Report by: Rob Horwitz

Posted: September 7, 2015

The Enterprise Cloud Suite (ECS) combines subscription licenses for the Windows Enterprise edition client OS, Office desktop suite, and collaboration and management software and services. Besides a bundling discount, ECS puts software under a common Per-User licensing model, which generally simplifies compliance compared to device-based models. However, ECS does not provide use rights after subscriptions expire, so ECS customers obligate themselves to ongoing long-term payments.

This report explains the ECS licensing model, technologies and use rights provided by each ECS component, licensing prerequisites, pricing, and other purchasing details for many common scenarios. While this report provides a brief overview of special purchasing provisions exclusively for Enterprise Agreement (EA) and EA Subscription "platform" customers moving to ECS, EA-related issues will be covered in greater detail in a separate report.

ECS Overview

ECS is licensed under a Per-User subscription model, as are most Microsoft online (hosted) services and some on-premises software. Under this model, each individual user requires a User Subscription License (SL), and all use rights associated with the User SL—both for online services and on-premises software—terminate if the subscription is allowed to lapse. (For a full explanation of the User SL licensing model, see "User Subscription Licenses: An Overview" on page 24 of the Oct. 2015 Update.)

ECS bundles three major User SLs into a single subscription. The first, the Windows Enterprise Upgrade User SL, licenses the Enterprise edition of the Windows OS for local and virtual desktops. The other components, Office 365 Enterprise E3 and the Enterprise Mobility Suite (EMS), each aggregate multiple User SLs for the included services. (See the illustration "Subscriptions Bundled into the Enterprise Cloud Suite (ECS)".) Though most of the value delivered by Office 365 Enterprise E3 and EMS is the hosted online services they provide, both also include use rights for various server-based products run on-premises. (See the illustration "On-Premises Use Rights Included in ECS".)

Windows Enterprise Upgrade Included

The Windows Enterprise Upgrade User SL, included in ECS, provides a single individual with the rights to install and use the current or any previous version of Windows Enterprise edition and the Microsoft Desktop Optimization Pack (MDOP) in a variety of ways listed below. Some of the following rights and features, such as version upgrade rights, are inherited from the fact that User SLs for on-premises software include Software Assurance (SA), and some are simply a unique aspect of Per-User licensing for Windows. Note that all rights associated with a Windows Enterprise Upgrade User SL end when the subscription is terminated.

Virtual desktop rights. The licensed individual may use any device to access any version of Windows Enterprise or Pro editions running within virtual machines (VMs) hosted on a server. This type of server-based desktop architecture is sometimes referred to as a virtual desktop or virtual desktop infrastructure (VDI).

Local Windows installs. Any version of Windows Enterprise (or Pro editions) can be locally installed on the licensed user's Windows-capable devices. On each device, Windows can be installed as the device's physical OS and in up to four local VMs running on the device. There is no limit to the number of devices the individual can cover. However, each device must already be licensed Per-Device for Windows 7 Professional or a higher version or edition unless the device has an integrated screen that is 10.1 inches or less (diagonally).

Microsoft Desktop Optimization Pack. MDOP is a set of PC virtualization and management utilities. An important component, Application Virtualization (App-V), lets client applications run in an isolated environment on each user's computer, and it allows applications to be deployed and updated from centrally managed servers. Starting Aug. 1, 2015, existing and new ECS customers gained use rights for MDOP on local devices and within virtual desktops. Previously, MDOP was a separate, supplemental subscription.

Version upgrade and downgrade rights. Version upgrade and downgrade rights apply to both local Windows installations and virtual desktops. Licensed users have rights to the most recent version of Windows Enterprise or Pro editions released during the subscription term as well as any prior version of Windows Enterprise or Pro editions. For Windows 10, this means that users have rights to any Long-Term Servicing Branch (LTSB), past or present, as well as Windows Enterprise configured to use the Current Branch or Current Branch for Business servicing options (where acceptance of feature updates eventually becomes mandatory).

Office 365 Enterprise E3 Included

Office 365 Enterprise E3 combines client-side personal productivity applications, called Office 365 ProPlus, with Microsoft-hosted e-mail, conferencing, and other collaboration services built on the latest versions of Exchange Server, SharePoint Server, Skype for Business Server (formerly Lync Server), and other services.

