NHSmail Microsoft 365 Licence Matrix

The below document sets out the supported M365 and Online Services licence types on the NHSmail platform. It also covers the differences between nationally provided licences, Top-Ups and Add-Ons.

‘Top-up’ licences refer to the range of base licence product alternatives (outside of the nationally allocated licences) offered by Microsoft and supported by the NHSmail Platform. ‘Add-on’ licences refer to application specific features that can be applied on top of the allocated base licences- these too can be procured and onboarded to the tenant.

Supported Microsoft Licences

Please see the below table to understand what is supported on the NHSmail platform. Supported means that these licence types can be onboarded onto the NHSmail tenant and allocated to your organisation for user provisioning.

Licence Type Category Supported
M365 E3 Frontline Worker Restricted (without Apps for Enterprise) National provision for NHSmail Enhanced Service Organisations
F5 Security and Compliance* National provision for NHSmail Enhanced Service Organisations
M365 F3 FUSL Sub Per User (Without Windows & EMS except AADP) National provision for NHSmail Standard Service Organisations
Azure Active Directory P2 K SU Azure Active Directory P1 K National provision for NHSmail Standard Service Organisations
Exchange Online P2 SU Exchange Online Kiosk Per User National provision for NHSmail Standard Service Organisations
Defender for Office 365 F2 National provision for NHSmail Standard Service Organisations
Office 365 E1 Top-Up (not required for Enhanced Service Organisations)
Office 365 E3 Top-Up
Office 365 E5 Top-Up
Microsoft 365 E3 Top-Up
Microsoft 365 E5 Top-Up
Enterprise Mobility + Security E3 Add-On (not required for NHSmail Enhanced Service Organisations)
Enterprise Mobility + Security E5 Add-On (not required for NHSmail Enhanced Service Organisations)
Azure Active Directory (AAD) P2 Add-On (Only needed for Enhanced Service Organisations with a BYOL base)
M365 Apps for Enterprise (*User only) Add-On
Microsoft Audio Conferencing (Dial-in) Add-On
Microsoft Teams Room Add-On
PowerBI Pro Add-On
Power BI Premium Per User Add-On
PowerBI Premium (Capacity Plans only) Add-On
Visio Plan 1 Add-On
Visio Plan 2 Add-On
Power Apps Per App Add-On
Power Apps Per User Add-On
Power Automate Per User Add-On
Power Automate Per Flow Add-On
Power Automate Attended RPA Add-On
Project Plan 1 Add-On
Project Plan 3 Add-On
Project Plan 5 Add-On
SharePoint Online Storage Add-On
Microsoft Teams Phone System (MCOEV) Add-On
120 minute Domestic Calling Plan (MCOPSTN_5) Add-On
240 minute Domestic Calling Plan (MCOPSTN_6) Add-On
1200 minute Domestic Calling Plan (MCPPSTN_1) Add-On
Domestic and International Calling Plan (MCOPSTN2) Add-On
Microsoft Teams Phone with Calling Plan (country zone 1 – UK/Canada)) Add-On
Microsoft Teams Premium Add-On
Microsoft Teams Premium (Intelligent Recap) Add-On
Microsoft Teams Audio Conferencing Add-On

*For F5 security and Compliance details regarding specific feature configuration and enablement will be shared with Local Administrators via the existing BAU channels (webinars, support site, release notes). These features will be prioritised in alignment with the NHSmail security roadmap.

NHSmail Nationally Provided Licences

There are two national licence offerings: the NHSmail Standard Service and the NHS Enhanced Service. The licence offering for each service has been assigned based off the user requirements for the organisation. For more detail on the offering assignment please see NHSmail Licence Overview and Migration Approach – NHSmail Support. Each organisation will only be part of one service with no action required of LAs to set this up. The nationally provisioned licences for each are as follows:

NHSmail Standard Service:

  • M365 F3 FUSL Sub Per User (Without Windows & EMS except AADP)
  • Azure Active Directory P2 K SU Azure Active Directory P1 K
  • Exchange Online P2 SU Exchange Online Kiosk Per User
  • Defender M365 F2 Sub Per User

NHSmail Enhanced Service:

  • Microsoft 365 E3 Frontline Worker (Restricted – without M365 Apps for Enterprise)
  • F5 Security & Compliance*

*Details of specific feature enablements will be shared via existing LA collaboration channels.

