How is Microsoft Defender for Identity licenced if you are purchasing standalone licences?

How is this product licenced if I am buying standalone licences at £4.20? We only have E3 so will need to buy the licenses individually and the documentation does not make it clear how it is licensed outside of E5. 

Is this per user who is in the AD domain? Or Per Domain Controller?

Does it have to be installed on every Domain Controller in the domain?

The documentation from what I can see does not seem to cover these points