licensing agreement, and that is the document to check.

Key Takeaways

• A3 is the sensible foundation for most schools. It covers desktop apps, Intune device management and conditional access, which the Essential Eight work depends on.
• A5 is worth buying when someone will act on its alerts and policies. Without that person, it is shelfware.
• Microsoft has changed how A1 is offered. Confirm current A1 terms with Microsoft or your licensing partner before relying on it.
• The commonest waste is simple: licences still assigned to people who have left, and included features that were never switched on.
• Right-sizing at renewal is a reconciliation job, not a negotiation. Count real users, check real usage, then decide.
• No licence makes a school compliant. Essential Eight maturity comes from configuration and routine, not from the badge on the bundle.

Summary Table

What do Microsoft 365 A1, A3 and A5 include?

A1 is the entry tier, built around web and mobile apps and core services such as Exchange, Teams, OneDrive and SharePoint. A3 adds installed desktop apps, device management and conditional access. A5 adds advanced security, identity protection and compliance tooling on top of A3. Microsoft revises bundles, so confirm against its current list.

The detail below reflects how Microsoft describes the Microsoft 365 Education plans at the time of writing. Bundles move, so check Microsoft's education pages and your own agreement before you rely on any single line.

Microsoft 365 A1

A1 gives access to the core cloud services, with the web and mobile versions of the Office apps. It has historically been the lightweight option, and it suits accounts that do not need installed apps or tight device control.

A1 is also the tier that has seen the most recent change in how Microsoft offers it. The next section covers that.

Microsoft 365 A3

A3 is where a school gets the things a managed environment needs. That includes the installed Microsoft 365 Apps, Windows Education licensing, Microsoft Intune for managing laptops and tablets, and Microsoft Entra ID P1, which brings conditional access. Conditional access lets you say, for example, that staff email can only be opened from a managed device or after a multi-factor prompt.

A3 also includes core information protection features such as sensitivity labels, so a school can start classifying documents without moving up a tier.

Under Microsoft's Student Use Benefit, schools that licence staff on qualifying A3 or A5 plans may be able to give students equivalent entitlements. The conditions apply, so confirm how it works under your agreement rather than assuming.

Microsoft 365 A5

A5 includes everything in A3 and adds the advanced layer. As Microsoft publishes it, that includes Microsoft Defender for Endpoint, Defender for Office 365 (the higher plan), Defender for Identity and Defender for Cloud Apps. It also adds Entra ID P2, which brings identity risk detection and Privileged Identity Management, along with Microsoft Purview tools such as insider risk management, advanced audit and eDiscovery. Microsoft has also bundled Power BI Pro and Teams Phone into A5 at various times.

Microsoft publishes add-on options that bring A5 security or compliance capability to A3 users. Availability depends on your agreement, so ask your licensing partner what is open to you.

What has changed with A1?

Microsoft has changed how A1 is offered in recent years, including how it applies to devices and to students. I will not quote terms here that may have moved since this was written. Check the A1 entry on Microsoft's education licensing pages, and ask your licensing partner what applies to your agreement before relying on A1 for anyone.

This is the part of the licensing picture where I would be most cautious about old advice. If a spreadsheet or a handover note from a previous IT provider says A1 is free and covers a given group, treat that as a prompt to verify, not as fact.

When we review a school's position, these are the A1 questions we ask:

• Does A1 still cover the apps that group of users actually needs, or are they quietly relying on installed apps that now need a different licence?
• Is a per-device option relevant to shared or lab machines?
• How does A1 interact with the Student Use Benefit if staff are on A3 or A5?
• Is anyone on A1 who handles sensitive data and therefore needs the controls A3 provides?

If you have a Microsoft partner looking after your tenant, this is a ten-minute conversation. SCCS is a Microsoft partner, and our Microsoft 365 and cloud work starts with exactly this kind of check.

What separates A3 from A5 on security and compliance?

A3 gives a school the controls to set sensible rules: multi-factor authentication, conditional access and managed devices. A5 adds detection and investigation: it spots risky sign-ins, flags suspicious email and endpoint behaviour, and records activity in more depth. In short, A3 helps you set the rules, and A5 helps you see when they are being broken.

Here is how that plays out in practice, grouped by the question a school is really asking.

Can we stop the wrong people getting in?

A3 handles most of this. With Entra ID P1 you can require multi-factor authentication, restrict sign-ins by location or device state, and block legacy sign-in methods. A5 adds Entra ID P2, which scores sign-in and user risk automatically, and Privileged Identity Management, which makes administrator rights temporary and approval-based instead of permanent.

Can we see when something has gone wrong?

