Summary
Microsoft’s February 2026 Product Terms update introduces two notable changes: security add-ons for Microsoft 365 E3 and a new Dragon Copilot SKU for physician practices.
Microsoft 365 E3 customers can now purchase Defender for Endpoint P2 and Entra ID P2 as standalone add-ons
Dragon Copilot Physician Practice Per User added to Microsoft Customer Agreement (MCA) availability with tenant isolation requirement
The changes are effective 1 February 2026.
Microsoft 365 E3 Security Add-ons
Microsoft has added two new SKUs to the Microsoft 365 Product Terms: Microsoft Defender for Endpoint P2 Add-On for Microsoft 365 E3 and Microsoft Entra P2 Add On for Microsoft 365 E3. Both appear in the MCA and Enterprise Agreement/Enterprise Agreement Subscription (EA/EAS) availability tables and License Prerequisites sections.
Implications for E3 Customers
Previously, organisations wanting these security capabilities had limited options. Microsoft Defender for Endpoint P2, which provides endpoint detection and response, automated investigation, and threat hunting, required either upgrading to Microsoft 365 E5 or purchasing the Microsoft Defender Suite. Similarly, Microsoft Entra ID P2, which adds risk-based conditional access, privileged identity management, and access reviews, required E5 or the Enterprise Mobility + Security E5 suite.
Before February 2026, Defender for Endpoint P2 and Entra ID P2 were only available via Microsoft 365 E5 or security suites.
The new add-ons create a middle path. E3 customers can now purchase individual security components without committing to a full E5 upgrade or the broader Defender or Enterprise Mobility + Security (EMS) suites. The add-ons require Microsoft 365 E3 as a prerequisite, meaning they cannot be purchased standalone.
Practical Considerations
The add-ons address a common scenario where organisations need specific security features but not the full E5 bundle. An organisation that needs Defender for Endpoint P2’s threat hunting capabilities but has no use for Power BI Pro, Phone System, or the other E5 components can now get precisely what they need.
Microsoft hasn’t published add-on pricing. When evaluating the economics, compare the add-on costs against the E3-to-E5 upgrade cost of approximately $21 per user per month (based on list prices effective July 2026). For organisations needing both Defender for Endpoint P2 and Entra ID P2, along with other E5 components, the full upgrade may still make sense.
The add-ons appear in both MCA and EA/EAS availability tables, so they should be available through both agreement types and associated channels.
Dragon Copilot: Physician Practice Per User
Microsoft has added Dragon Copilot Physician Practice Per User to the Dragon Copilot Product Terms under MCA availability. More significantly, a new clause specifies that Physician Practice Per User licences cannot be deployed in the same tenant as other Dragon Copilot licence types.
The Tenant Isolation Requirement
The new Product Terms clause reads: “Customers may not deploy Dragon Copilot Physician Practice Per User Licenses in the same tenant as other Dragon Copilot Licenses.”
This restriction means healthcare organisations using Physician Practice Per User must maintain a separate Entra ID tenant from any operations using other Dragon Copilot licence types such as Physician Per User, Physician Flex, or Nurse Per User. Microsoft has not explained the rationale for this requirement. The practical implications depend on an organisation’s structure and existing deployments.
What Is Physician Practice Per User?
Microsoft’s Dragon Copilot licensing guidance describes four licence types: Physician Per User (flat monthly subscription covering all features), Physician Flex (subscription plus Azure consumption), Nurse Per User, and Physician Practice Per User. The licensing guidance describes Physician Practice Per User as equipping users to run most Dragon Copilot features including front-end speech, ambient features, and GenAI features.
Given the name and tenant isolation requirement, Physician Practice Per User likely targets smaller healthcare organisations, individual practices, or practice groups that operate independently from larger health systems. Such organisations often have their own IT infrastructure and would naturally use separate tenants anyway.
Impact on Existing Deployments
Organisations currently using Dragon Copilot under Physician Per User or Physician Flex licences and considering Physician Practice Per User for a subset of clinicians face a structural decision. They cannot mix these licence types in a single tenant. If the use case requires both, the organisation would need separate tenants with associated identity management complexity.
For new deployments evaluating Dragon Copilot for the first time, the choice of licence type now carries tenant architecture implications. Understanding which licence type best fits the organisation’s needs before deployment avoids later restructuring.
🖐 Get independent guidance on Microsoft Product Terms and licensing changes. Learn more: Microsoft Licensing Services for Enterprises.
If you need help evaluating E3 security add-ons versus an E5 upgrade, or understanding Dragon Copilot licensing for your healthcare organisation, get in touch. We don’t sell Microsoft licences or cloud services, so our advice is independent.