Secure productivity growth opportunities data in AI Business Solutions & Security Insights

Appropriate roles: Report viewer | Executive report viewer

With the further evolution of the AI Business Solutions & Security Insights, Microsoft has broadened its Land and Expand (LXP) based machine learning models to encompass all Microsoft 365 secure productivity workloads offering enhanced data insights for marketing, sales, and customer success organizations to upsell and cross-sell Microsoft products along the entire customer life cycle. Hundreds of signals such as marketing engagement, licensing, and usage are distilled into actionable insights at account level.

Key LXP models include several main types:

1. Account classification and targeting across key Modern Work products.

2. Usage-to-Revenue model for Secure Productivity (Office365 and Microsoft 365 business), which identifies accounts ready for upsell and needing adoption acceleration.

3. Propensity to attach and expand priority E5 Security products across Microsoft Purview and Defender.

4. Whitespace and potential revenue estimates at the account level.

5. Workload level incentive eligibility to propel adoption initiatives.

Foundational principle

The foundational principle involves defining the account position for Secure Productivity, which indicates a "center of gravity" where most account licenses are. At a higher level, there are three key motions:

1. Upsell to Microsoft 365 E3 (E3)

2. Upsell to Microsoft 365 E5 (E5)

3. Microsoft 365 E5 license expansion

A machine learning Usage-to-Revenue model for each of the three motions enables the identification of accounts that are prepared for upselling, based on an overall usage score. These models also offer insights into which workloads fall below the thresholds required for upselling or expansion.

The following image shows the Secure Productivity customer journey. Usage insights help determine who should engage to help customers move up to the next level.

More intelligent insights

AI Business Solutions & Security Insights now has more Secure Productivity insights for partners to accelerate upsell.

New insights

1. Upsell opportunities (E3, E5, E5 expansion)
The high-level LXP account classification for Secure Productivity is available at tenant level to outline target upsell motions, whether it's upsell to E3 or E5, or E5 license expansion. The tenants are resurfaced in corresponding opportunity tabs - E3, E5, and E5 Expansion:

• E3 Opportunities tab
  Contains tenants who primarily have Office 365 licenses. Any usage and upsell motions for these tenants are meant to encourage E3 license update. They're part of the E3 pipeline because any usage and upsell motions for these tenants are meant to encourage E3 license uptake.

• E5 Opportunities tab
  Includes tenants who primarily have E3 licenses. They're likely part of the E5 pipeline since any usage and upsell motions for these tenants are meant to encourage E5 license uptake.

• E5 Expansion Opportunities tab
  Comprised of tenants with most licenses in the E5 position. They're part of the E5 expansion pipeline because any usage motions for these tenants are meant to encourage further expansion of E5 licenses. Learn about turning AI Business Solutions & Security Insights into customer-centric data security conversations and more at https://aka.ms/ASPXDataSecurityPlaybook.

2. Upsell Readiness and Tipping Points
For each sales motion, Microsoft's data scientists have identified a set of workloads that predict upsell readiness. In 2025, the biggest change is the inclusion of Security workloads for customers in scope for E3 upsell.

When a certain combination of workloads meets the tipping points, the tenant as a whole is then categorized as ready for upsell or above threshold overall for a specific upsell motion. Learn more about the LXP Tipping Points.

Figure 1: LXP Opportunity Calculation

Callouts:

• Microsoft Data Science found that, for customers with predominantly Office 365 licenses, it's still important to focus on their fewer E3 licenses. Improving usage on their fewer E3 workloads such as Microsoft Entra ID, DNR, MIP, and DLM are critical to promoting full E3 upsell.

• Analysis is separate for SMC and Enterprise customers.

3. Workload Monthly Active Usage (MAU) and Paid Available Users (PAU) definitions
Aligned with the rest of Microsoft, the Land and Expand Growth Propensity Model has a specific set of definitions for what counts as MAU and PAU for workloads.

• These definitions vary from the Claim Partner of Record (CPOR) data definitions used for the Security Usage Incentive Engagement within Microsoft Commerce Incentives (MCI).

• The Opportunities tabs all use the latest definitions aligned across Microsoft Field. However, the CPOR definitions of MAU and PAU are still available in the Tenants tab. Also, High Water Mark (HWM) data, compensable units, etc. are available as fields that can be added into the Opportunities tabs, but are hidden from view (by default). For more information, see the LXP Workload Definitions.