This is the real A5 difference. Defender for Endpoint, Defender for Office 365 and Defender for Identity give richer alerts and investigation tools across laptops, mailboxes and identities. They only create value if someone reads the alerts and acts. A school without in-house security staff needs a partner or monitored service to do that, or the alerts pile up unread.

Can we investigate and prove what happened?

A5's Purview features, including advanced audit, eDiscovery and insider risk management, help when a school has to establish what happened to a piece of information. That matters after a suspected breach or a serious complaint. If you ever have to assess an incident against the Notifiable Data Breaches scheme, the OAIC's guidance sets out your obligations, and good audit records make that assessment faster and more defensible.

When does a school actually need A5?

A school needs A5 when it has a specific risk it will act on: a team that can triage security alerts, a need to detect compromised identities quickly, or a duty to investigate data incidents. If nobody will triage the alerts or build the policies, A5 is shelfware. Most schools are better placed on A3 done properly.

That is my honest view, and I hold it because I would rather a school run a well-configured A3 than a half-configured A5. Here are the situations where A5 genuinely earns its place.

• You have monitoring in place. An internal security resource or a partner watches the Defender alerts daily.
• You hold highly sensitive records. Student welfare, health, counselling, boarding and financial data carry a higher consequence if exposed.
• Your risk assessment calls for it. You are working towards a higher Essential Eight maturity level and need stronger privileged access control and logging.
• You want Teams Phone. If you plan to retire an ageing phone system and A5 includes the calling capability you need, that is a legitimate non-security reason. Check the current inclusions first.

Do all users need the same licence?

Not necessarily. A common sensible pattern is A3 for most teaching and administration staff, with A5 for a defined group: the principal's office, finance, HR, student services leaders and IT administrators. Microsoft's licensing rules generally require that the people who benefit from a feature are licensed for it, so a mixed model needs careful design. It is a good approach, but it has to be set up properly and documented so it survives a staff change.

Where do schools waste Microsoft 365 licences?

The two commonest sources of waste are licences still assigned to people who have left, and included features nobody switched on. Both are quiet, and both are fixable. The first costs you money directly. The second costs you protection you have already paid for.

Licences assigned to people who have left

Schools have a lot of movement. Casual relief teachers, contractors, graduating cohorts, staff who finish at the end of a term. If the leaver process is a manual email to IT, accounts linger. A licence that stays assigned to a departed user is a cost, and the account is also a security exposure.

The fix is a routine, not a one-off clean-up. Reconcile your Microsoft 365 user list against payroll and your student management system each term. Reclaim licences from disabled accounts. Keep a short, written leaver checklist that names who does what.

Features paid for and never switched on

This one is more common than most business managers expect. A school moves to A3 or A5, the bundle is purchased, and the configuration work never gets finished. Typical examples:

• Conditional access policies not built, so Entra ID P1 sits idle.
• Intune available but only part of the device fleet enrolled.
• Defender for Endpoint included but not onboarded to all devices.
• Sensitivity labels and data loss prevention rules never created.
• Privileged Identity Management available, with administrators still holding permanent rights.

This is where the idea of buying a bundle and calling the job done falls over. Devices are the easy part. The lifecycle is the work, and licensing follows the same rule: the purchase is the start, and the configuration is the job.

How do you right-size licences at renewal?

Right-sizing is a reconciliation exercise. Count who genuinely needs a licence, check which features are actually in use, then match the tier to the people and the risk. Start well before the renewal date, because your agreement controls when you can add or reduce quantities, and that is where the leeway sits.

Here is the sequence we use when a school asks us to review a renewal.

1. Read your agreement first. Confirm the renewal date, the rules for increasing and reducing quantities, and what the true-up process involves. Your licensing partner can explain the terms in plain language.
2. Reconcile the user list. Compare licensed accounts with current staff and enrolled students. Remove leavers, duplicates and test accounts.
3. Check feature usage. The Microsoft 365 admin centre and Entra reports show what is being used. List the included features that have never been configured.
4. Map tiers to roles. Decide which groups need A3, which need A5, and whether any group is better served by another option. Document the reasoning.
5. Plan the configuration work. For every paid feature you keep, name who will configure it and by when. If nobody owns it, question the purchase.
6. Set a review rhythm. Put a licence review in the calendar each term, not just at renewal.

None of this needs a price figure to decide. It needs a clear head and an accurate list.

How does Microsoft 365 licensing connect to the Essential Eight?

The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate (ASD) and the Australian Cyber Security Centre (ACSC). Microsoft 365 licensing does not make a school compliant. It gives you tools that make some strategies easier to implement, provided they are configured and maintained.

