Microsoft 365 Education is a suite that combines the core capabilities of Microsoft 365 with learning tools. The Microsoft 365 Education A5 SKU includes a comprehensive set of management, security, privacy, and compliance solutions to create secure learning environments.1 Paid users, such as faculty and staff, benefit from all of these features, and the student use benefit makes a subset of the features available to students at no cost.
Microsoft commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study that examines the potential security-related return on investment (ROI) K-12 school systems may realize by deploying Microsoft 365 for Education A5.2 The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of the Microsoft 365 for Education A5 security features on their organizations.
To better understand the benefits, costs, and risks associated with this investment, Forrester interviewed seven representatives from a total of four school systems and surveyed 67 respondents with experience using Microsoft 365 Education A5. For the purposes of this study, Forrester aggregated the experiences of the interviewees and survey respondents and combined the results into a single composite organization that is a K-12 (primary and secondary education) school system with 60,000 students and 10,000 employees.
Microsoft commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study that examines the potential security-related return on investment (ROI) higher education organizations may realize by deploying Microsoft 365 Education A5.3 The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of the Microsoft 365 Education A5 security features on their organizations.
To better understand the benefits, costs, and risks associated with this investment, Forrester interviewed seven representatives from a total of four higher ed organizations and surveyed 157 respondents with experience using Microsoft 365 Education A5. For the purposes of this study, Forrester aggregated the experiences of the interviewees and survey respondents and combined the results into a single composite organization that is a higher ed organization with a teaching hospital, 50,000 students and 15,000 employees.
Return on investment (ROI)
0%
Net present value (NPV)
Prior to upgrading from the Microsoft 365 Education A3 SKU to the A5 SKU and eliminating other point security and compliance solutions, interviewees noted how their organizations found it increasingly difficult to provide adequate security, privacy, and compliance protection. These limitations led to costly security-related events in terms of ransomware payments, recovery efforts, brand damage, and disruption to business continuity. Additionally, limited budgets meant that their existing security stacks sometimes did not meet the minimum requirements dictated by cyber insurance providers.
After upgrading to Microsoft 365 Education A5, the interviewees rationalized their IT security estate while improving protection for employees, students, and online resources.
Prior to upgrading from the Microsoft 365 Education A3 SKU to the A5 SKU and eliminating other point security and compliance solutions, interviewees noted how their organizations found it increasingly difficult to provide adequate security, privacy, and compliance protection. Compliance was especially important with regards to research grants and the Health Insurance Portability and Accountability Act (HIPAA). These limitations led to costly security-related events in terms of ransomware payments, recovery efforts, brand damage, and disruption to business continuity. Additionally, limited budgets meant that their existing security stacks sometimes did not meet the minimum requirements dictated by cyber insurance providers.
After upgrading to Microsoft 365 Education A5, the interviewees rationalized their IT security estate while improving protection for employees, students, and online resources.
Key Findings
Quantified benefits. Three-year, risk-adjusted present value (PV) quantified benefits for the composite organization include:
- Improved security and compliance posture. Consolidating onto Microsoft 365 Education A5 improves the overall security, compliance, and privacy protection for everyone in the composite organization and all their online resources. Specifically, the annual number of significant breaches that cross multiple systems and large portions of users is reduced by 15% for the composite organization, and the cost to remediate the remaining breaches is reduced by 29%. These savings include the actual remediation costs as well as fines and additive audit and compliance costs. Over three years, this is worth about $972,800 to the composite organization.
- Improved security and compliance posture. Consolidating onto Microsoft 365 Education A5 improves the overall security, compliance, and privacy protection for everyone in the composite organization and all their online resources. Specifically, the annual number of significant breaches that cross multiple systems and large portions of users is reduced by 15% for the composite organization, and the cost to remediate the remaining breaches is reduced by 29%. These savings include remediation costs as well as fines and additive audit and compliance costs. Over three years, this is worth $1.2 million to the composite organization.
For system, this benefit could be worth over three years.
- Security solution vendor consolidation reduces license costs by 30%. The consolidation from multiple security, privacy, and compliance solutions to Microsoft 365 Education A5 provides integrated access to solutions that meet or exceed minimum requirements included in industry best practices or mandated by a cyber insurance policy. Consolidating from multiple vendors onto Microsoft also reduces the total license/subscription and maintenance spend. The three-year value to the composite organization is $1.1 million.
- Security solution vendor consolidation reduces license costs by 30%. Consolidating from multiple security, privacy, and compliance solutions to Microsoft 365 Education A5 provides integrated access to solutions that meet or exceed minimum requirements included in industry best practices or mandated by cyber insurance. Consolidating from multiple vendors also reduces the total license/subscription and maintenance spend. The three-year value to the composite organization is $1.7 million.
For system, this benefit could be worth over three years.
-
Efficiencies in detection, remediation, and efficiency reduces future IT security team staff growth. The tight integration across all security-related solutions within Microsoft 365 Education A5 and the ability to see everything in a single pane of glass makes it easier to analyze what is happening and identify vulnerabilities and security events across the composite organization in real time. This integration and single console also mean remediation takes less time and effort, enabling the existing IT security team to deal with the increased number and sophistication of attacks. Additionally, eliminating prior solutions makes management activities easier.
Taken all together, consolidating onto Microsoft 365 Education A5 makes it possible to provide the composite organization with necessary improved protection and response to threats without growing the IT security team by the 50% it would need with the prior solutions. In doing so, the composite organization realizes about $545,700 in added labor savings over three years. This is an especially important benefit because of the difficulty the composite organization’s school system has with hiring, training, and/or retaining IT security professionals.
-
Efficiencies in detection, remediation, and efficiency reduces future IT security team staff growth. The tight integration across all security-related solutions within Microsoft 365 Education A5 and the ability to see everything in a single pane of glass makes it easier to analyze what is happening and identify vulnerabilities and security events across the composite organization in real time. This integration and single console also mean remediation takes less time and effort, enabling the existing IT security team to deal with the increased number and sophistication of attacks. Eliminating prior solutions also makes management easier.
Taken all together, consolidating onto Microsoft 365 Education A5 makes it possible to provide the composite organization with necessary improved protection and response to threats without growing the IT security team by the 40% it would need with the prior solutions. In doing so, the composite organization realizes $1.1 million in added labor savings over three years. This is an especially important benefit because of the difficulty the higher ed composite organization has with hiring, training, and/or retaining IT security professionals.
For system, this benefit could be worth over three years.
-
Improved security and using security features save employees fifteen minutes per week. Less downtime during a security breach and time savings from features such as single sign-on (SSO) and self-service password reset save time for staff and teachers. In the case of teachers, this is time they can spend on student instruction.
After very conservatively reducing this benefit by 75% because not all time saved translates into additional work getting done, the three-year value to the composite organization is $1.7 million.
-
Improved security and using security features save employees fifteen minutes per week. Less downtime during a security breach and time savings from features such as single sign-on (SSO) and self-service password reset save time for staff and teachers. In the case of faculty, this is time they can spend on student instruction and research. After very conservatively reducing this benefit by 75% because not all time saved translates into additional work getting done, the three-year value to the composite organization is $3.3 million.
For system, this benefit could be worth over three years.