Personal Productivity Applications

The Office 365 ProPlus component includes the right to install Office applications for Windows, OS X (Mac), iOS (iPad and iPhone), and Android on the user's devices.

Windows and Mac. Each subscription permits installation and use of the Office 365 ProPlus suite for Windows; this delivers the same set of individual desktop applications as the current version of the Office Professional Plus suite and includes the Office Multi-Language Pack. Additionally, users may use a Mac suite whose applications parallel the four (Excel, Outlook, PowerPoint, and Word) supplied in the current version of Office for Mac. Each subscription permits a user to activate up to five local instances of the PC or Mac software per license and to remotely access any Office 365 ProPlus instances running in server-based desktops hosted by the organization.

iOS and Android. Each subscription also allows the user to install native touch-based Office applications on up to five smartphones plus five tablets and to use them to create and edit documents for commercial purposes. (Note that these applications offer some editing capabilities free to consumers, but their terms of service require a business-focused Office 365 license for commercial use.)

Browser-based applications. Office 365 ProPlus also provides rights to Office Online, Microsoft-hosted applications that enable users to create and edit Office documents from a browser (without Office software installed on the device).

E-mail and Calendar

Office 365 Enterprise E3 includes Microsoft's premium hosted e-mail and calendaring service called Exchange Online Plan 2 (when sold stand-alone). It provides a comparable feature set to on-premises Exchange Server installations licensed with both the Exchange Standard Client Access License (CAL) and the Enterprise CAL. This includes Exchange Online Protection for malware detection, features for addressing or mitigating compliance and legal issues (such as analyzing message content for personally identifiable information and other sensitive data), and capabilities that allow organizations to phase out existing legacy voice-mail systems.


Office 365 Enterprise E3 includes several hosted collaboration-related offerings OneDrive for Business, SharePoint Online Plan 2, and Yammer. New technologies called Office 365 Groups and Delve, designed to address somewhat similar collaboration scenarios, were recently added.

OneDrive for Business enables mobile and roaming users to store files in document libraries and access and search them securely over the Internet without a virtual private network (VPN) connection. Users can also share files selectively with other users and maintain copies of files for offline use on multiple devices.

SharePoint Online Plan 2 delivers most SharePoint Server Standard and Enterprise CAL-level functions—including team collaboration, corporate portal hosting, enterprise search, and content management—but it lacks some business intelligence (BI), reporting, Web site customization, and server-side development capabilities that are available to SharePoint Server customers on-premises. However, SharePoint Online and the Microsoft-hosted OneDrive for Business have capabilities that are not available for on-premises such as external sharing features to aid selective sharing of documents with users who are not members of the organization.

Yammer Enterprise is a social networking service for organizations that offers collaboration spaces with groups, conversations, and data sharing that are similar to public social networking services, such as Facebook and Twitter.

Office 365 Groups is designed to offer collaboration spaces where group members can hold text discussions in a shared mailbox, maintain a shared calendar, and work on shared files in a SharePoint-like document library.

Delve presents personalized search results and views of content to users, based on user activity and other information collected by the Office Graph service, which infers relationships among users and content using a variety of data sources including access logs.

IM, Presence, and Conferencing

In Office 365 Enterprise E3, instant messaging (IM), presence status (online, busy, or away), and Web conferencing services are provided by Skype for Business Online Plan 2. It supports most but not all IM, presence, and Web conferencing capabilities of the comparable on-premises server software but not the telephony capabilities.

Some Advanced Capabilities Not Included

Though the above online services and technologies deliver a broad set of capabilities in their respective areas, they do not include all related functions that Microsoft makes available through online services. Use of some advanced capabilities outside the scope of Office 365 Enterprise E3 will require additional subscription purchases. One example is Exchange Advanced Threat Protection. It extends Exchange Online Protection to protect e-mail users against previously unknown malware as well as malicious URLs and other types of threats, which requires an Exchange Advanced Threat Protection User SL (or the upcoming Office 365 Enterprise E5 offering, which includes it).

Enterprise Mobility Suite Included

ECS contains EMS, which provides Microsoft-hosted directory, rights management, and mobile device management capabilities beyond those included with Office 365 E3.