4. Tenant Recommendations and Upsell Destination
Depending on the tenants licensing profile, it may have different upsell destinations. These upsell destinations are recommended as the next best way to grow revenue at the customer. Note, these recommendations are only surfaced if the tenant is healthy (for example, upsell-ready).

LXP Position	Box	Primary Upsell
Office 365	Office 365 E1	Microsoft 365 E3 without Google signals, else OE1+EMS/ OE1 Plus
Office 365	Office 365 E3	Microsoft 365 E3
Office 365	Office 365 E1+Enterprise Mobility + Security /Office 365 E1 Plus	Microsoft 365 E3
Office 365	Office 365 E1+Enterprise Mobility + Security	Microsoft 365 E3 + Mini-bundles (E5 Security/E5 Compliance)
Office 365	Business Basic	ME3 for accounts with >=300 seat count, else Business Standard + Copilot for Business
Office 365	Business Standard	ME3 for accounts with >=300 seat count, else Business Premium + Copilot for Business
Microsoft 365 E3	Business Premium	ME3 + Mini-bundles (E5 Security/E5 Compliance) for accounts with ≥300 seats, else Business Premium + Copilot for Business + Purview bundle
Microsoft 365 E3	Microsoft 365 E3	Microsoft 365 E5
Microsoft 365 E3	Microsoft 365 E3 + Mini-bundles	Microsoft 365 E5
Microsoft 365 E5	Microsoft 365 E5	ME5 - Seat Expansion

Customer data associations

Data in AI Business Solutions & Security Insights is limited to customers with whom partners have an established compliant association. A compliant association requires customer consent for data sharing, with availability of an opt-out option. Anonymized and derived data is only shared with customer consent. The specific associations configured in AI Business Solutions & Security Insights for data sharing purposes are outlined in the following table.

Note

The Secure Productivity Opportunities tab surfaces data for customer tenants that meet the following licensing criteria:

• Enterprise customers with more than 150 Microsoft 365 licenses, or
• Small Medium Enterprise & Channel (SME&C) with more than 25 Microsoft 365 licenses.

Association	Description
CPOR	If partners claimed one or more workloads via CPOR with a customer, they can view data in AI Business Solutions & Security Insights across all workloads and SKUs for the associated tenant. Once a new CPOR claim is completed, data will be available in AI Business Solutions & Security Insights in alignment with the timing outlined in this Data Refresh article.
Cloud Solution Provider (CSP)	If partners are the transacting partner as stated via an existing CSP association with a tenant, they can view data across all workloads and SKUs for the associated tenant. This includes: - CSP Tier 1 and Tier 2 associations - Monthly and annual billing cycles For new CSP associations, data will be available in AI Business Solutions & Security Insights in alignment with the timing explained in this Data Refresh article.
Enterprise Agreements (EA)	If a partner is the Licensing Solution Provider (LSP) transacting on an EA with a customer, the partner can only see the EA renewal dates. Other data is currently not provided due to lack of customer consent for data sharing.

We're assessing and expanding to other association types as customer consent is obtained and will update this section when new associations are added to AI Business Solutions & Security Insights.

Data dictionary

As a result of the enhancements to the model and UI, the data dictionary now has richer data and more insights.

Following is a view of the data available in the E3 Opportunities, E5 Opportunities, and E5 Expansion tabs:

Image 1 of 2

Image 2 of 2

Details about these screenshots are included in the following sections.

Definitions

The following table describes the columns that are numbered in the preceding screenshot:

Name	Definition
E3, E5, and E5 Expansion Opportunities tabs	The three tabs display a pipeline of customers that are ready for E3 and E5 upsell or expansion, and customers that need usage engagements to optimize before upsell. It utilizes CPOR and CSP associations with corresponding customers to build the pipeline. It's important to understand that each pipeline view in AI Business Solutions & Security Insights only displays the workloads in scope for the E3, E5, or E5 Expansion as described in Figure 1: LXP Opportunity Calculation. For example, for E5 Expansion opportunities partners won't find details of the Teams workload in the corresponding AI Business Solutions & Security Insights opportunity page.
KPI tile: Tenants	This column shows the pipeline of customers, measured in tenants, with opportunities to get to a healthy state or upsell to the corresponding SKU.
KPI tile: Paid Utilization	The total ratio of MAU divided by PAU, capped at 100%, for all tenants and Land and Expand Growth Propensity Model workloads within the pipeline. Land and Expand Growth Propensity Model workloads are specifically identified workloads that have high correlation to upsell.
KPI tile: Usage Whitespace	The total PAU - MAU for all tenants and Growth Propensity Model workloads within the pipeline, with a minimum of 0. This metric quantifies the whitespace available to grow usage.
KPI tile: Upsell Ready	Tenants within optimal usage threshold for an upsell conversation. When a combination of workloads within a tenant is healthy, then the tenant as a whole is classified as upsell ready. Not all workloads need to be healthy for a tenant to be upsell ready.
KPI tile: Unhealthy	Tenants with usage who don't meet usage criteria to be ready for upsell, need to grow usage before they're likely to upsell. When a combination of workloads within a tenant is unhealthy, then the tenant as a whole is classified as unhealthy. Not all workloads need to be unhealthy for a tenant to be unhealthy.
KPI tile: At Risk	Tenants at risk for license loss due to extremely low usage patterns. This metric is only available for E5 opportunities and E5 expansion opportunities. When a combination of workloads within a tenant is at risk, then the tenant as a whole is classified as at risk. Not all workloads need to be at risk for a tenant to be at risk.
KPI tile: E7 Upsell-ready	Tenants that meet criteria for an E7 upsell motion. These tenants have been identified based on their security licensing as well as agent intensity, which includes foundry signals. This KPI tile includes all E7 targeting scenarios, including E5 customers with low agent intensity, E5 customers with medium/high agent intensity, and E3 customers with high/medium agent intensity.
KPI tile: Potential Earnings	Potential earnings from all tenants via MCI engagements and CPOR usage incentives. This isn't a precise number, but more an estimate of incentive earnings. This estimate isn't simply the sum of potential earnings in the following table, because one MCI engagement can span multiple workloads. Thus, partners can't sum potential earnings across workloads, only across tenants.
Tenant Name	Name of the customer tenant as entered by the customer when the tenant was first created.
Tenant ID	Unique identifier of a customer tenant that contains all the unique users, domains, and subscriptions, and is administered by the tenant admin.
Tenant Country/Region	The country/region assigned to the tenant when the tenant was first created.
Tenant Segment	Indicates how Microsoft classifies the customer tenant segment.
Customer Sub-Segment	Represents Microsoft’s standardized customer sub-segment classification at the customer Top Parent Organization ID (TPID) level. This is used to group customers into comparable market tiers for segmentation, targeting, and prioritization.
Industry/Vertical	Indicates the customer’s primary industry or vertical at the customer TPID level, enabling industry-specific segmentation, filtering, and go-to-market analysis within ASPX.
TPID	The TPID is associated with the Tenant ID. For any given Tenant ID on any given date, there's only one customer TPID.
Customer Name	Name of the customer TPID.
EA Renewal	Month when the Microsoft Enterprise Agreement (EA) is up for renewal. This data only shows up if the tenant has the partner name listed as the EA reseller.
Largest Seat CSP Renewal	Month when the largest (by license count) Cloud Solutions Provider (CSP) subscription is up for renewal. This data is only visible if the tenant has the partner name listed as the CSP provider for the subscription.
Dominant SKU Group	Based on the tenant's largest license by license count, a categorization of the customer into the following: - Business Basic (BB), Business Standard (BS), Business Premium - OE1, OE3 (Office 365 E1, Office 365 E3) - OE3+EMS (Office 365 E3 + Enterprise Mobility + Security) - OE1+EMS / OE1 Plus (Office 365 E1 + Enterprise Mobility + Security) - ME3 or ME3 + Mini-bundles (Purview Suite) - ME5
Total M365 Seat Count	Total information worker and frontline worker licenses in the tenant, regardless of dominant license profile. This gives a sense of total whitespace available to upsell to the next land and expand destination.
Tenant Health	Not to be confused with Workload Health, this refers to the tenant’s overall status—Healthy, Unhealthy, or At Risk, aligned with the KPI tiles.
Tenant Recommendation	Next step with the tenant, defining what products to upsell if the tenant is healthy, or to drive usage if the tenant is unhealthy or at risk.
