What Is Microsoft 365 Education? A1, A3 and A5 Plans Explained

A1 is the entry tier, and Microsoft donates Office 365 A1 to eligible institutions at no cost for educators and students. Per Microsoft's service description it provides the Office 365 platform and Microsoft 365 for the web — meaning Word, Excel, PowerPoint and OneNote run in a browser rather than as installed applications — alongside Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Microsoft Stream, Planner and Forms. Classroom tooling such as Teams classroom experiences, OneNote Class Notebook, Sway, Forms and the accessibility checker is included at every tier, A1 upward.

What A1 does not include is the part district IT usually needs. Microsoft 365 Apps for enterprise — the installable desktop Office suite — is listed as not included at Office 365 A1. Neither is Intune for Education, so A1 on its own carries no Microsoft device-management entitlement. There is no Windows edition attached, no Defender antivirus or endpoint tier, no Litigation Hold or eDiscovery beyond basic content search, and no Bookings, audio conferencing or phone system. A1 is a solid collaboration and identity floor; it is not a management platform.

There is one important exception to the A1 pattern. Microsoft's Microsoft 365 table lists a separate A1 line — Microsoft 365 A1 for devices — which does include Microsoft 365 Apps for enterprise, Windows 11 Pro Education, Intune for Education, Remote Help and Minecraft Education. If someone in the procurement chain says "we are on A1" and also says the devices are Intune-managed, that distinction is almost certainly what they mean, and it is worth confirming before you spec anything.

At the Office 365 layer, A3 is chiefly about installed software and records management. It adds Microsoft 365 Apps for enterprise, upgrades Exchange Online and SharePoint Online from Plan 1 to Plan 2, and turns on Microsoft Bookings, Skype Meeting Broadcast, Litigation Hold, Microsoft Purview eDiscovery (Standard) including hold and export, and Office 365 Cloud App Security. For a school whose only complaint about A1 is that staff want Excel installed locally and legal wants a defensible hold capability, Office 365 A3 is the answer.

Microsoft 365 Education A3 is a materially bigger step, because it adds the whole device layer. It carries Windows 11 Enterprise, Intune for Education, Microsoft Entra ID Plan 1, Microsoft Defender Antivirus and Device Guard, Microsoft Defender for Endpoint Plan 1, Purview Information Protection Plan 1, Advanced Threat Analytics, Microsoft Endpoint Configuration Manager, Windows Server CALs, Universal Print, Clipchamp and Remote Help. It also enables the two education-specific deployment tools — the Take a Test app and Set up School PCs — that Microsoft lists as absent from every A1 line and from the Student Use Benefit columns.

In practical terms, A3 is the tier at which a district stops assembling management from parts. Enrollment, configuration profiles, application deployment, disk encryption policy, antivirus policy and conditional access all become one console rather than four. That is usually the reason districts move up, more than the desktop Office entitlement.

A5 is a security, compliance and analytics tier rather than a functionality tier — almost nothing a teacher touches changes between A3 and A5. On the Office 365 side, A5 turns on Audio Conferencing and Phone System, Power BI Pro, MyAnalytics, Purview eDiscovery (Premium), Purview Audit (Premium), Communication Compliance, Communications DLP for Teams chat, Customer Key, Customer Lockbox, Advanced Message Encryption and Privileged Access Management.

On the Microsoft 365 side, A5 raises identity to Microsoft Entra ID Plan 2, endpoint protection to Microsoft Defender for Endpoint Plan 2, and adds Microsoft Defender for Identity, Microsoft Defender for Office 365 Plan 2, Microsoft Defender XDR for Cloud Apps, Purview Information Protection Plan 2, endpoint data loss prevention and Insider Risk Management. Read as a list it looks like a security-operations product catalog, because that is essentially what it is.

The honest question for a district evaluating A5 is not whether the components are good but whether anyone is going to operate them. Defender for Endpoint Plan 2, Insider Risk Management and eDiscovery Premium generate work; they do not absorb it. Districts that already run a security operations function, or that buy managed detection and response, get value from A5 immediately. Districts whose security staffing is one person wearing three hats often get more out of A3 plus a managed service than out of A5 sitting unconfigured.

The single distinction that decides most A1-versus-A3 conversations is web versus desktop. Every tier from A1 up includes Microsoft 365 for the web, so Word, Excel, PowerPoint and OneNote are usable in a browser on any device with a supported browser and a network connection. Microsoft 365 Apps for enterprise — the installed suite that runs offline and supports the full desktop feature set, add-ins and VBA — appears from Office 365 A3 upward, and on the Microsoft 365 A1 for devices line.

That matters unevenly across a district. Elementary classrooms working in Teams and OneNote on shared devices rarely notice the difference. Business office staff running complex workbooks, special-education teams working with add-ins, and anyone who needs to work with a flaky or absent connection notice immediately. The usual outcome is a mixed estate: web-tier licenses for the student body, a desktop-capable tier for staff who need it. Microsoft's plan structure supports that split rather than forcing one tier across every seat.

Microsoft's education plans are not licensed identically for staff and students, and the mechanism is the Student Use Benefit. Microsoft's service description publishes separate comparison columns for Office 365 A3/A5 Student Use Benefit and for Microsoft 365 Education A3 and A5 Student Use Benefit, and the contents differ from the equivalent faculty plan.

The differences are specific rather than cosmetic. In the Microsoft 365 tables, the A3 and A5 Student Use Benefit columns carry Windows 11 Enterprise, Intune for Education, Microsoft 365 Apps for enterprise, Entra ID Plan 1 (Plan 2 at A5) and Clipchamp — but Microsoft lists Learning tools, Take a Test and Set up School PCs as not available in the Student Use Benefit columns, along with Microsoft Defender Antivirus, Device Guard and both Defender for Endpoint plans. Universal Print appears in the Student Use Benefit columns with a footnote reading zero print jobs included. In the Office 365 tables, Microsoft notes that Defender for Office 365 Plan 2 is not available with the Office 365 A3 Student Use Benefit.

The planning consequence is that a district cannot assume the security controls it configured for staff devices apply automatically to student devices covered under a Student Use Benefit. Check the specific column, not the plan letter, before you write an endpoint-security standard into a device specification — and confirm current entitlements with Microsoft or your licensing partner, because the tables are revised.

Once the tier is settled, three hardware questions follow directly from it. The first is Windows edition: Microsoft 365 A1 for devices carries Windows 11 Pro Education, while A3 and A5 carry Windows 11 Enterprise. Devices ordered with Windows 11 Pro or Pro Education are the normal starting point for upgrade entitlement, and buying a Home-edition consumer machine into a managed fleet creates avoidable rework. Whatever edition you land on, the hardware still has to meet Windows 11 system requirements, including TPM 2.0 and Secure Boot — a constraint that quietly disqualifies a slice of older estates.

The second is enrollment. If the plan includes Intune for Education, the fleet should arrive registered for zero-touch provisioning so devices enroll on first boot rather than being touched individually by staff. That is a purchasing decision made at order time with the manufacturer and reseller, not something that can be retrofitted cheaply across a thousand machines.

The third is the specification floor. A web-first tier tolerates modest memory and storage; a desktop-applications tier does not. If A3 or A5 puts installed Office, Teams and a security agent on the same machine, 8 GB of memory is the realistic minimum for staff devices and 16 GB is the comfortable one, with SSD storage rather than eMMC. Send us the plan you have settled on along with the seat counts and we will spec and quote the matching hardware — the licensing itself stays with Microsoft or your licensing partner.