Directory and Management Infrastructure

Azure Active Directory (AD) Premium is included with EMS. Like its established on-premises counterpart, Windows Server AD, it provides identity and access management (IAM) for users, devices, and applications.

The Azure AD Premium service goes beyond the IAM capabilities included with Office 365 Enterprise E3 (such as synchronization with AD on-premises and user self-service password reset) that are generally limited to use with Office 365 applications and services. Azure AD Premium adds unique features such as support for multifactor authentication to hosted services and on-premises applications that support it. Furthermore, Azure AD Premium expands capabilities in categories such as self-service, single sign-on, and reporting. For example:

  • Management policies can be used to determine which users can reset their password (under user self-service) and what credentials they must provide to reset it
  • Single sign-on capabilities can be used with an unlimited (rather than a fixed) number of hosted services and on-premises applications
  • A more expansive set of reports makes it easier to spot possible fraudulent use, unauthorized attempts at access, and malware attacks.

Rights Management

Azure Rights Management (RM) Premium is included with EMS. Based on its on-premises counterpart, Windows Server Rights Management Services, Azure RM Premium service is designed to allow organizations to comply with privacy and disclosure requirements. It provides encryption and decryption of e-mail, documents, and other types of business content to control access by users regardless of where the content resides.

Rights management protection is part of and travels with the content, which allows controlled access even if the content moves to a computer that is outside an organization's control. Though rights management restrictions can sometimes be circumvented by a determined user within the organization (for example, by taking screen shots while content is being viewed), they are generally sufficient to prevent casual or inadvertent disclosure.

Azure RM Premium extends Office 365 Enterprise E3's information rights management capabilities with several features. These include the ability to protect content on on-premises Windows Server file shares (that has been classified as requiring protection via administrator defined rules) as well as enhanced document usage tracking and revocation capabilities (in preview as of Aug. 2015).

Device Management

EMS includes Microsoft Intune, which allows organizations to manage hardware and software on Windows client PCs and mobile devices including Android and iOS. Its capabilities include antimalware, hardware and software inventories, device wipe, software updating, and policy management, though not all features are supported on the various mobile platforms. (Microsoft Intune has no direct on-premises counterpart, but the closest functional match is System Center Configuration Manager.)

Intune extends Office 365 Enterprise E3's basic mobile device management capabilities with features that include the following: a portal to allow users to enroll their own devices and self-provision approved corporate applications, tightened administrative control over applications (such as blocking users from removing content from managed applications via copy/paste), and remote device locking that limits the potential damage inflicted by lost devices.

Purchasing ECS

One general-purpose ECS User SL SKU, sometimes called the Full ECS User SL, is available through EA, EA Subscription, and starting Sept. 2015, Microsoft Products and Services Agreement (MPSA) contracts. In an EA or EA Subscription, the Full ECS User SL is generally purchased at the start of a brand-new contract, at contract renewal to account for additional users, or in the middle of an existing EA or EA Subscription contract as a way to satisfy True-Up requirements. There are also two special purpose User SLs, called Add-on and From-SA SKUs, exclusively for existing EA and EA Subscription "platform" customers who wish to leverage existing SA payments as part of a move from on-premises licenses to ECS.

Full ECS User SLs

Full ECS User SLs have the following attributes:

Prerequisites. Purchase of a Full ECS User SL requires that the user's primary work device already be licensed (Per-Device) for the Pro or Enterprise edition of Windows 10, Windows 8/8.1, or Windows 7. (The license can be OEM, retail, or volume licensing in origin.) Specifically, this is a prerequisite for the Windows Enterprise Upgrade User SL component in ECS. When this prerequisite cannot be met, Microsoft has processes that allow customers to buy a Virtual Desktop Access (VDA) Per-User subscription instead—this provides similar use rights as Windows Enterprise Upgrade User SL but at a higher fee. Under this special accommodation, the VDA Per-User, Office 365 Enterprise E3, and EMS User SLs are purchased separately (rather than as a single bundled SKU), but Microsoft applies a 5% discount to each to match the bundle discount provided by ECS.

