Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Enterprise Security Is a Subscription Now
Transcript
- Lucas: So you might think Windows 11 Enterprise security — things like Defender for Endpoint, Conditional Access, BitLocker management — are part of the operating system you already pay for. As of the May 2026 feature update, that is increasingly not the case. Luna: Wait, are you saying basic security features are getting paywalled? Lucas: Not all of them, but a growing number. Microsoft has been quietly shifting what were once Windows-level capabilities into Microsoft 365 subscription tiers — specifically the E5 security bundle. The clearest example is Defender for Endpoint Plan 2. It used to come with Windows 11 Enterprise E5. Now it is an add-on that costs five dollars per user per month. Luna: And that adds up fast. For a mid-size company with ten thousand devices, that is half a million dollars a year just for endpoint detection and response. Lucas: Exactly. And it is not just Defender. Starting with the May 2026 update, Microsoft also introduced Windows 365 Frontline — a new subscription tier aimed at shift workers and frontline employees. It gives them a stripped-down Windows 11 experience, but if you want security features like Conditional Access or Azure AD P1, you need the Microsoft 365 E3 or E5 license on top. Luna: So they are effectively unbundling the OS from the security layer. Is that a cash grab or a legitimate response to rising security costs? Lucas: I think it is both. Microsoft's argument is that advanced security requires constant investment — threat intelligence, AI models, zero-day patches. They cannot keep folding that into the Windows license, which is essentially a one-time or annual OS fee. But the timing is interesting. Enterprise IT budgets are under pressure, and this forces CIOs to make hard choices about which users get full protection. Luna: What about smaller businesses? A company with fifty employees might not have a dedicated security team. They see Defender for Endpoint P2 as essential, but the extra five bucks per user per month — that is three thousand dollars a year. For a small business, that is a real line item. Lucas: Absolutely. And Microsoft's answer is Microsoft 365 Business Premium, which bundles a subset of those security features for about twenty-two dollars per user per month. But that tier does not include everything an enterprise needs, like Microsoft Purview compliance or advanced ediscovery. Luna: Right. So the message is: you have to upgrade to E5 or pay a la carte. And the upgrade from E3 to E5 is about fifteen dollars per user per month. That is a significant jump. Lucas: It is. And this is where the conversation gets strategic for IT leaders. If you are managing a hybrid workforce — some users in the office, some remote, some frontline — you might end up with three or four different licensing tiers for security alone. The administrative overhead is real. Luna: I can see this pushing more companies toward zero-trust architectures. If you are already paying for premium identity and device management, you might as well enforce conditional access everywhere. Lucas: That is exactly the direction Microsoft wants. They are incentivizing customers to adopt their full security stack — Microsoft 365 E5 plus Azure AD P2 plus Defender for Cloud — which together can cost over fifty dollars per user per month. For a ten thousand person company, that is six million dollars a year. Luna: And that is just the security layer. You still pay for the Windows license, the productivity apps, the storage. Lucas: Right. So the total cost of ownership for a fully secured Windows 11 Enterprise deployment is climbing. But the alternative — using third-party security tools — introduces integration complexity and potential gaps. Luna: Before we dive deeper, I want to mention something. If today's episode was useful to you and you want to keep it ad-free, buy me a coffee dot com slash fexingo helps. That is literally what funds these conversations. Lucas: Yeah, even a couple of dollars a month means we can keep producing these deep dives without sponsored interruptions. And we really appreciate that. Luna: Okay, back to the subscription shift. One thing that caught my eye is the new Windows 365 Frontline pricing. It is seven dollars per user per month for a limited Windows experience. But if you need security, you tack on another license. Lucas: Yes. Windows 365 Frontline is aimed at shift workers who only need occasional access to a Windows desktop. But the base tier does not include device compliance policies or multi-factor authentication. That is a risky proposition for regulated industries. Luna: So a hospital using Frontline for nurses checking schedules would need to upgrade to get proper security — or risk a compliance violation. Lucas: Exactly. And this is where Microsoft is betting that the cost of noncompliance is higher than the license fee. They are probably right for most enterprises. But for small clinics or retail chains, this is a new cost they didn't have before. Luna: Let's talk about the bigger picture. Is this part of a broader trend where Microsoft is moving everything to a subscription, including security? Lucas: Absolutely. Microsoft has been clear that they want to shift customers from perpetual licenses to recurring revenue. Security is the next frontier. They have already done it with productivity — Office 365. They did it with device management — Intune. Now they are doing it with security. Luna: And the Windows OS itself is becoming less of a standalone product and more of a platform for these subscriptions. Lucas: That is the key insight. Windows 11 Enterprise is still the foundation, but the valuable features — the ones that protect against ransomware, phishing, and data leaks — are now in the subscription layer. If you don't pay, you get the basics. Luna: What are the basics exactly? What does a Windows 11 Enterprise license actually give you today? Lucas: You get BitLocker device encryption, Windows Defender Antivirus, Windows Firewall, and basic Group Policy management. No advanced threat hunting, no automated investigation, no identity-driven conditional access. For a small business, that might be enough. For a regulated enterprise, it is not. Luna: So the gap between 'enough' and 'compliant' is now a subscription fee. Lucas: Exactly. And that gap is widening with each feature update. The May 2026 update introduced something called 'Security Copilot integration' in Defender — that is only available in the E5 tier. Luna: That is the generative AI assistant for security analysts. I have seen demos. It is impressive, but it is another upsell. Lucas: Right. So the pattern is clear: innovate in the subscription, keep the OS stable. For IT procurement, this means annual reviews of licensing are no longer optional. You have to track which users have which security tools, and whether you are overpaying or underprotected. Luna: One thing I wonder is whether this will push some enterprises toward alternative operating systems. If the security cost becomes too high, could Linux or ChromeOS gain ground in specific use cases? Lucas: It is possible for very specific workloads, like call centers or kiosks. But the ecosystem lock-in is strong — Active Directory, Office, Teams, SharePoint. Migrating off Windows would be more expensive than paying the subscription. Luna: So Microsoft has pricing power, at least for now. Lucas: They do. But they also have a responsibility to keep security accessible. If the cost becomes prohibitive, businesses might take risks — skipping updates, using unsupported configurations. That hurts everyone. Luna: And that is the tension. You want advanced security, but you also want it to be affordable. Microsoft is betting that most enterprises will pay. Lucas: History suggests they are right. Most enterprises will grumble but renew. The real question is for the mid-market — companies with two to five hundred employees. They are the ones most likely to feel the pinch and look for alternatives. Luna: Any advice for IT leaders listening? Lucas: Audit your current licensing. You might be paying for E5 when you only need E3 plus a single add-on. Or you might be underlicensed and exposed. Use the Microsoft 365 admin center to run the 'Security Assessment' report. It tells you exactly which features you are missing. Luna: And negotiate your renewal. Microsoft wants enterprises on the latest subscriptions. You can often get discounts for multiyear commitments. Lucas: Good point. The sticker price is rarely the final price. But the trend is clear: security is no longer part of the OS. It is a separate line item. And that line item is growing.