Local administrators can identify a national licence subscription in ‘User Policies’ within the portal via the below naming convention:

  • “ODS Code.Licence.NationalPolicy”

More details in managing these policies can be found here – User Policy Management Guide.

How to check my organisation(s) assigned NHSmail Service:

Local Administrators can follow the steps below to confirm their organisation’s NHSmail Service profile:

  1. Login to the NHSmail portal with your nhs.net credentials and visit Admin > User Policy Management
  2. Create a new policy by clicking on Add > Create User Policy
  3. Using the drop-down menu, select the organisation you wish to check
  4. Using the drop-down menu, view all base licences available to your organisation. In addition to top-up licences, this list will include one nationally provisioned licence type:
    • If the available national licence reads ‘Organisation – National – Microsoft F3 – Date’, this means the organisation will receive the NHSmail Standard Service
    • If the available national licence reads ‘Organisation – National – Microsoft E3 – Date’, the organisation will receive the NHSmail Enhanced Service

Top Up Licence Types

If organisations would like access to services beyond those nationally provided, they have the option to procure Top-Up Microsoft Online Services licences from their licence reseller or Microsoft Licencing solution provider LSP. E1, E3 and E5 will provide users with larger mailboxes (50GB & 100GB respectively), as well as other feature sets which are further explained in the Functional Comparison documentation.

Organisations can follow the on-boarding guidance to load these Top-Up licences into the NHSmail tenant. Once provisioned, when creating User Policies – Local Administrators will have the option to select the E1, E3 or E5 subscription in the ‘Base Licence’ field.

Local Administrators can identify this subscription in User Policies through the below naming convention:

  • Base Licence: ORG – ODS – Local – Office 365 Enterprise E1/3/5 – Date
  • Base Licence: ORG – ODS – Local – Microsoft 365 E3/5 – Date

The applications available through the Nationally Provided and Top-Up licences can be toggled on and off when setting up a User Policy.

Add-On Licence Types

Like Top-Ups, organisations can procure Add-On licences and allocate to users where appropriate. The same on-boarding guidance can be followed to onboard these licences onto the NHSmail tenant.

There are two key differences that Add-On licences have compared to Top-Up licences.

  1. Add-On licences have to be applied in addition to a Base Licence.
  2. When the Add-On is added to a policy, all the applications and functionality provided by the Add-On will be applied automatically.

There is currently no option to toggle specific Add-On features on/off. This is particularly relevant for the Apps for Enterprise Add-On, further information is included below:

Important Note

Apps for Enterprise: When applied as an Add-On, all the different M365 applications included within this licence type will be enabled by default. These are included below and are not currently configurable through toggles:

  • Forms (Plan 1)
  • Office Web
  • Office Desktop
  • Sway
  • OneDrive for Business (Plan 1)
  • Whiteboard

It is the local organisation’s responsibility to determine if it is appropriate to enable this functionality for their users subject to local risk appetite and Data Protection policies on offshoring. Applications such as Whiteboard and Sway host data outside of the UK, this is not an exhaustive list and full details can be found here.

Please consult Microsoft documentation and your licence reseller for further information on procuring Microsoft 365 Add-On licence types.

For more guidance on managing and allocating access to M365 licences, Top Ups and Add-Ons please visit the User Policy Management Guide.

Important note:

As per the January 2024 renewed licencing agreement between NHSmail and Microsoft, there are some top-up and add-on licences which are no longer required. For more information please visit the on-boarding guidance.


If you already have Teams Rooms Standard licences on your active Enterprise Subscription Agreement (ESA) you are able to purchase more and these will work with resource mailboxes. It is likely that the majority of NHS organisations have renewed or are renewing their ESAs and must now purchase Teams Rooms Pro.

Teams Rooms Pro is not natively supported in the Portal. If you have purchased this licence please review the following guidance – https://support.nhs.net/knowledge-base/adding-surface-hub-to-ms-teams/

Un-supported services

The NHSmail M365 Service doesn’t currently support use or integration with the below subscriptions or services. These include, but are not limited to:

• Azure Information Protection
• Office Store
• Dynamics 365

Last Reviewed Date 12/06/2024


Updated on 20/06/2024

Related Articles

Need Support?
Can’t find the answer you’re looking for? Don’t worry we’re here to help!
Contact Support
back to top