E7 Opportunity	This field, which is also a clickable flyout panel, describes the E7 opportunity, which can be one of three different targeting scenarios: - ME5 with H/M agent intensity: Tenants with E5 and AI maturity, strong candidates for E7 upsell now, and are top priority. - ME3 with H/M agent intensity: Tenants with AI maturity, but not primarily on E5 licenses. These tenants are second in priority. - ME5 with low agent intensity: Tenants with E5 maturity and copilot penetration, but not high agent usage. These tenants are third priority. The flyout panel has additional details, including agent intensity, Copilot penetration, and Entra penetration for additional insights
Workload Name	Workload names refer to the specific services or applications that are part of the Microsoft 365 suite.
Monthly Active Users (MAU)	MAU is the measure, determined by Microsoft product telemetry, of unique signed-in users who have taken one or more intentional actions in the last rolling 28 days. The intentional action establishes clear user intent to perform a specific business action.
Paid Available Units (PAU)	PAU is the measure of paid licenses assigned to a tenant that is revenue associated. PAU is always less than or equal to the number of licenses because PAU doesn't count trial licenses, promotional licenses, step-up SKUs, or any unpaid subscription. Also, PAU requires the license to be assigned to a user and requires the service plan to be enabled in the tenant admin portal. Since paid licenses fluctuate due to billing cycles, PAU smooths these fluctuations by applying logic that removes cyclical impacts.
Utilization	The ratio of MAU divided by PAU, capped at 100%.
Usage Whitespace	The Total PAU - MAU, with a minimum of 0.
Usage Threshold	Tipping points define optimal usage thresholds for specific workloads that are highly correlated with upsell and expansion opportunities. These thresholds are identified through analysis and are used to determine when a customer or tenant is most likely to benefit from an upsell, based on their current usage patterns. - Above signifies a tenant's optimal usage threshold for upsell propensity. - Below indicates a tenant's opportunity for growth.
Usage Tipping Point	Usage profiles of the customer tenant and workloads based on specific usage tipping points of the workloads in the current subscription.
Workload Health	Categorization of workloads in scope for the opportunity as healthy, unhealthy, or at risk.
Workload Recommendation	Recommended motions based on the analysis and correlation of workload usage profile, upsell propensity, and incentive eligibility.
MCI Eligibility	Eligibility of the tenant and workload for one or more MCI engagements. This eligibility depends on the eligibility of the partner and customer, taking into account geography as well. Eligibility is automatically calculated based on whether the claiming partner country/region is within a customer's headquarters area*. Partners claiming customers outside of their headquarters area may be paused or removed from Microsoft Commerce Incentives. *See slide 32 "Microsoft Area Mapping" in the Microsoft Commerce Partner Incentives Guide available at https://aka.ms/MCI.
CPOR Eligibility	Eligibility of the tenant and workload for CPOR claim. All CPOR claimable workloads may not be eligible for incentives. See CPOR Potential Earnings Column or Potential Earnings Column for this information.
Total Potential Earnings	Sum of the potential earnings of eligible MCI and CPOR incentives earnings.
Partner Name	This is the name of the associated Partner Center ID (MPN). The associated partner is the partner on the specific claim with the tenant. This partner name is typically at a regional level. This could be a CPOR claim, a CSP association or more. Sometimes, the same tenant may be associated with multiple partner IDs within your organization. Most commonly, if your organization has multiple lines of business (for example, CSP reseller and service based via CPOR), the same tenant may have different partner IDs for the CSP association and the CPOR association. Sometimes, these different MPNIDs are eligible for different incentives, which is why they're shown separately.
Partner Center ID (MPN)	This is the associated Partner Center ID (MPN). The associated partner is the partner on the specific claim with the tenant. This partner name is typically at a regional level. This could be a CPOR claim, a CSP association or more. Sometimes, the same tenant may be associated with multiple partner IDs within your organization. Most commonly, if your organization has multiple lines of business (for example, CSP reseller and service based via CPOR), the same tenant may have different partner IDs for the CSP association and the CPOR association. Sometimes, these different MPNIDs are eligible for different incentives, which is why they're shown separately.
CPOR Association	Yes/No flag if this customer is associated with the partner via a CPOR claim.
CSP Association	Yes/No flag if this customer is associated with the partner via a CSP association.
CSP Tier	If this is associated via CSP, a breakdown of which customers are associated as a distributor or as a reseller.
T2 Reseller Name	For tier 2 CSP associations, this is the name of the T2 reseller. This data is only visible if the tenant has the partner name listed as the CSP provider for the subscription.

