Most small businesses on Microsoft 365 Business Premium are using it as an expensive version of Business Standard: the same Office apps, the same email, the same Teams, plus a bigger bill. The extra money buys a set of security tools that, in our experience, sit unused in the majority of accounts we are asked to look at. Not because they are hard to use, but because nobody switched them on.
This post goes through what is actually in the box, in plain terms, what each piece protects you from, and which ones we would turn on first. If you are paying for Business Premium and cannot say with confidence that each of these is running, you are paying for security you do not have.
First, what Business Premium is
Business Premium is Business Standard plus a security and management layer. The productivity side is the same as the cheaper plan: Office apps on up to five computers, five tablets and five phones per person, a 50 GB mailbox, 1 TB of file storage each, Teams, SharePoint and the rest. The difference is roughly a dozen security products that Microsoft bundled in, several of which used to be sold separately to large companies at prices small businesses could not justify. We looked at the value question in is Business Premium worth it?; this post is about using what you have already decided to pay for.
1. Conditional access: rules about who gets in, and from where
This is the most important feature in the licence and the one most often left idle. Conditional access lets you write rules about sign-ins: require MFA for everyone, block sign-ins from countries you do not operate in, and, most valuably, only allow company data to be opened on company-managed devices.
That last rule is the one we would turn on first in any business. It means a stolen password, or even a stolen sign-in, is useless from a criminal’s laptop or a staff member’s unmanaged home PC, because the device itself is not on the list. Without it, anyone who gets hold of a password and talks their way past MFA is in.
What it stops: account takeover, data walking out on personal devices, sign-ins from places you have never been.
2. Defender for Business: proper detection on every device
Business Premium includes Defender for Business, which is a real endpoint detection and response product, not the free Defender antivirus that comes with Windows. It watches for behaviour rather than just known bad files, can automatically isolate a machine from the network the moment it sees something that looks like ransomware starting, and gives a single view of every device’s health.
It is also the “EDR on every endpoint” that cyber insurers now ask about. Many businesses are buying a separate product to answer that question while already paying for this one.
What it stops: ransomware spreading past the first machine, malware that antivirus misses, and the awkward moment when the insurer asks what you had running.
3. Defender for Office 365: protection against the email that gets through
Standard email filtering catches obvious spam. Defender for Office 365 (Plan 1 is included) adds the pieces that deal with targeted attacks: it rewrites links so they are checked at the moment someone clicks them, not just when the email arrived; it opens attachments in a safe environment first; and it watches for impersonation, the emails that look like they come from your managing director or your biggest supplier but do not.
What it stops: fake invoice scams, links that turn malicious after delivery, and the “can you urgently buy some gift cards” emails that still work far too often.
4. Intune: knowing and controlling every device
Intune is the device management side. It lets you enrol every company computer and phone, push settings and apps to them, enforce disk encryption so a lost laptop is just a lost laptop, require a PIN on phones that hold company email, and wipe company data from a device remotely when someone leaves or loses it.
It is also what makes rule number one possible. Conditional access can only insist on “company-managed devices” if something is managing them, and that something is Intune. The two features are a pair.
What it stops: data loss from lost or stolen devices, ex-employees keeping access on their phone, and the slow drift where every computer in the business is set up differently.
5. Information protection: labels and limits on sensitive data
Purview Information Protection lets you label documents and emails (internal, confidential, client data) and attach rules to those labels: encrypt it, stop it being forwarded outside the business, warn someone before they email a spreadsheet full of tax file numbers to a personal address. There are also basic data loss prevention rules that look for things like credit card and bank account numbers in outgoing email.
It takes a little thought to set up well, so we would not start here, but for accounting, legal and healthcare practices it is often the difference between a near miss and a reportable breach.
What it stops: sensitive data leaving by accident, and the “reply all” that attaches the wrong file.
6. Email archiving and retention
Exchange Online Archiving gives each mailbox a large archive and lets you set retention rules, so email is kept for as long as you need it for legal or professional reasons and then disposed of properly. Unexciting, until a dispute or a records request arrives and you need to produce three-year-old correspondence.
What it stops: lost records, overflowing mailboxes, and expensive scrambles when someone asks for old email.
7. Global Secure Access: the newest one, and almost nobody has it on
This is a recent addition and the least known. The part included in Business Premium routes your Microsoft 365 traffic through Microsoft’s own network and lets you add a rule that a sign-in only counts if it comes through that connection. In practice, that means a stolen sign-in replayed from a criminal’s computer is refused even if it passed MFA. We wrote it up in detail in Global Secure Access: free, powerful, off by default.
What it stops: the stolen-sign-in attack that is currently the most common way small businesses get breached.
Also in the box
A few more that are worth knowing about: self-service password reset so people stop phoning you about lockouts; Windows Autopilot, which lets a new laptop set itself up from the box with your settings and apps; and support for passkeys and phishing-resistant sign-in, which we think is where passwords are heading (see passkeys explained).
Where to start
If you do nothing else, do these three in this order:
- Enrol every device in Intune and turn on disk encryption. This is the foundation everything else rests on.
- Turn on conditional access: MFA for everyone, and company data on company-managed devices only. This single rule removes most of the ways a business like yours gets broken into.
- Deploy Defender for Business to every computer and set it to isolate automatically. Then make sure someone is actually looking at the alerts.
After that, email protection, information labels and Global Secure Access in whatever order suits your risk.
None of this requires buying anything. It requires someone who knows the licence to spend the time setting it up properly and then keep it running, which is a fair description of what managed Microsoft 365 is. It also lines up almost exactly with the Essential Eight, which is why we keep saying that for most small businesses the gap is not the tools, it is switching them on.
If you would like to know which of these are actually running in your business, we can check and give you a plain list of what is on, what is off, and what we would do first. Get in touch.
Adam leads the Itopia team in Brisbane, helping professional-services firms get secure, productive and confident with their technology, in plain English.