Unquantified benefits. Benefits that provide value for the composite organization but are not quantified for this study include:
- Improved learning outcomes. Microsoft 365 A5 Education indirectly contributes to improving learning outcomes in several ways. Firstly, less downtime for students and teachers means more time for in-class learning. Secondly, it helps provide a safe and compliant environment for online learning and collaboration. This is especially true for hybrid and all-remote learning models. Lastly, device management and security features such as Microsoft Intune make it possible to provide students with secure learning devices more easily and efficiently.
- Benefits from nonsecurity Microsoft 365 Education A5 capabilities. Microsoft 365 Education A5 includes other capabilities not included in the A1 or A3 SKUs. Two capabilities highlighted by interviewees that save them money and provide for better school operations and collaboration are Microsoft Teams Phone and Power BI.
- Ability to purchase and save money on cyber insurance. Cyber insurance providers increasingly require schools to have specific security solutions such as endpoint detection and response (EDR). Additionally, the cost of cyber insurance is generally increasing rapidly. Microsoft 365 Education A5 helps schools put in place insurance-mandated solutions faster and at less cost than many other alternatives, and it can help slow down the increases in policy premiums.
- Benefits from nonsecurity Microsoft 365 Education A5 capabilities. Microsoft 365 Education A5 includes other capabilities not included in the A1 or A3 SKUs. Two capabilities highlighted by interviewees that save them money and provide for better university operations and collaboration are Microsoft Teams Phone and Power BI. Interviewees reported that Microsoft Teams Phone saved them between $100,000 and $250,000 per year.
- Ability to purchase and save money on cyber insurance. Cyber insurance providers increasingly require higher ed organizations to have specific security solutions such as endpoint detection and response (EDR). Additionally, the cost of cyber insurance is generally increasing rapidly. Microsoft 365 Education A5 helps higher ed organizations put in place insurance-mandated solutions faster and at less cost than many other alternatives, and it can help slow down the increases in policy premiums.
- Enables secure remote learning.The security features in Microsoft 365 Education A5 make it easier to securely provide remote and hybrid learning. Additionally, the EDR capabilities improve the bring-your-own-device (BYOD) option for students. The CIO and VP at a four-year state university said: “A5 has improved access for students who would otherwise have to travel to a campus. The fact we can do remote learning securely helps with accessibility, especially for underrepresented groups.”
Costs. Three-year, risk-adjusted PV costs for the composite organization include:
- Internal costs of $621,000. Internal costs are the effort to implement Microsoft 365 Education A5 and the incremental effort for ongoing management. The initial implementation takes nine months and requires 4.8 FTEs. Ongoing management requires 1.5 FTEs.
- Internal costs of $1.2 million.Internal costs are the effort to implement Microsoft 365 Education A5 and the incremental effort for ongoing management. The initial implementation takes nine months and requires 7.0 FTEs. Ongoing management requires 2.0 FTEs.
For system, this cost could be over three years.
- External costs of $1.3 million. The main component of external costs is the $51 per employee per year incremental cost of the Microsoft 365 Education A5 SKU over the A3 SKU. Students receive free use of a subset of capabilities via the student use benefit. There are also some initial external professional services as part of the deployment and configuration.
- External costs of $2.0 million.The main component of external costs is the $51 per employee per year incremental cost of the Microsoft 365 Education A5 SKU over the A3 SKU. Students receive free use of a subset of capabilities via the student use benefit. There are also some external professional services as part of the deployment and future expansions.
For system, this cost could be over three years.
The financial analysis, which is based on the interviews and survey, found that a composite organization experiences benefits of $4.22 million over three years versus costs of $1.94 million, adding up to a net present value (NPV) of $2.28 million and an ROI of 118%.
The financial analysis, which is based on the interviews and survey, found that a composite organization experiences benefits of $7.28 million over three years versus costs of $3.19 million, adding up to a net present value (NPV) of $4.09 million and an ROI of 128%.
system, could experience benefits of over three years versus costs of , adding up to an NPV of and an ROI of 0%.
Key Statistics
-
ROI
0%
-
Benefits PV
-
Net present value (NPV)
-
Payback
0
Benefits (Three-Year)
Improved security and compliance posture Reduced license costs from vendor consolidation Additional IT security team members not added Reduced employee downtimeTEI Framework And Methodology
From the information provided in the interviews, Forrester constructed a Total Economic Impact™ framework for those organizations considering an investment Microsoft 365 for Education A5.
The objective of the framework is to identify the cost, benefit, flexibility, and risk factors that affect the investment decision. Forrester took a multistep approach to evaluate the impact that Microsoft 365 for Education A5 can have on an organization.
Forrester Consulting conducted an online survey of 351 cybersecurity leaders at global enterprises in the US, the UK, Canada, Germany, and Australia. Survey participants included managers, directors, VPs, and C-level executives who are responsible for cybersecurity decision-making, operations, and reporting. Questions provided to the participants sought to evaluate leaders' cybersecurity strategies and any breaches that have occurred within their organizations. Respondents opted into the survey via a third-party research panel, which fielded the survey on behalf of Forrester in November 2020.
-
Due Diligence
Interviewed Microsoft stakeholders and Forrester analysts to gather data relative to Microsoft 365 for Education A5.
-
Interviews And Survey
Interviewed seven representatives across four school systems and surveyed 67 respondents at organizations using Microsoft 365 Education A5 to obtain data with respect to costs, benefits, and risks.
Interviewed seven representatives across four higher ed organizations and surveyed 157 respondents at organizations using Microsoft 365 Education A5 to obtain data with respect to costs, benefits, and risks.
-
Composite Organization
Designed a composite organization based on characteristics of the interviewees’ organizations and survey respondents.
-
Financial Model Framework
Constructed a financial model representative of the interviews using the TEI methodology and risk-adjusted the financial model based on issues and concerns of the interviewees and survey respondents.
-
Case Study
Employed four fundamental elements of TEI in modeling the investment impact: benefits, costs, flexibility, and risks. Given the increasing sophistication of ROI analyses related to IT investments, Forrester’s TEI methodology provides a complete picture of the total economic impact of purchase decisions. Please see Appendix A for additional information on the TEI methodology.
Disclosures
Readers should be aware of the following:
This study is commissioned by Microsoft and delivered by Forrester Consulting. It is not meant to be used as a competitive analysis.
Forrester makes no assumptions as to the potential ROI that other organizations will receive. Forrester strongly advises that readers use their own estimates within the framework provided in the study to determine the appropriateness of an investment in Microsoft 365 for Education A5.
Microsoft reviewed and provided feedback to Forrester, but Forrester maintains editorial control over the study and its findings and does not accept changes to the study that contradict Forrester’s findings or obscure the meaning of the study.
Microsoft provided the customer names for the interviews but did not participate in the interviews.
Forrester fielded the double-blind survey using a third-party survey partner.
Consulting Team:
Isabel Carey
Jonathan Lipsitz
Drivers leading to the Microsoft 365 Education A5 investment
Key Challenges
Forrester interviewed seven representatives from four school systems and surveyed 67 respondents with experience using Microsoft 365 Education A5. For more details on these individuals and the organizations they represent, see Appendix B.
Forrester interviewed seven representatives from four higher ed organizations and surveyed 157 respondents with experience using Microsoft 365 Education A5. For more details on these individuals and the organizations they represent, see Appendix B.
Prior to implementing Microsoft 365 Education A5, interviewees were using Microsoft Education A3 in conjunction with other vendors’ security, compliance, and privacy solutions. This multivendor approach required custom integrations for monitoring and remediation.
