Microsoft 365 Business Premium is the plan most small and mid-sized firms are told to buy for security. That advice is right. The problem is what happens next: the licenses get assigned, the invoice gets paid, and most of the Microsoft 365 Business Premium security features stay switched off or half configured.
Below is a plain-English tour of what Business Premium actually includes, which parts I most often find unused, and a sensible order for turning them on.
What Business Premium includes for security
Business Premium is designed for organizations of up to 300 users. On top of the Microsoft 365 apps, email, and Teams that Business Standard includes, it adds a full security stack:
Component
What it protects
Where you configure it
Microsoft Entra ID P1
Sign-ins, with Conditional Access policies
Microsoft Entra admin center
Microsoft Intune Plan 1
Windows, macOS, iOS, and Android devices and apps
Microsoft Intune admin center
Microsoft Defender for Business
Endpoints: antivirus, attack surface reduction, endpoint detection and response
Microsoft Defender portal
Microsoft Defender for Office 365 Plan 1
Email and files: Safe Links, Safe Attachments, impersonation protection
Microsoft Defender portal
Microsoft Purview Information Protection and DLP
Sensitive data in email and files
Microsoft Purview portal
That is a lot of protection for one license. It also means five admin portals and a few hundred settings. No wonder much of it goes untouched.
The features I most often find switched off
1. Conditional Access
Many Business Premium tenants are still running on security defaults, or worse, on nothing at all. Entra ID P1 lets you build Conditional Access policies: require MFA on your terms, block legacy authentication, require compliant devices, and require phishing-resistant MFA for admins. This is usually the single biggest gain available.
2. Device enrollment in Intune
Intune only manages the devices that are enrolled. A common pattern is a tenant where a handful of laptops were enrolled during a pilot and the rest were never touched. Without enrollment you cannot push BitLocker encryption, Windows Update rings, firewall rules, or compliance policies.
3. Defender for Business onboarding
Defender for Business is equivalent to Microsoft Defender for Endpoint Plan 1 plus some Plan 2 features, such as endpoint detection and response and automated investigation. But a device has to be onboarded to be protected. Many firms still run a separate antivirus product and pay twice, or run only built-in Microsoft Defender Antivirus without the onboarding that gives you visibility in the portal.
4. Preset security policies for email
Defender for Office 365 Plan 1 includes Safe Links, Safe Attachments, and impersonation protection. Microsoft applies a Built-in protection preset for Safe Links and Safe Attachments, but impersonation protection is not configured until you apply the Standard or Strict preset, or build custom anti-phishing policies. In the tenants I review, Standard and Strict are often assigned to nobody.
5. App protection policies for phones
Intune app protection policies let staff use Outlook and Teams on personal phones while keeping company data inside managed apps. You can block copy and paste into personal apps and wipe company data without touching personal photos. This is ideal for bring-your-own-device setups, and it is frequently skipped.
6. Sensitivity labels and data loss prevention
Business Premium includes Purview Information Protection and DLP for email and files. A small set of labels (Public, Internal, Confidential) and a DLP policy that warns before someone emails a file of social security or card numbers outside the company covers a lot of real-world risk.
7. Windows Autopilot
Business Premium supports Windows Autopilot, which lets a new laptop ship straight from the supplier to an employee and configure itself on first sign-in: joined to Entra ID, enrolled in Intune, apps installed, security policies applied. Many firms still image laptops by hand or hand them out with local admin accounts. Autopilot removes that step and makes sure no device starts life unmanaged. It also makes resetting and reissuing a laptop after someone leaves a much shorter job.
A sensible rollout order
Turning everything on at once is how you generate a week of help desk tickets. This order balances risk reduction against disruption.
Identity first. Create emergency access accounts, then build Conditional Access policies in report-only mode: MFA for all users, stronger MFA for admins, block legacy authentication. Switch them on.
Email next. Apply the Standard preset security policy to all users and Strict to executives and finance. Turn off automatic external forwarding in the outbound spam policy.
Enroll devices. Set up Windows automatic enrollment, then enroll company laptops. Use Windows Autopilot for new devices.
Onboard to Defender for Business. Once devices are in Intune, onboarding is straightforward. Apply the default next-generation protection and firewall policies, then attack surface reduction rules in audit mode before enforcing them.
Protect phones. Deploy app protection policies for iOS and Android.
Require compliant devices. Add a Conditional Access policy that requires a compliant device for access to company data. Do this after enrollment, not before.
Protect data. Publish a small set of sensitivity labels and one or two DLP policies, starting in test mode.
For a 50-person firm, steps 1 and 2 can usually be done in a day. Steps 3 to 6 typically take a few weeks because they touch every device. Step 7 benefits from a conversation with department heads about what data actually matters.
Signs you are not getting your money’s worth
You still pay for a third-party antivirus on devices covered by Business Premium.
Your Intune device count is much lower than your staff count.
Security defaults are on, even though you own Entra ID P1.
The Preset security policies page shows Standard and Strict with no users assigned.
Nobody can tell you what a sensitivity label is.
Microsoft Secure Score shows a large gap between your current score and your current license score.
If two or more of these are true, you are paying for security you are not using.
Does Microsoft 365 Business Premium include Defender for Endpoint?