The ASD's Essential Eight guidance lists the strategies and the maturity model describes what each level looks like. Always work from the latest published edition. For a school-specific view, see our article on the Essential Eight for independent schools.

Here is how the licensing tiers relate to the strategies, in general terms.

• Multi-factor authentication. Conditional access in A3 lets you enforce it by rule. A5 adds risk-based policies. Stronger forms of MFA at higher maturity levels depend on how you configure it, not on the tier alone.
• Patching applications and operating systems. Intune, included in A3, helps manage update policies across enrolled devices. Coverage depends on enrolment being complete.
• Restricting administrative privileges. A3 supports separate admin accounts and role-based access. A5's Privileged Identity Management makes elevated rights time-limited and reviewable.
• Application control, user application hardening and Office macro settings. These are largely configuration tasks that Intune and Windows policy can deliver across managed devices. They are not tied to A5.
• Regular backups. Be careful here. Microsoft runs the service, but a licence is not a backup of your data. Check how your school's Microsoft 365 data is protected and recovered.

A5 also helps with the detection and response side that sits around the Essential Eight, even though that is not one of the eight strategies. That is useful, but it is a separate decision from the maturity target.

The ASD's maturity model is the reference for what each level asks for. Other products can meet some requirements too, so the question is never simply whether you own A5. It is whether the control is in place and working.

Why a licence review works best as a conversation about people

The most useful licensing question I know is not technical. It is the teacher test: does this make a teacher's day easier or safer, and will someone own it so the teacher never has to think about it? If technology steals a minute of the lesson, it failed.

Apply that to licensing. A school that takes A5 because the security list looks impressive, then lets the alerts go unread, has bought comfort and not protection. A school on A3 with every conditional access policy built, every device enrolled and a tidy leaver process is in a stronger position than the A5 school next door. That is my view, and it is not the one a licence vendor would lead with.

It comes from watching how this plays out. When SCCS took end-to-end responsibility for an independent school's network, cyber security and daily support, the outcome that mattered was simple: staff could return to teaching instead of troubleshooting. Nobody at that school asked which tier they were on. They asked whether things worked and whether risk was being handled early. The licence decision followed from that.

This fits how we approach security generally. We want schools to be safe, not scared. If A3 is enough, we say A3 is enough. If a school has a real reason for A5, we say so, and we say who needs to own it. A licence review should end with fewer unknowns, not a bigger shopping list. We measure ourselves on your quiet weeks.

Where to start

If you want a calm, plain-language view of where your school stands on Microsoft 365 licensing, security and the Essential Eight, the school IT health check is the place to begin. We look at what you have, what you are using and what is worth changing. You get honest reporting, and if something is fine, we will say it is fine. Real people, not a ticket queue.

References

• Microsoft, Education (Australia)
• Australian Signals Directorate (ASD) and ACSC, Essential Eight
• Australian Signals Directorate (ASD) and ACSC, Essential Eight Maturity Model
• Office of the Australian Information Commissioner, Notifiable Data Breaches

Frequently asked questions

Do we need A5 to meet the Essential Eight?

No. The Essential Eight is about how controls are configured and maintained, and no licence tier is a requirement. A3 provides the tools for multi-factor authentication, device management and patch policy. A5 can help with privileged access and detection at higher maturity, but other products can also meet those needs.

Is Microsoft 365 A1 still free?

Microsoft has changed how A1 is offered in recent years, so do not rely on older advice. Check the A1 entry on Microsoft's education licensing pages, and ask your licensing partner what applies to your school and your agreement before you assign A1 to any group.

Do students need their own licences if staff are on A3 or A5?

Not necessarily. Under Microsoft's Student Use Benefit, a school that licenses staff on qualifying A3 or A5 plans may be able to provide students with equivalent entitlements. The conditions and eligible products matter, so confirm the details with your licensing partner and your agreement.

Can we mix A3 and A5 across staff?

Yes, and many schools do. A common pattern is A3 for most staff and A5 for leadership, finance, HR and IT administrators. Microsoft's rules generally require that people who benefit from a feature are licensed for it, so design the model carefully and document it.

How often should we review our licences?

Once a term is a sensible rhythm, with a deeper review before each renewal. The term review is mostly a reconciliation: remove leavers, check new starters have the right tier, and confirm the features you pay for are switched on and owned by someone.

Keep reading

Essential Eight for schools

The Essential Eight for Independent Schools: Where to Start

16 min read

school iPad program

Running a 1:1 iPad or Mac program: five decisions before term starts

18 min read

cyber incident cost for schools

What a Cyber Incident Costs a School, Measured in a Term

19 min read