Definitions (hidden columns)

To view the hidden columns, select the Change Column icon, then select the columns to display or download, as shown in the following screenshot:

Column	Definition
Customer Country/Region	Specifies the country/region associated with the customer account. This field enables partners to identify the customer's geographic location for reporting, compliance, and localization within the ASPX platform.
Customer Segment	Indicates the classification of the customer based on business type or market segment. This field helps partners tailor reporting, analytics, and experiences to different customer groups on the ASPX platform.
Tenant Domain	The email domain of the tenant.
Max Comp Units	The maximum compensable units for usage incentives.
MCI Engagement Name	List of Microsoft Commerce incentivized Modern Work and Security engagements for which both partner and customer are eligible.
Opportunity Units	The available number of units for usage incentives (PAU minus Prior High Water Mark).
Prior High Water Mark (HWM)	The highest all-time recorded MAU for a particular service or subscription within a specified time frame before a certain event, such as the start of a new billing cycle or the date of a partner association. The Prior HWM snapshot is taken at the beginning of each month and serves as a benchmark used to measure growth or decline in usage over time. It's also used to determine the baseline from which growth is measured for incentive calculations.
Rate per Unit	The rate of usage incentive available for each compensable unit of active usage.
Starting High Water Mark (HWM)	The highest all-time MAU before the partner association date. It's a benchmark used to measure the initial level of usage or engagement that a partner brings to the table when they begin their association with Microsoft.
CPOR Potential Earnings	Calculated by multiplying a workload's opportunity units by the rate per unit for a specific workload. This calculation provides an estimation of the earnings a partner could potentially receive for servicing a customer's Microsoft cloud environment under the CPOR program.
Earliest CSP Renewal	Month when the earliest (by subscription end date) CSP subscription is up for renewal. This data is only visible if the tenant has the partner name listed as the CSP provider for the subscription.
Non-Profit Pricing	Tenants that are eligible for non-profit pricing across their Microsoft subscriptions. This is a specific list that may not align with the tenant industry/vertical.

Chart definitions

The following table describes the web parts numbered as A-E in the preceding screenshot:

Section	Name	Definition
A	Utilization by Workload	MAU/PAU by core workload within Growth Propensity Model opportunities pipeline. Usage growth in these workloads is identified through data science as the most correlated with upsell propensity.
B	Opportunities by Usage Whitespace	PAU minus MAU by core workload within Growth Propensity Model opportunities pipeline. This provides guidance about which of the core workloads has the most opportunity to grow absolute MAU.
C	Workload Health	A summary of the overall health profile of workloads. When a certain combination of core workloads within the tenant is healthy/unhealthy/at risk, then the tenant as a whole is classified correspondingly.
D	Workload Recommendation	A summary of the Usage Opportunities of all workloads.
E	Potential Earnings by Workloads	Sum of all of the CPOR and MCI potential earnings categorized by workload. This isn't a precise number, but more an estimate of incentive earnings. Potential earnings is a workload view, and potential earnings shouldn't be added across workloads. This is because some workshops apply to multiple workloads at a time but have a singular payout per workload. This view is meant to show all the potential earnings if partners were to focus on a particular workload.

For reference

LXP tipping points

Enterprise upsell to Microsoft 365 E3 workloads

Key workloads and thresholds correlated with Microsoft 365 E3 upsell for Enterprise. These tipping points are subject to change, but these values present the general direction of the thresholds for each workload. When a certain combination of workloads meets the tipping points, then the tenant as a whole is categorized as ready for upsell to E3.

SMC upsell to Microsoft 365 E3 workloads

Key workloads and thresholds correlated with Microsoft 365 E3 upsell for SMC. These tipping points are subject to change, but these values present the general direction of the thresholds for each workload. When a certain combination of workloads meets the tipping points, then the tenant as a whole is categorized as ready for upsell to E3.

Enterprise upsell to Microsoft 365 E5 workloads

Key E3 workloads and thresholds correlated with M365 E5 upsell for Enterprise. These tipping points are subject to change, but these values present the general direction of the thresholds for each workload. When a certain combination of workloads meets the tipping points, then the tenant as a whole is categorized as ready for upsell to E5.