It includes Microsoft Defender for Business, which is built on Defender for Endpoint and designed for organizations up to 300 users. You can add Defender for Endpoint Plan 1 or Plan 2 separately if you need the full enterprise product.
Is Business Premium enough security for a regulated business?
For many firms in healthcare, legal, and finance, Business Premium covers the core controls auditors ask about: MFA, device management, encryption, email protection, and DLP. Some needs, like attack simulation training or risk-based sign-in policies, require add-ons or E5-level licensing.
How long does it take to configure Business Premium security?
Identity and email protections can be in place within days. Full device enrollment, Defender onboarding, and data protection usually take a few weeks, depending on how many devices you have and how they were set up.
Want to know which Business Premium features are switched off in your tenant? Book a free Microsoft 365 security assessment and we will show you exactly what you are paying for and not using.
Microsoft 365 Business Premium is the plan most small and mid-sized firms are told to buy for security. That advice is right. The problem is what happens next: the licenses get assigned, the invoice gets paid, and most of the Microsoft 365 Business Premium security features stay switched off or half configured.
Below is a plain-English tour of what Business Premium actually includes, which parts I most often find unused, and a sensible order for turning them on.
What Business Premium includes for security
Business Premium is designed for organizations of up to 300 users. On top of the Microsoft 365 apps, email, and Teams that Business Standard includes, it adds a full security stack:
That is a lot of protection for one license. It also means five admin portals and a few hundred settings. No wonder much of it goes untouched.
The features I most often find switched off
1. Conditional Access
Many Business Premium tenants are still running on security defaults, or worse, on nothing at all. Entra ID P1 lets you build Conditional Access policies: require MFA on your terms, block legacy authentication, require compliant devices, and require phishing-resistant MFA for admins. This is usually the single biggest gain available.
2. Device enrollment in Intune
Intune only manages the devices that are enrolled. A common pattern is a tenant where a handful of laptops were enrolled during a pilot and the rest were never touched. Without enrollment you cannot push BitLocker encryption, Windows Update rings, firewall rules, or compliance policies.
3. Defender for Business onboarding
Defender for Business is equivalent to Microsoft Defender for Endpoint Plan 1 plus some Plan 2 features, such as endpoint detection and response and automated investigation. But a device has to be onboarded to be protected. Many firms still run a separate antivirus product and pay twice, or run only built-in Microsoft Defender Antivirus without the onboarding that gives you visibility in the portal.
4. Preset security policies for email
Defender for Office 365 Plan 1 includes Safe Links, Safe Attachments, and impersonation protection. Microsoft applies a Built-in protection preset for Safe Links and Safe Attachments, but impersonation protection is not configured until you apply the Standard or Strict preset, or build custom anti-phishing policies. In the tenants I review, Standard and Strict are often assigned to nobody.
5. App protection policies for phones
Intune app protection policies let staff use Outlook and Teams on personal phones while keeping company data inside managed apps. You can block copy and paste into personal apps and wipe company data without touching personal photos. This is ideal for bring-your-own-device setups, and it is frequently skipped.
6. Sensitivity labels and data loss prevention
Business Premium includes Purview Information Protection and DLP for email and files. A small set of labels (Public, Internal, Confidential) and a DLP policy that warns before someone emails a file of social security or card numbers outside the company covers a lot of real-world risk.
7. Windows Autopilot
Business Premium supports Windows Autopilot, which lets a new laptop ship straight from the supplier to an employee and configure itself on first sign-in: joined to Entra ID, enrolled in Intune, apps installed, security policies applied. Many firms still image laptops by hand or hand them out with local admin accounts. Autopilot removes that step and makes sure no device starts life unmanaged. It also makes resetting and reissuing a laptop after someone leaves a much shorter job.
A sensible rollout order
Turning everything on at once is how you generate a week of help desk tickets. This order balances risk reduction against disruption.
For a 50-person firm, steps 1 and 2 can usually be done in a day. Steps 3 to 6 typically take a few weeks because they touch every device. Step 7 benefits from a conversation with department heads about what data actually matters.
Signs you are not getting your money’s worth
If two or more of these are true, you are paying for security you are not using.
Our Microsoft 365 services team can configure the full Business Premium stack. For the device side, see Intune deployment and Defender for Endpoint. Microsoft’s Microsoft 365 for business security overview compares what each business plan includes.
Frequently asked questions
Does Microsoft 365 Business Premium include Defender for Endpoint?
It includes Microsoft Defender for Business, which is built on Defender for Endpoint and designed for organizations up to 300 users. You can add Defender for Endpoint Plan 1 or Plan 2 separately if you need the full enterprise product.
Is Business Premium enough security for a regulated business?
For many firms in healthcare, legal, and finance, Business Premium covers the core controls auditors ask about: MFA, device management, encryption, email protection, and DLP. Some needs, like attack simulation training or risk-based sign-in policies, require add-ons or E5-level licensing.
How long does it take to configure Business Premium security?
Identity and email protections can be in place within days. Full device enrollment, Defender onboarding, and data protection usually take a few weeks, depending on how many devices you have and how they were set up.
Want to know which Business Premium features are switched off in your tenant? Book a free Microsoft 365 security assessment and we will show you exactly what you are paying for and not using.