Both interviewees and survey respondents noted how their organizations struggled with common challenges, including:
- Prior solutions resulted in increased complexity and associated rising costs. Interviewees reported that their prior point solution integration approaches required too much effort to set up and manage. Additionally, multiple point solutions required more effort and time to identify and remediate threats, and this was expected to increase with more frequent and complex attacks. Interviewees also reported that they were spending too much on security solution licenses.
-
It was difficult to respond to the increasing complexity of security threats and compliance requirements. Vulnerabilities and attacks were becoming more complex, and interviewees said that addressing these threats required better solution integration and the ability to analyze all signals in a single pane of glass. A successful breach could impact trust and reputation, result in high costs for external remediation help, and disrupt school operations.It was difficult to respond to the increasing complexity of security threats and compliance requirements. Vulnerabilities and attacks were becoming more complex, and interviewees said that addressing these threats required better solution integration and the ability to analyze all signals in a single pane of glass. A successful breach could impact trust and reputation, result in high costs for external remediation help, and disrupt university operations.
- Prior solutions did not meet cyber insurance requirements. Interviewees’ prior security toolsets did not meet their insurance providers’ new cyber security requirements. They needed to add these solutions quickly and cost-effectively.
Solution Requirements
The interviewees and survey respondents searched for a solution that could:
- Improve their security posture, including compliance and privacy, without adding many people to the IT security team.
- Provide integrated security across all levels, including device-level security such as that found on Surface devices.
- Speed up recovery after a cyberattack.
- Reduce the total spend on security solutions.
- Meet minimum cyber insurance requirements.
- Enable secure and compliant environments that support learning, especially hybrid and online models.
- Improve their security posture without adding many people to the IT security team.
- Improve compliance and privacy capabilities across all areas, including HIPAA for teaching hospitals and grant-related compliance requirements.
- Provide integrated security across all levels, including device-level security such as that found on Surface devices.
- Speed up recovery after a cyberattack.
- Reduce the total spend on security solutions.
- Meet minimum cyber insurance requirements.
What security specific goals did your organization hope to achieve with your current security Solutions?
Improve security posture (visibility, reliability) Contain costs related to Security, Compliance, and Identity technology tools Improve security to better meet privacy requirements Contain costs related to Security, Compliance, and Identity employees Provide efficiencies for security resources Improve compliance and better meet regulatory requirements Improve educational outcomes by creating learning experiences that are secure and compliantBase: 67 decision-makers who have experience using and managing Microsoft 365 Education A5 at their organizations
Source: A commissioned study conducted by Forrester Consulting on behalf of Microsoft, April 2023.
What security specific goals did your organization hope to achieve with your current security Solutions?
Improve security posture (visibility, reliability) Improve security to better meet privacy requirements Contain costs related to Security, Compliance, and Identity technology tools Provide efficiencies for security resources Improve educational outcomes by creating learning experiences that are secure and compliant Contain costs related to Security, Compliance, and Identity employees Improve compliance and better meet regulatory requirements, including those related to research grantsBase: 67 decision-makers who have experience using and managing Microsoft 365 Education A5 at their organizations
Source: A commissioned study conducted by Forrester Consulting on behalf of Microsoft, April 2023.
Composite Organization
Based on the interviews and survey, Forrester constructed a TEI framework, a composite company, and an ROI analysis that illustrates the areas financially affected. The composite organization is representative of the seven interviewees from four school systems and 67 survey respondents, and it is used to present the aggregate financial analysis in the next section. The composite organization has the following characteristics:
Description of composite. The composite organization is a K-12 public school district. There are 7,860 teachers and 2,140 staff, all of whom have paid Microsoft 365 Education A5 licenses. IT has six FTEs on the IT security team. The district’s 60,000 students all use some of the security and compliance features available in the student use benefit at no additional cost. The district operates many different types of schools, including traditional elementary, middle, and high schools, as well as schools for special needs students and vocational training. The district recently launched an online-only school built on Microsoft 365 Education.
Based on the interviews and survey, Forrester constructed a TEI framework, a composite company, and an ROI analysis that illustrates the areas financially affected. The composite organization is representative of the seven interviewees from four higher ed organizations and 157 survey respondents, and it is used to present the aggregate financial analysis in the next section. The composite organization has the following characteristics:
Description of composite. The composite organization is a higher ed. There are 6,580 faculty and 8,420 staff, all of whom have paid Microsoft 365 Education A5 licenses. IT has ten FTEs on the IT security team. The 50,000 students all use some of the security and compliance features available in the student use benefit at no additional cost. The higher ed has multiple campuses and a study abroad program. It has a teaching hospital and also supports various remote/hybrid learning initiatives.
Description of . system, has 0 faculty members, 0 staff FTEs, and 0 IT security analysts.
Deployment characteristics. The school district upgraded from the Microsoft 365 Education A3 SKU to the A5 SKU and retired previous security solutions now provided by Microsoft. Microsoft 365 Education A5 can replace as many as 26 point security, compliance, and privacy solutions. The features rolled out to all employees as part of the upgrade included Azure Active Directory Plan 2, Office 365 Right Management, Litigation Hold, Microsoft 365 Purview eDiscovery, Microsoft 365 Data Loss Prevention for email and files, Microsoft Purview Communication Compliance, Endpoint data loss prevention, School Data Sync, Intune for Education, Microsoft Defender for Endpoint Plan 2, Advanced Threat Analytics, Office 365 Cloud App Security, Microsoft 365 Defender for Cloud Apps, Microsoft Defender Antivirus, Microsoft Defender Device Guard, and Microsoft Defender for Identity.
Some of the main features rolled out to students as part of the student use benefit were Azure Active Directory Plan 2, Litigation Hold, Microsoft Purview eDiscovery Standard, Microsoft Purview Data Loss Prevention for email and files, Intune for Education, School Data Synce, Advanced Threat Analytics, Office 365 Cloud App Security, and Microsoft 365 Defender for Cloud Apps.
Deployment characteristics. The higher ed upgraded from the Microsoft 365 Education A3 SKU to A5 and retired previous security solutions now provided by Microsoft. Microsoft 365 Education A5 can replace as many as 26 security, compliance, and privacy solutions. The features rolled out to all employees included Azure Active Directory Plan 2,Litigation Hold, Microsoft Purview Data Loss Prevention (DLP) for email and files, Microsoft Purview eDiscovery Premium, Microsoft Purview Communication Compliance, Microsoft Insider Risk Management, Microsoft Privileged Access Management, Microsoft Defender for Endpoint Plan 2, Advanced Threat Analytics, Intune for Education, Microsoft Defender Antivirus, Microsoft Defender for Identity, Office 365 Cloud App Security, Microsoft Defender Device Guard, and Microsoft 365 Defender for Cloud Apps.
Some of the main features rolled out to students as part of the student use benefit were Azure Active Directory Plan 2, Litigation Hold, Microsoft Purview eDiscovery Standard, Microsoft Purview Data Loss Prevention for email and files, Intune for Education, School Data Sync, Advanced Threat Analytics, Office 365 Cloud App Security, and Microsoft 365 Defender for Cloud Apps.
