Microsoft 365 Business Premium: security features you can use
Conditional Access, Intune, Defender and archiving are included in Business Premium but still have to be set up. What the licence contains, where I start and why PIM needs an add-on licence.
Microsoft 365 Business Premium includes tools to protect accounts, devices and company data. Which of them actually protect your business depends on how they are set up. I explain which security features I check when I take over an environment and when it is worth adjusting them. The observations come from tenant reviews, most recently in 2026.
What I often find in the tenants I review
The most common surprise is not an exotic gap but basic settings. Licences are paid for but not assigned to anyone, or they keep running for people who have left. In several environments the tenant was still running in its default configuration: the features were licensed but not set up.
- Multi-factor authentication is active for only some accounts, or none at all.
- Individual accounts hold permanent global admin rights, and people use them for everyday work.
- Accounts of former staff are still active or licensed.
- SPF, DKIM and DMARC for the email domain are incomplete.
- Sharing with external people is possible without restriction, and it is being used.
- There is no Microsoft 365 backup beyond the recycle bin.
No single switch fixes any of these. Each security feature has to be adapted once to the way the company works, its devices and its responsibilities. That is exactly the step companies often skip after buying the licence.
Which security features does Business Premium include?
Part of Entra ID P1. Rules for who may sign in from where, with which device and under which conditions. The basis for everything else.
Management of Windows, macOS, iOS and Android: encryption, updates, apps and compliance. Access rules only become effective once devices are managed.
Endpoint protection with detection and response (EDR) and automated investigation, designed for companies with up to 300 users.
Safe Links and Safe Attachments check links and attachments in email as well as files in SharePoint, OneDrive and Teams, plus extended phishing protection.
Sensitivity labels and data loss prevention policies for email and files through Microsoft Purview.
Exchange Online Archiving is included, but the archive mailbox has to be enabled for each user.
New Windows devices set themselves up with applications and policies as soon as the user signs in.
Staff reset their own passwords, and with an on-premises Active Directory the change is written back there too. Writeback is missing from Basic and Standard.
Then there is Windows LAPS, which rotates the passwords of local administrator accounts regularly and stores them centrally. LAPS itself is free; in practice I manage it through Intune. I rarely find this set up at Business Premium customers either.
Security defaults or Conditional Access?
Every new tenant starts with Microsoft’s security defaults. They enforce multi-factor authentication and block legacy sign-in methods. That is effective baseline protection, but you cannot adjust it: no exclusions for emergency accounts, no rules by device or location, no graded treatment of administrators.
Cannot be expressed. The rules are the same for everyone, with no distinction by device or location.
The accounts team only opens mail and files on managed company devices. Field staff may also use their phones on the road, but only through the protected Outlook app.
With Business Premium I therefore replace the security defaults with Conditional Access early on, usually during the initial assessment.
Where I start
- Emergency accounts and Conditional Accessmulti-factor authentication for everyone, legacy sign-in blockedFirst
- Time-limited admin rightsPIM, with a justification and an audit trail
- Defender for Office 365Safe Links, Safe Attachments, extended phishing protection
- Everything elseIntune, Defender for Business, LAPS, archiving, information protection
The two emergency access accounts are excluded from the access rules and specially protected. Administrators face stricter requirements. I replace permanent global administrators with rights that an administrator activates for a limited time when needed. This is what Privileged Identity Management (PIM) does; the accounts involved need an add-on licence for it. I switch on Defender for Office 365 through the preset security policies and then adapt them to the environment.
From the fourth step on, the order depends on what I find. I set up Intune with encryption and compliance policies, and Defender for Business on the devices.
What Basic and Standard do not include
Many clients still work with Business Basic or Business Standard. Both licences only include the free tier of Entra ID, and so no Conditional Access. They also lack device management with Intune and endpoint protection with EDR. Whether that matters depends on your needs and on what other safeguards are in place. If you want to manage devices centrally or make access depend on conditions, Basic or Standard need add-on licences, and Business Premium is often the simpler option.
| Feature | Basic | Standard | Premium |
|---|---|---|---|
| Conditional Access (Entra ID P1) | – | – | ✓ |
| Device management with Intune | – | – | ✓ |
| Endpoint protection with EDR (Defender for Business) | – | – | ✓ |
| Safe Links and Safe Attachments (Defender for Office 365) | – | – | ✓ |
| Sensitivity labels and data loss prevention (Purview) | – | – | ✓ |
The same applies the other way round. For companies with fewer than 300 users I usually consider E3 or E5 unnecessary. Business Premium for staff and targeted add-on licences such as Entra ID P1 or P2 for IT cover most requirements. What Business Premium costs by comparison, and how Copilot fits in, I have worked through in the article on the Copilot and Business Premium bundle price.
What can be dropped afterwards
Once the included features are set up, the question is which additional products you still need. Some clients were then able to cancel a separate endpoint protection product and an upstream mail gateway. I mainly use additional email protection where the licence does not include Defender for Office 365. That is not a general recommendation: where an additional service adds clear value, it stays. But I only make that decision once it is clear what the licence you already pay for can do.
Frequently asked questions
Are Microsoft’s security defaults enough?
As baseline protection, yes. The security defaults enforce multi-factor authentication and block legacy sign-in methods. But you cannot adjust them: there are no exclusions for emergency accounts and no rules by device or location. With Business Premium I therefore replace them with Conditional Access.
Is PIM included in Business Premium?
No, Privileged Identity Management (PIM) is not one of the security features in Business Premium. It requires Entra ID P2 or Entra ID Governance. Only the accounts that activate or approve admin rights need that licence, so a few add-on licences for IT are usually enough.
Do small companies need Microsoft 365 E3 or E5?
For companies with fewer than 300 users I usually consider E3 or E5 unnecessary. Business Premium for staff and targeted add-on licences such as Entra ID P1 or P2 for IT cover most requirements.
Sources
- Security features by licence: Microsoft Learn – Microsoft 365 for business security overview
- Conditional Access: Microsoft Learn – What is Conditional Access?
- Security defaults: Microsoft Learn – Security defaults in Microsoft Entra ID
- Emergency access accounts: Microsoft Learn – Manage emergency access accounts
- Licence requirements for PIM: Microsoft Learn – Microsoft Entra ID Governance licensing fundamentals
- Defender for Business: Microsoft Learn – Microsoft Defender for Business overview
- Defender for Office 365: Microsoft Learn – Microsoft Defender for Office 365 overview
- Sensitivity labels: Microsoft Learn – Learn about sensitivity labels
- Archiving: Microsoft Learn – Exchange Online Archiving service description
- Autopilot: Microsoft Learn – Overview of Windows Autopilot
- Self-service password reset: Microsoft Learn – Licensing requirements for Microsoft Entra self-service password reset
- Windows LAPS: Microsoft Learn – What is Windows LAPS?
Employee training with Campus: mandatory training, onboarding and records in one place
Data protection training, phishing, new employees: how Campus organises mandatory training with deadlines, onboarding and records for small companies, from the reminder to the annual report.
Read article→
How to secure Microsoft 365: the key settings for small companies
Which Microsoft 365 settings come first, which licence they need and what is possible without Business Premium. An overview for managing directors and the people responsible internally.
Read article→
PHP2Shell: is my website affected by the PHP vulnerability?
Two critical vulnerabilities in PHP threaten millions of websites, and updating WordPress does not help. Who is affected, why a patch alone is not enough and how I check your website.
Read article→