SMC upsell to Microsoft 365 E5 workloads

Key E3 workloads and thresholds correlated with M365 E5 upsell for SMC. These tipping points are subject to change, but these values present the general direction of the thresholds for each workload. When a certain combination of workloads meets the tipping points, then the tenant as a whole is categorized as ready for upsell to E5.

Enterprise expansion workloads

Key E5 workloads and thresholds correlated with M365 E5 expansion for Enterprise. These tipping points are subject to change, but these values present the general direction of the thresholds for each workload. When a certain combination of workloads meets the tipping points, then the tenant as a whole is categorized as ready for E5 expansion.

SMC expansion workloads

Key E5 workloads and thresholds correlated with M365 E5 expansion for SMC. These tipping points are subject to change, but these values present the general direction of the thresholds for each workload. When a certain combination of workloads meets the tipping points, then the tenant as a whole is categorized as ready for E5 expansion.

LXP workload definitions

Modern Work

Workload Name	Workload Name in AI Business Solutions & Security Insights	Business Definition of Usage
Teams	Teams	Number of unique signed in users who have performed a collaboration action (schedule a meeting, send a chat message, add members to a Teams Channel, etc.) in the last 28 days.
Exchange Online	EXO	Number of unique signed in users performing actions within Microsoft Outlook, Outlook on the web (formerly known as Outlook Web App), and mobile clients such as mobile devices or tablets.
Microsoft SharePoint	SharePoint	Number of unique signed in users who have performed actions like delete, move, read, or rename a file on a Windows PC or tablet, a Mac, a Mobile device, or in a browser (web app) in the last 28 days.
Microsoft 365 Apps	Microsoft 365 Apps	Number of unique signed in users performing actions within Word, Excel, PowerPoint, Outlook, OneNote, or Teams on a Windows PC, a Mac, a mobile device, or in a browser (web app) in the last 28 days. Each user counts once, no matter how many apps or platforms they use.
Teams Meeting	Teams Meeting	Number of unique signed in users that participate in at least one scheduled meeting or group call in the last 28 days. Also includes video and audio conferencing, screen sharing, meeting chat, digital whiteboards, Teams live.
Teams Phone	Teams Phone	Number of unique signed in/valid Microsoft Entra ID users that make a make a public switched telephone network (PSTN) call using Phone System capabilities on Teams on Windows PC or Tablet, a MAC, a Mobile device or in a browser (web app). Guest users are excluded.

Identity and security

Workload Name	Workload Name in AI Business Solutions & Security Insights	Business Definition of Usage
Microsoft Entra ID	Microsoft Entra ID P1 + P2	The number of users who are active on or covered by: Conditional Access, Strong Authentication, Risk-based Conditional Access, Login Azure Active Directory, Windows Certificate-Based Authentication, Certificate-Based Authentication, Business-to-business Sign-in, Passwordless, Customer Identity and Access Management Tenant.
Microsoft Intune	Intune	The number of users who are targeted by Mobile Application Management (MAM) or having at least one managed device + managed devices without user assigned. (Managed devices include PC + Mobile Device Management (MDM) that checked in during the last 28 days.) Includes System Center Configuration Manager (SCCM) as a subworkload.
Microsoft Entra ID P2	Microsoft Entra ID P2	Number of users who have had a risk-based Conditional Access policy actively applied in the past 28-day rolling window.
Microsoft Defender for Endpoint	MDE P1 + P2	Number of devices that have been active (Sent telemetry) to the MDE service for any reason/feature in the past 28 day rolling window. Includes both active and passive modes.
Microsoft Defender for Office 365 (MDO)	MDO P1 + P2	The number of users who have actively engaged in the last 28-day rolling window with at least one of the following categories: SafeLinksOffice, SafeLinksTeams, SafeLinksEmail, SafeLinksOfficeOnline, SafeAttachmentsSPO, SafeAttachmentsEmail, AutoInvestigation, ManualInvestigation. It isn't sufficient that users be simply covered by the preceding protection - they must have active engagement in the protection during the 28-day rolling window. Shared mailboxes aren't counted towards MPU.
Microsoft Defender for Identity	MDI	Number of users who have been actively seen by at least one monitored activity in the last 28 days. See Microsoft Defender for Identity monitored activities.
Microsoft Defender for Cloud Apps	MDA P1 + P2	The number of users who are active on or covered by: ActivityPolicy, AnomalyDetectionPolicy, DiscoveryNewAppPolicy, SessionPolicy, FilePolicy.