Quantified benefit data as applied to the composite
Total Benefits
| Ref. | Benefit | Year 1 | Year 2 | Year 3 | Total | Present Value |
|---|---|---|---|---|---|---|
| Atr | Improved security and compliance posture | $0 | $0 | $0 | $0 | $0 |
| Btr | Reduced license costs from vendor consolidation | $0 | $0 | $0 | $0 | $0 |
| Ctr | Additional IT security team members not added | $0 | $0 | $0 | $0 | $0 |
| Dtr | Reduced employee downtime | $0 | $0 | $0 | $0 | $0 |
| Total benefits (risk-adjusted) | $0 | $0 | $0 | $0 | $0 |
Improved Security And Compliance Posturex
Evidence and data. Microsoft 365 Education A5 includes more than twenty security, compliance, and privacy features not included in the A3 SKU. Additionally, Microsoft made most of its security features and almost half of its compliance and privacy features available to students at the interviewees’ organizations at no cost as part of the student use benefit. All of these capabilities had tight integration because they were all from a single vendor, and this improved the interviewees’ schools’ security posture in terms of the number and severity of breaches as well as metrics such as mean time to detect (MTTD) and mean time to remediate (MTTR). An improved posture reduced downtime and cost after a cyber event, protected schools’ public reputation and limited the disruption to teaching. Interviewees’ rollout roadmaps varied based on their highest priorities. Interviewees and survey respondents shared the following examples of how their security postures improved:
- The head of IT at a European private education trust said: “Rolling out multifactor authentication to all staff members traps 90% of vulnerabilities. If they click on a phishing link, bad actors can’t access anything.” The number of successful phishing attacks has been reduced from three per month to one per quarter.
- The CIO at an alternative education campus reported that their organization was hit with a ransomware attack in 2020. The damage was limited to one server containing old pictures. They said: “If we were not on Microsoft, we probably would have lost a lot more data. The ransomware demand was $1.6 million, which we did not have to pay.”
- The CIO at a public school district said, "Being able to see everything in a single pane of glass helps to understand what is happening, the root cause, and how to remediate the threat.”
- The same CIO shared an example in which some student IDs were accidentally emailed to external parties. Data loss prevention from Microsoft blocked that email from leaving the domain.
- About compliance and privacy, the CIO at the alternative education campus said: “We definitely have better privacy and compliance. We have automated cyberbullying monitoring, and eDiscovery finds state regulatory violations before they result in fines.”
- The European director of IT said that Microsoft 365 Education A5 helped their organization meet GDPR requirements and respond to freedom of information requests.
- The CIO at a public school district explained that previously purchased student devices were out of compliance with regard to US federal poverty regulations. That was caught by Microsoft 365 Education A5, and the district can now ensure that it is in compliance.
- Two-thirds of survey respondents reported a decreased risk of a data breach, and the average decrease was 16%.
- The survey also found that the cost to remediate remaining breaches was reduced by 29%.
- With regards to compliance, survey respondents reported a 14% decrease in non-compliance events linked to regulations such as Children's Online Privacy Protection Act (COPPA), Family Educational Rights and Privacy Act (FERPA), Health Insurance Portability and Accountability Act (HIPAA), and General Data Protection Regulation (GDPR).
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- Based on Forrester’s research, the average number of material breaches that impact multiple systems and a large proportion of users at an organization the size of the composite is 3.0 per year.4
- This study’s survey’s average cost of a breach of $270,000 is scaled to $351,000 to reflect the larger composite organization. These savings include the actual remediation costs as well as fines and additive audit and compliance costs.
- Based on the survey and interviews, the reduction in material breaches for the composite is 15%. Three quarters of this is realized in Year 1 as the Microsoft solutions are fully deployed and fine-tuned and as the IT security team learns to use them fully.
- For the remaining material breaches, the survey finding of a 29% reduction in the cost to remediate is applied.
Risks. The size of this benefit can vary because of:
- The prior frequency of breaches and the total cost of a breach.
- What other security solutions, from Microsoft or another vendor, were in place before.
- Which Microsoft 365 Education A5 security features are implemented and an IT security organization’s maturity as it relates to threat detection and remediation.
Results. To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of about $972,800.
Evidence and data. Microsoft 365 Education A5 includes more than twenty security, compliance, and privacy features not included in the A3 SKU. Additionally, interviewees reported that Microsoft made most of its security features and almost half of its compliance and privacy features available to students at their organizations at no cost as part of the student use benefit. All of these capabilities had tight integration because they were all from a single vendor, and this improved the interviewees’ organizations’ security posture in terms of the number and severity of breaches as well as metrics such as mean time to detect (MTTD) and mean time to remediate (MTTR). An improved posture reduced downtime and cost after a cyber event, protected public reputation, and limited the disruption to teaching.
Interviewees reported that security compliance at their higher ed organizations was very important for several reasons. In the US, it improved HIPAA compliance for student health services and teaching hospitals. Microsoft 365 Education A5 also helped with compliance around research grants and government reporting, and it improved compliance with Europe’s General Data Protection Regulation (GDPR). Interviewees’ rollout roadmaps varied based on their organizations’ highest priorities. Interviewees and survey respondents shared the following examples of how their security postures improved:
- The VP technology and CIO at a four-year university said that their organization had 10 accidental incidents of emailing restricted information over a two-year period that Microsoft 365 Education A5 helped block. Had they resulted in compliance breaches, the cyber insurance policy would have been activated, leading to a big premium increase.
- The CISO at a four-year university shared that within the first week of implementation, “[Microsoft 365 Education A5] found two ransomware payloads that had not detonated but the prior security tools did not detect.”
- The CIO and VP at a four-year university explained that easily bringing the organization’s telemetry together helped teams see alerts but also the valuable attack story. They also said that the move to Microsoft had a very positive impact on creating a culture of security within the IT organization and the entire university.
- The director of technology at a two-year technical college shared that the organization faced successful phishing attacks prior to moving to Microsoft 365 Education A5, but now there are none. A security analyst at the same college said, “Visibility is ten times better and there are built-in automations, which is priceless.”
- Survey findings around improved security indicated a 15% decrease in annual incidents and a 29% reduction in the cost of remediating a successful breach at respondents’ organizations.
- With regards to compliance, survey respondents said that there was a 20% decrease in noncompliance events related to government regulations and/or research grants. The average value of research grants that were either preserved or won because of better compliance was $270,000.
Modeling and assumptions.For the financial analysis as applied to the composite organization, Forrester assumes:
- Based on Forrester’s research, the average number of material breaches that impact multiple systems and a large proportion of users at an organization the size of the composite is 3.0 per year.5
- The average cost of a breach of $450,000 from that Forrester research is used in the composite organization’s calculations. These savings include the actual remediation costs as well as fines and additive audit and compliance costs.
- Based on the survey and interviews, the reduction in material breaches for the composite is 15%. Three-quarters of this is realized in Year 1 as the Microsoft solutions are not yet fully deployed and fine-tuned as the IT security team learns to use them fully.
- For the remaining material breaches, the survey finding of a 29% reduction in the cost to remediate is applied.
Risks. The size of this benefit can vary because of:
- The prior frequency of breaches and the total cost of a breach.
- What other security solutions, from Microsoft or another vendor, were in place before.
- Which Microsoft 365 Education A5 security features are implemented and an IT security organization’s maturity as it relates to threat detection and remediation.
Results. To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of about $1.2 million.
For system, this benefit may have a three-year, risk-adjusted total PV of .