SKUs and pricing. The volume license SKU is denoted by "Enterprise Cloud Suite (User SL)" in the Microsoft Product Terms and by "EntCloudSuite" on EA or EA Subscription price sheets and "Ent CldSte" in MPSA. The highest price a U.S.-based customer would pay is approximately US$32.50 per user per month, which represents a 5% savings compared to purchasing the Windows Enterprise Upgrade User SL, Office 365 E3 User SL, and EMS User SL separately. (The price quoted here incorporates the approximate 5% ECS price increase enacted Aug. 2015 to reflect features added to the Windows Enterprise Upgrade and EMS User SL components.)

Subscription duration. ECS subscription terms for EA customers generally must end at the same time as the customer's EA contract. For MPSA and EA Subscription contracts, the general rule is that the minimum ECS subscription commitment is 12 months.

Quantity. The MPSA program sets no ECS minimum purchase requirements, but terms of some EA and EA Subscription contracts may directly or indirectly dictate minimum ECS User SL purchase quantities. For example, an EA covering online services exclusively generally requires a 250 User SL minimum, and an EA or EA Subscription customer that uses ECS exclusively to satisfy organization-wide coverage requirements at a True-Up would need to buy an ECS User SL for all newly added users. No program places a limit on the number of Full ECS User SLs that customers can purchase, but there is no reason to buy more User SLs than there are users associated with the organization.

SA-related benefits. Until allowed to expire, Full ECS User SLs accrue all SA benefits related to Windows Enterprise Upgrade User SL. These include potentially high-value benefits such as virtual desktop rights, version upgrade rights, and MDOP rights (discussed earlier) as well as e-learning courses, in-person training courses, and technical support problem resolution incidents (for on-premises software). Although online services—including the Office 365 E3 and EMS offerings included as part of ECS—generally do not entitle customers to SA benefits per se, they do include similar benefits such as the right to use the latest versions of software and limited technical support. Note that all on-premises use rights included with ECS provide the right to use the latest version of on-premises software (i.e., new version rights), an attribute typically associated with SA.

Add-on and From-SA ECS User SLs

Existing Platform EA and Platform EA Subscription contracts generally license the Windows Enterprise Upgrade, the Office Professional Plus suite, and a Core or Enterprise CAL suite across the entire organization. Special-purpose Add-on and From-SA SKUs for ECS were created to motivate such customers to move from traditional on-premises products to ECS through special pricing and other benefits.

Under the Add-on licensing approach, customers gain ECS's Windows Enterprise Upgrade Per-User and online services use rights by layering new (Add-on) licenses on top of the SA-covered on-premises licenses they already own; SA coverage on these existing on-premises licenses must continue unabated.

Under the From-SA licensing approach, customers essentially swap their existing on-premises license SA coverage (and payments) for a discounted Full ECS User SL. To maintain the ECS From-SA User SL discount, a customer must continue the subscription without interruption.

Though the two approaches effect a similar outcome with respect to Windows Enterprise Upgrade Per-User and online services use rights, there are substantive differences regarding when they can be purchased and in what quantity, SKU pricing, and residual use rights for on-premises products.


The User SL licensing model is explained in "User Subscription Licenses: An Overview" on page 24 of the Oct. 2015 Update.

Licensing changes introduced with Windows 10, including the bundling of MDOP with SA, are covered in "Windows 10 Licensing Details Emerge" on page 20 of the Aug. 2015 Update.

Per-Device and Per-User Windows Enterprise Upgrade licensing options are compared in "Per-User Licensing Option Available for Windows" on page 12 of the Jan. 2015 Update and "Licensing Windows for Virtual Desktops" on page 28 of the Sept. 2015 Update.

The LTSB and other ways that Windows 10 will be serviced with updates, fixes, and new features is covered in "Windows 10 Release and Servicing Plans Outlined" on page 14 of the July 2015 Update.

Technical features included with the various Office 365-branded SKUs are covered in the Nov. 2014 Research Report "Office 365 Evaluation Guide." How these capabilities are expected to evolve is explained in the Office 365 Roadmap.

Licensing rules for Office Web Apps are covered in "Licensing Office Web Apps" on page 13 of the Aug. 2013 Update.

EMS technical features and capabilities are covered in detail in the Aug. 2015 Research Report "Enterprise Mobility Suite Evaluation Guide."

Product downgrade rights are covered in "Downgrades Are Key to License Compliance" on page 29 of the Aug. 2014 Update.

Report by: Rob Horwitz

Posted: September 7, 2015