Compliance

Workload Name	Workload Name in AI Business Solutions & Security Insights	Business Definition of Usage
Microsoft Purview Discover and Respond	DNR P1 + P2	The number of users for whom there's been an audit event or access to long term data, or who are covered by one of the following policies - Basic Hold, Basic Purge, Basic Export, Basic Search, Premium Hold, Premium Search, or Premium Review.
Microsoft Purview Information Protection	MIP P1 + P2	MAU is measured in two ways: 1. Number of users who are active and in scope of an MIP policy control – DLP (Microsoft SharePoint, OneDrive, Exchange Online, Teams), Manual labeling in Office apps, Automatic Labeling in Office apps and services, OME and Trainable Classifiers. 2. Number of users who interact with an item that is affected by an MIP control, such as users accessing a document that triggers the labeling feature/controls.
Microsoft Purview Data Lifecycle Management	DLM P1 + P2	The number of users who are either directly covered by a DLM policy (for example, their mailbox or OneDrive), have access to a shared location, which is covered by a DLM policy or where this DLM feature is used, or whose data has been searched, held, purged, exported, or added to a review set.
Microsoft Purview Discover and Respond P2	DNR P2	The number of users for whom there's been an audit event or access to long term data, or who are covered by one of the following policies - Premium Hold, Premium Search, or Premium Review.
Microsoft Purview Information Protection P2	MIP P2	MAU is measured in two ways: 1. Number of users who are active and in scope of an MIP P2 policy control: Teams DLP, Endpoint DLP, Automatic Labeling in Office apps and services, Advanced Message Encryption and Trainable Classifiers. 2. Number of users who interact with an item that is affected by an MIP P2 control, such as users accessing a document that triggers the labeling feature/controls.
Microsoft Purview Data Lifecycle Management P2	DLM P2	The number of users who are either directly covered by a DLM P2 policy* (for example, their mailbox or OneDrive), have access to a shared location, which is covered by a DLM P2 policy or where this DLM P2* feature is used, or whose data has been searched, held, purged, exported, or added to a review set. Examples of DLM P2 policies and labels: Adaptive policies, Auto retention policies, record labels, event retention labels, etc.
Microsoft Purview Insider Risk Management	IRM	The number of users who are across Insider Risk Management and Communication Compliance covered by one of the following policies: WorkplaceThreat, DisgruntledEmployeeSPV, IntellectualPropertyTheft, Offensive Language, LeakOfInformation, Regulatory Compliance, Sensitive Information, or a Custom Policy.

Notes on usage data

In some cases, Monthly Active Usage (MAU) is greater than Paid Available Units (PAU). This can occur for the following various reasons:

1. Unpaid or Trial Users: Some workloads allow usage by users who don't hold paid licenses. For example, if Microsoft 365 Copilot or Compliance workloads, features may be accessible to a broader set of users than those with paid entitlements. This leads to higher MAU counts compared to PAU.

2. Tenant-Level Policies: In security workloads like Microsoft Defender or Insider Risk Management (IRM), tenant-wide policies may apply protections to all users or devices, regardless of licensing. This results in MAU counts that include users not covered by paid licenses.

3. Misconfigured or Missing Licensing Data: There are cases where licensing data is incomplete or misaligned. For instance, if IRM isn't configured but Communication Compliance (CC) is, MAU may still be reported due to CC activity, while PAU remains zero for IRM.

4. Over-Deployment or Over-Usage: In security and compliance workloads, over-deployment is common. For example, a product like Purview may be deployed across an organization, but only a subset of users are licensed. This is seen as a monetization opportunity to convert active users into paid ones.

5. Multiple Workload Attribution: Some workloads aggregate usage across multiple features (for example, MIP DLP, DLM, DNR under Purview). If users engage with any of these features, they may be counted in MAU even if only one feature is licensed, inflating MAU relative to PAU.

Note

Learn how to quickly identify and prioritize Secure Productivity growth opportunities in the AI Business Solutions and Security Partner Center eXperience (ASPX) Partner Scenario Playbook at https://aka.ms/ASPXPlaybook. Inside this guide you’ll find a step‑by‑step view of when to use each scenario, what signals to look for, along with how to turn insights into concrete growth opportunities.

You can also explore the AI Business Solutions & Security Partner Center eXperience deck available at https://aka.ms/ASPXAIBS to learn more about the various ways to view the data within ASPX.