Improved Security And Compliance Posture
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| A1 | Average annual number of material breaches before A5 | Forrester research | 0 | 0 | 0 | |
| A2 | Average total cost of a breach | Assumption | $0 | $0 | $0 | |
| A3 | Reduced likelihood of a breach with A5 | Composite | 0% | 0% | 0% | |
| A4 | Reduced number of breaches | A1*A3 | 0 | 0 | 0 | |
| A5 | Subtotal: Savings from fewer breaches | A2*A4 | $0 | $0 | $0 | |
| A6 | Reduction in total cost of remaining breaches | Composite | 0% | 0% | 0% | |
| A7 | Subtotal: Savings from lower costs associated with remaining breaches | (A1-A4)* (A2*A6) | $0 | $0 | $0 | |
| At | Improved security and compliance posture | A5+A7 | $0 | $0 | $0 | |
| Risk adjustment | ↓5% | |||||
| Atr | Improved security and compliance posture (risk-adjusted) | $0 | $0 | $0 | ||
| Three-year total: $0 | Three-year present value: $0 | |||||
Reduced License Costs From Vendor Consolidation
Evidence and data. Consolidating from a point-solution-integration approach to Microsoft 365 Education A5 lowered license costs for interviewees and survey respondents. Interviewees and survey respondents shared the following examples of how they reduced license costs:
- The CIO at the alternative education campus reported a 50% reduction in license costs. Solutions that were retired in favor of Microsoft included endpoint security, antivirus, email filtering, and eDiscovery.
- The CIO at the public school district described a savings of 25% from eliminating prior antivirus and malware solutions.
- A network administrator at a public school district said that the EDR savings alone more than paid for their district’s upgrade from Microsoft 365 Education A3 to A5.
- The survey reported software license savings of 14% and an additional software maintenance savings of 15%.
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- The total Microsoft 365 Education A5 license cost of $120 per employee per year is 30% less than the cost of the prior security, compliance, and privacy solutions it replaces.
- Only three-quarters of the benefit is realized in Year 1 as some prior solution license agreements expire.
Risks. The size of this benefit can vary because of:
- The extent to which an organization consolidates onto Microsoft 365 Education A5 and the cost of solutions being replaced.
- How much time is remaining on the prior solution license agreements.
Results. To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV of $1.1 million.
Evidence and data. Consolidating from a point-solution-integration approach to Microsoft 365 Education A5 lowered license costs for interviewees and survey respondents. Interviewees and survey respondents shared the following examples of how they reduced license costs:
- The VP technology and CIO at a four-year state university said that Microsoft 365 Education A5 replaced another multifactor authentication (MFA) tool for students and employees, password self-service reset, and antivirus. There also would have been the need for a $500,000 data center refresh. They concluded by saying, “My CFO loves me right now.”
- The interviewee of one of the four-year state universities said that it consolidated separate platforms for students and for employees, as well as different instances for its teaching hospital and for each campus, into a single Microsoft estate. This eliminated the need for many other security solutions, which was estimated to save $500,000 per year.
- The two-year technical college replaced an extended detection and response (XDR) solution with the Microsoft EDR solutions. A separate email protection solution was also eliminated. The director of technology reported that this switch saved the institution “six figures per year.” There is also the potential to replace more solutions, such as MFA.
- The survey found that respondents’ organizations experienced many cost savings related to replacing other security solutions and infrastructure, including a 12% decrease in license costs, a 15% decrease in maintenance costs, and a 22% decrease in management costs.
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- The total Microsoft 365 Education A5 license cost of $120 per employee per year is 30% less than the cost of the prior security, compliance, and privacy solutions it replaces.
- Only three-quarters of the benefit is realized in Year 1 as some prior solution license agreements expire.
Risks. The size of this benefit can vary because of:
- The extent to which an organization consolidates onto Microsoft 365 Education A5, and the cost of solutions being replaced.
- How much time is remaining on the prior solution license agreements.
Results. To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV of $1.7 million.
For system, with 0 faculty members and 0 staff FTEs, this benefit may have a three-year, risk-adjusted total PV of .
Reduced License Costs From Vendor Consolidation
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| B1 | Number of faculty and staff employees | 0 | 0 | 0 | ||
| B2 | Total Microsoft 365 A5 subscription costs | B1*$120 | $0 | $0 | $0 | |
| B3 | Reduction compared to previous solutions | Composite | 0% | 0% | 0% | |
| Bt | Reduced license costs from vendor consolidation | Y1: B2/(1-B3)-B2*75% Y2: B2/(1-B3)-B2*100% Y3: B2/(1-B3)-B2*100% |
$0 | $0 | $0 | |
| Risk adjustment | ↓5% | |||||
| Btr | Reduced license costs from vendor consolidation (risk-adjusted) | $0 | $0 | $0 | ||
| Three-year total: $0 | Three-year present value: $0 | |||||
Additional IT Security Team Members Not Added
Evidence and data. Compared to prior multivendor security estate, IT security teams working with Microsoft 365 Education A5 were more efficient and effective for several reasons. Firstly, the breadth of solutions within the system and the tight integration across all of them made it easier for the IT security team to view signals in a single pane of glass. This gave them the ability to better avoid breaches and to efficiently detect and remediate ones that do occur. The increased number and complexity of attacks made this more important. Secondly, there were built-in automations that reduced a team’s effort. Lastly, there was less effort in managing an integrated security, compliance, and privacy platform compared to a multivendor stack. These efficiencies meant that an existing IT security team could handle a larger workload without adding headcount. Interviewees and survey respondents shared the following examples of how they are more efficient and effective:
- The CIO at a public school district explained that a significant driver of moving to Microsoft was an IT staff shortage. With Microsoft’s tools, the school district was able to implement a one-device-to-student model and provide internet access to 14,000 families without adding any additional IT staff.
- The same CIO also estimated that their district would have needed to add four security people to its existing team of four if it had not moved to Microsoft 365 Education A5 — two on the security operations center (SOC) team and two working on compliance and identity. The interviewee said this was largely attributed to automation in A5 needed less human monitoring and let their organization’s teams work with fewer people.
- The CIO at the alternative education campus estimated that everyone on the virtual team responsible for security saved 30% of their time. They also said that application developers saved time by leveraging Microsoft 365 Education A5 security features in their applications.
- The infrastructure manager at the European private education trust said: “I see increased confidence in my team. We get a lot of security alerts, and the built-in automation gives them the time to look at what is most important and analyze what is happening and why.”
- The executive director of technology at a public school district said that managing a multivendor estate requires more people. They said: “[With Microsoft 365 Education A5], the teams are becoming more efficient on response time to triage and respond to an attack, containing it before it becomes a larger problem.”
- Survey respondents reported increased efficiencies across several teams, including security, developers, and internal audit.
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- The existing IT security team is six FTEs, and it would need to grow by 50% if the composite organization had not consolidated onto Microsoft 365 Education A5.
- A team member's average fully burdened cost, including salary, benefits, and payroll taxes, is $77,000.
Risks. The size of this benefit can vary because of:
- The prior team size and eve of experiences.
- The prior security solutions in place and the level of automation.
- The fully burdened cost of an IT security team member.
Results. To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV of about $545,700.
Evidence and data. Compared to prior multivendor security estate, Microsoft 365 Education A5 made IT security teams more efficient and effective for several reasons. Firstly, the breadth of solutions within the system and the tight integration across all of them made it easier for the IT security team to view signals in a single pane of glass. This gave them the ability to better avoid breaches and to efficiently detect and remediate ones that do occur. The increased number and complexity of attacks made this more important. Secondly, built-in automations reduced a team’s effort. Lastly, there was less effort in managing an integrated security, compliance, and privacy platform compared to a multivendor stack. These efficiencies meant that an existing IT security team could handle a larger workload without adding headcount. Interviewees and survey respondents shared the following examples of how they are more efficient and effective:
- The VP technology and CIO at a four-year university said they were able to reduce their server ops team from four to three people through natural attrition. They also said they would have had to add more people to the server security and help desk teams.
- The CIO and VP at another four-year university estimated they would have needed to add 30% more people to the security and email teams had they not consolidated onto Microsoft.
- The same interviewee also said that their institution’s developers are 10% more efficient by using the plug-and-play identity features.
- An analyst at the two-year technical college explained that the prior point solutions had a lot of customization and complex integrations, which were time consuming to manage.
- The director of technology at the same technical college said that the number of student password reset help desk tickets was cut by 50%.
- Survey respondents reported time savings across many teams, including security operations, IT operations, developers, and internal audit.
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- The existing IT security team is ten FTEs, and it would need to grow by 40% if the composite organization had not consolidated onto Microsoft 365 Education A5.
- A team member's average fully burdened cost, including salary, benefits, and payroll taxes, is $112,500.
Risks. The size of this benefit can vary because of:
- The prior team size and eve of experiences.
- The prior security solutions in place and the level of automation.
- The fully burdened cost of an IT security team member.
Results. To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV of about $1.1 million.
For system, with 0 total IT security analysts, this benefit may have a three-year, risk-adjusted total PV of .
Additional IT Security Team Members Not Added
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| C1 | Number of FTEs on IT security team | 0 | 0 | 0 | ||
| C2 | Avoided FTE headcount increase | 0 | 0 | 0 | ||
| C3 | Average fully burdened cost | $0 | $0 | $0 | ||
| Ct | Additional IT security team members not added | C2*C3 | $0 | $0 | $0 | |
| Risk adjustment | ↓5% | |||||
| Ctr | Additional IT security team members not added (risk-adjusted) | $0 | $0 | $0 | ||
| Three-year total: $0 | Three-year present value: $0 | |||||
Reduced Employee Downtime
Evidence and data. Teachers and staff at the interviewees’ organizations experienced less downtime because there were fewer successful breaches, and the time to remediate the remaining ones was less. Additionally, security tools such as SSO and multifactor authentication (MFA) saved users’ time. In the case of teachers, these time savings could be used for additional student teaching, which contributed to improved learning and is discussed in the upcoming unquantified benefits section. Interviewees and survey respondents shared the following examples of how employees experienced less downtime:
- The CIO at the alternative education campus described a breach in which some systems were down for two weeks. Without the forensic and remediation tools in Microsoft 365 Education A5, they estimated that those systems would have been down for two months.
- The head of IT at the private education trust estimated that SSO saved employees 30 to 60 minutes per week because they were not forgetting and resetting passwords.
- The CIO at a public school district said that giving substitute teachers Microsoft 365 Education A5 licenses sped up the onboarding process.
- Survey respondents estimated that employees saved 289 hours yearly since moving to Microsoft 365 Education A5.
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- Faculty and staff save fifteen minutes weekly because of less downtime and features such as SSO. For teachers, this is only experienced for 36 weeks out of the year because they have summers off.
- Half of the benefit is experienced in Year 1 as solutions are rolled out and staff become familiar with them.
- An annual average fully burdened cost of staff $63,000 is used, and the hourly fully burdened cost is adjusted for teachers and staff based on how many weeks per year they work.
- To be very conservative, only 25% of this benefit is included in the financial analysis because not all time savings translates into additional productive work.
Risks. The size of this benefit can vary because of:
- The amount of previous downtime.
- If features such as SSO and MFA are implemented.
- The fully burdened cost of an employee.
Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV of $1.7 million.
Evidence and data. Faculty and staff at the interviewees’ and respondents’ organizations experienced less downtime because there were fewer successful breaches, and the time to remediate the remaining ones was less. Additionally, security tools such as SSO and MFA saved users’ time. In the case of teachers, these time savings could be used for additional student teaching, which contributed to improved learning and is discussed in the upcoming unquantified benefits section. Interviewees and survey respondents shared the following examples of how employees experienced less downtime:
- The VP technology and CIO at a four-year university said that there were considerably fewer employee-generated help desk tickets, which meant less downtime for employees.
- The CTO at a four-year university said that device provisioning was much faster because of Azure AD, Intune, and Autopilot. Employees also didn’t need to bring their computers to IT for other security-related support. They said, “This saves time and leads to higher employee satisfaction.”
- The CISO at the same university said that solutions like Microsoft Authenticator saved employees time, and that there was less downtime during a security event.
- The survey found an average employee time savings of more than one hour per week.
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- Faculty and staff save fifteen minutes weekly because of less downtime and features such as SSO.
- Half of the benefit is experienced in Year 1 as solutions are rolled out and staff become familiar with them.
- An annual average fully burdened cost of staff $84,000 is used, and the hourly fully burdened cost for faculty is $90,600.
- To be very conservative, only 25% of this benefit is included in the financial analysis because not all time savings translates into additional productive work.
Risks. The size of this benefit can vary because of:
- The amount of previous downtime.
- If features such as SSO and MFA are implemented.
- The fully burdened cost of an employee.
Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV of $3.3 million.
For system, with 0 staff FTEs at a fully burdened annual salary of $0 and 0 faculty members earning a fully burdened annual salary of $0, this benefit may have a three-year, risk-adjusted total PV of .
Reduced Employee Downtime
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| D1 | Number of staff | 0 | 0 | 0 | ||
| D2 | Annual staff time savings (hours) | 50 weeks*0.25 hours [50% realized in Year 1] | 0 | 0 | 0 | |
| D3 | Hourly fully burdened cost staff | $0 | $0 | $0 | ||
| D4 | Subtotal: Reduced staff downtime | D1*D2*D3 | $0 | $0 | $0 | |
| D5 | Number of faculty | 0 | 0 | 0 | ||
| D6 | Annual faculty time savings (hours) | 0 | 0 | 0 | ||
| D7 | Hourly fully burdened cost faculty | $0 | $0 | $0 | ||
| D8 | Subtotal: Reduced faculty downtime | D5*D6*D7 | $0 | $0 | $0 | |
| D9 | Productivity capture | TEI standard | 0% | 0% | 0% | |
| Dt | Reduced employee downtime | (D4+D8)*D9 | $0 | $0 | $0 | |
| Risk adjustment | ↓20% | |||||
| Dtr | Reduced employee downtime (risk-adjusted) | $0 | $0 | $0 | ||
| Three-year total: $0 | Three-year present value: $0 | |||||
Unquantified Benefits
Interviewees and survey respondents mentioned the following additional benefits that their organizations experienced but were not quantified in the study:
-
Improved learning outcomes. Microsoft 365 Education A5’s security, compliance, and privacy capabilities help create secure environments in which to teach and collaborate. Learning outcomes can also improve because of less downtime for teachers and students.
- The head of IT at the European private education trust explained that: “[Managing student laptops with Intune] means we are confident that we are giving them safe learning devices. This is especially important for the students struggling financially.”
- The infrastructure manager at the same school reported that teachers can now reset students' passwords, which reduced student downtime.
- The CIO at a public school system said remote teaching would be impossible without Microsoft 365 Education A5. For a newly launched all-virtual school, every student and teacher was provided with a Surface device. The CIO said, “This virtual model couldn’t operate without a great security environment.”
- Fifty-eight percent of survey respondents said that off-campus/hybrid learning improved.Forty-two percent reported that they could better provide learning experiences in secure and compliant ways. Forty-two percent also stated that accessibility and inclusiveness improved.
- Benefits from non-security Microsoft 365 Education A5 capabilities. The security features and benefits described in this study are just one part of the Microsoft 365 Education A5 suite. In addition to the education-specific capabilities, it provides other features a school system can use and save money by retiring other vendor solutions. Two that were called out by interviewees were Microsoft Teams Phone and Power BI.
- Ability to purchase and save money on cyber insurance. Interviewees shared that insurance providers were increasingly requiring additional security capabilities be in place. EDR was the one most cited. They also said that Microsoft 365 Education A5 contributed to their insurance premiums not increasing as fast as other schools’ rates.
-
Benefits from nonsecurity Microsoft 365 Education A5 capabilities. The security features and benefits described in this study are just one part of the Microsoft 365 Education A5 suite. In addition to the education-specific capabilities, it provides other features a higher ed organization can use and save money with by retiring other vendor solutions. Two that were called out by interviewees were Microsoft Teams Phone and Power BI.
- The VP technology and CIO at a four-year university reported saving a couple of hundred dollars per user because the organization replaced another analytics platform with Power BI. They also said replacing a wiki platform with Teams will save it $50,000 per year.
- One interviewee reported that their four-year university saved $250,000 per year by moving to Microsoft Teams Phone. It has also made Power Platform available to everyone to create citizen developers.
- An interviewee reported that their two-year technical college saved $100,000 per year because of the move to Microsoft Teams Phone.
-
Ability to purchase and save money on cyber insurance. Interviewees shared that insurance providers were increasingly requiring additional security capabilities be in place. EDR was the one most cited. They also said that Microsoft 365 Education A5 contributed to their insurance premiums not increasing as fast.
- One interviewee said that their four-year university had a 10% decrease in cyber insurance premium costs, although that could not be fully attributed to Microsoft 365 Education A5.
- The CIO and VP at another four-year university said: “Cyber insurance premiums have not gone up, probably because of A5. This is the first year our premium did not increase, and two of the biggest contributors were MFA and privileged access management.”
-
Enable secure remote learning and collaboration. Microsoft 365 Education A5’s security, compliance, and privacy capabilities helped create secure environments in which to teach and collaborate. Learning experiences also improved because of less downtime for teachers and students and because of better BYOD support for students.
- The VP of technology and CIO at a four-year university shared that Microsoft 365 Education A5 helped their institution during COVID-19 closures. They said, “Because everyone uses Azure AD, we were able to identify students who had not logged in and gave that list to student affairs for follow-up. That is a benefit of using tools that have great reporting capabilities.”
- The same interviewee said, “[Microsoft 365 Education improved] communication and consistency because online classes now go through Teams.”
- The CTO at a four-year university said: “Combining A5 security with Teams helps with our learn anywhere, work anywhere initiatives. With DLP, people can now collaborate in ways that are compliant.”
Flexibility
The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Microsoft 365 Education A5 and later realize additional uses and business opportunities, including:
- Implementing additional security features. All the interviewees explained that they continue to investigate the various security, compliance, and privacy features and that they intend to implement more of them in the future. These could replace other existing solutions and/or eliminate the need to purchase additional solutions. In both cases, this can result in additional cost savings.
-
Integrating with Microsoft Sentinel. Interviewees described different levels of use of Microsoft Sentinel. Some were fully deployed and ingesting signals from all the deployed Microsoft 365 Education A5 components. Others were in the process of integrating everything, and one was still planning their implementation. Everyone believed that the combination of Microsoft 365 Education A5 and Microsoft Sentinel creates better security and saves them more time.Protecting from future, unknown security threats. Interviewees talked about how the threat landscape is continually evolving and that Microsoft 365 Education A5 helps them prepare for that. They stressed that this would become more important in the future as attacks become more sophisticated, and that Microsoft’s continual investment in security, privacy, and compliance features would help them be ready.
Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Appendix A).
Quantified cost data as applied to the composite
Total Costs
| Ref. | Cost | Initial | Year 1 | Year 2 | Year 3 | Total | Present Value |
|---|---|---|---|---|---|---|---|
| Etr | Internal costs | $0 | $0 | $0 | $0 | $0 | $0 |
| Ftr | External costs | $0 | $0 | $0 | $0 | $0 | $0 |
| Total costs (risk-adjusted) | $0 | $0 | $0 | $0 | $0 | $0 |
Internal Costs
Evidence and data. Interviewees generally said that implementing the Microsoft 365 Education A5 security, compliance, and privacy features was easier than other past projects because of the native integration across all of the capabilities. Implementation times ranged from a couple of months to one year, depending on the size of the school system and the features initially being deployed.
Ongoing effort for Microsoft 365 Education A5 activities and implementing new policies and features was also described as relatively minor. The level of effort varied based on school size but typically came out to one-quarter of the team's time.
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- The initial implementation lasts nine months and requires 4.8 FTEs. These individuals come from various IT teams, including security, networking, and operations.
- Ongoing solution management requires 1.5 FTE.
- The average fully burdened cost for an IT security FTE is $77,000.
Risks. The size of this cost can vary because of:
- The size of the deployment based on solutions being added, the overall size of the organization, and the prior solutions replaced.
- The average fully burdened cost of these resources.
Results. To account for these risks, Forrester adjusted this cost upward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $621,000.
Evidence and data. Interviewees generally said that implementing the Microsoft 365 Education A5 security, compliance, and privacy features was easier than other past projects because of the native integration across all of the capabilities. Implementation times ranged from a couple of months to one year, depending on the size of the organization and the features initially being deployed.
The ongoing effort for Microsoft 365 Education A5 activities and implementing new policies and features was also described as relatively minor. The level of effort varied based on an organization’s size but typically came out to one-fifth of the team's time.
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- The initial implementation lasts nine months and requires 7.0 FTEs. These individuals come from various IT teams, including security, networking, and operations.
- Ongoing solution management requires 2.0 FTE.
- The average fully burdened cost for an IT security FTE is $112,500.
Risks. The size of this cost can vary because of:
- The size of the deployment based on solutions being added, the overall size of the organization, and the prior solutions replaced.
- The average fully burdened cost of these resources.
Results. To account for these risks, Forrester adjusted this cost upward by 5%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.2 million.
For system, these costs may have a three-year, risk-adjusted total PV of .
Internal Costs
| Ref. | Metric | Source | Initial | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|---|
| E1 | Number of months spent in implementation | Assumption | 0 | 0 | 0 | 0 | |
| E2 | Number of FTEs involved in implementation | Assumption | 0 | 0 | 0 | 0 | |
| E3 | Fully burdened cost of IT FTE | $0 | $0 | $0 | $0 | ||
| E4 | Implementation costs | E1*E2* (E3/12 months) | $0 | $0 | $0 | $0 | |
| E5 | Ongoing solution management (FTEs) | Assumption | 0 | 0 | 0 | 0 | |
| Et | Internal costs | E4+E5*E3 | $0 | $0 | $0 | $0 | |
| Risk adjustment | ↑10% | ||||||
| Etr | Internal costs (risk-adjusted) | $0 | $0 | $0 | $0 | ||
| Three-year total: $0 | Three-year present value: $0 | ||||||
External Costs
Evidence and data. External costs to the interviewees’ organizations mainly consisted of the incremental Microsoft 365 Education A5 subscription costs. Two interviewees used some upfront professional services to assist with the deployment, configurations, and implementation of best practices.
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- In Year 1, 2, and 3, the $51 increase in price from Microsoft 365 Education A3 to A5 is fully included even though it provides additional capabilities, such as Microsoft Teams Phone and Power BI, which were not included in the benefits section.
- The composite spends $50,000 on deployment professional services for the scope of work shown in the organization’s description. This is in addition to the free support that Microsoft sometimes provides.
Risks. The size of this cost can vary because of:
- The overall size of the organization.
- The number of professional services required.
Results. No risk adjustment was made because the list price is used, and the full, incremental cost is included. The three-year total PV is $1.3 million.
Evidence and data. External costs to the interviewees’ organizations mainly consisted of the incremental Microsoft 365 Education A5 subscription costs. Two interviewees used some upfront professional services to assist with the deployment, configuration, and implementation of best practices and for ongoing guidance on rolling out new security features.
Modeling and assumptions. For the financial analysis as applied to the composite organization, Forrester assumes:
- In Year 1, 2, and 3, the $51 increase in price from Microsoft 365 Education A3 to A5 is fully included even though it provides additional capabilities, such as Microsoft Teams Phone and Power BI, that were not included in the benefits section./span>
- The composite spends $50,000 on deployment professional services for the scope of work shown in the organization’s description. This is in addition to the free support that Microsoft sometimes provides. It also uses a smaller amount of ongoing professional services.
Risks. The size of this cost can vary because of:
- The overall size of the organization.
- The number of professional services required.
Results. No risk adjustment was made because the list price is used, and the full, incremental cost is included. The three-year total PV is about $2 million.
For system, these costs may have a three-year, risk-adjusted total PV of .
External Costs
| Ref. | Metric | Source | Initial | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|---|
| F1 | Number of A5 subscriptions | B1 | 0 | 0 | 0 | 0 | |
| F2 | Incremental A5 cost over A3 | $120 - $69 | $0 | $0 | $0 | $0 | |
| F3 | Incremental A5 subscription uplift cost | F1*F2 | $0 | $0 | $0 | $0 | |
| F4 | Professional services | Assumption | $0 | $0 | $0 | $0 | |
| Ft | External costs | F3+F4 | $0 | $0 | $0 | $0 | |
| Risk adjustment | 0% | ||||||
| Ftr | External costs (risk-adjusted) | $0 | $0 | $0 | $0 | ||
| Three-year total: $0 | Three-year present value: $0 | ||||||
Consolidated Three-Year Risk-Adjusted Metrics
Cash Flow Chart (Risk-Adjusted)
Total costs Total benefits Cumulative net benefits-
The financial results calculated in the Benefits and Costs sections can be used to determine the ROI, NPV, and payback period for the composite organization’s investment. Forrester assumes a yearly discount rate of 10% for this analysis.
These risk-adjusted ROI, NPV, and payback period values are determined by applying risk-adjustment factors to the unadjusted results in each Benefit and Cost section.
Cash Flow Analysis (Risk-Adjusted Estimates)
| Initial | Year 1 | Year 2 | Year 3 | Total | Present Value | |
|---|---|---|---|---|---|---|
| Total costs | $0 | $0 | $0 | $0 | $0 | $0 |
| Total benefits | $0 | $0 | $0 | $0 | $0 | $0 |
| Net benefits | $0 | $0 | $0 | $0 | $0 | $0 |
| ROI | 0% | |||||
| Payback | 0 |
Appendix A: Total Economic Impact
Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders.
Total Economic Impact Approach
-
Benefits represent the value delivered to the business by the product. The TEI methodology places equal weight on the measure of benefits and the measure of costs, allowing for a full examination of the effect of the technology on the entire organization.
-
Costs consider all expenses necessary to deliver the proposed value, or benefits, of the product. The cost category within TEI captures incremental costs over the existing environment for ongoing costs associated with the solution.
-
Flexibility represents the strategic value that can be obtained for some future additional investment building on top of the initial investment already made. Having the ability to capture that benefit has a PV that can be estimated.
-
Risks measure the uncertainty of benefit and cost estimates given: 1) the likelihood that estimates will meet original projections and 2) the likelihood that estimates will be tracked over time. TEI risk factors are based on “triangular distribution.”
The initial investment column contains costs incurred at “time 0” or at the beginning of Year 1 that are not discounted. All other cash flows are discounted using the discount rate at the end of the year. PV calculations are calculated for each total cost and benefit estimate. NPV calculations in the summary tables are the sum of the initial investment and the discounted cash flows in each year. Sums and present value calculations of the Total Benefits, Total Costs, and Cash Flow tables may not exactly add up, as some rounding may occur.
Appendix B: Interview And Survey Demographics
Interviews
| Role | School Type | Students | Faculty And Staff |
|---|---|---|---|
| CIO | Alternative education campus | 6,000 | 500 |
| Head of IT | Private education trust, Europe | 10,000 | 1,500 |
| Infrastructure manager | Private education trust, Europe | 10,000 | 1,500 |
| CIO | Public school district | 50,000 | 10,000 |
| Network administrator | Public school district | 21,000 | 5,000 |
| Network administrator | Public school district | 21,000 | 5,000 |
| Executive director of IT | Public school district | 21,000 | 5,000 |
Interviews
| Role | Higher Education Type | Students | Faculty And Staff |
|---|---|---|---|
| VP technology and CIO | Four-year state university | 9,000 | 2,000 |
| CISO | Four-year state university with medical school | 45,000 | 15,000 |
| CTO | Four-year state university with medical school | 15,000 | 15,000 |
| CIO and VP | Four-year state university with medical school | 55,000 | 15,000 |
| Security analyst | Two-year technical college | 20,000 | 1,700 |
| Security analyst | Two-year technical college | 20,000 | 1,700 |
| Director of technology | Two-year technical college | 20,000 | 1,700 |
In Which country are you located?
United States United Kingdom Canada Germany France Spain Ireland The Netherlands PolandBase: 67 decision-makers who have experience using and managing Microsoft 365 Education A5 at thier organizations
Source: A commissioned conducted by Forrester Consulting on behalf of Microsoft, April 2023
In Which country are you located?
United States United Kingdom Canada Germany Spain Ireland France The Netherlands PolandBase: 67 decision-makers who have experience using and managing Microsoft 365 Education A5 at thier organizations
Source: A commissioned conducted by Forrester Consulting on behalf of Microsoft, April 2023
Appendix C: Endnotes
1 In this study, security is sometimes used as a shorthand for security, compliance, and privacy.
2 Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders.
3 Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders.
4 Source: Forrester Consulting Cost Of A Cybersecurity Breach Survey, Q1 2021.
5 Source: Forrester Consulting Cost Of A Cybersecurity Breach Survey, Q1 2021.
PDF
