Business Premium: paid-for security features nobody has switched on

Microsoft 365 Business Premium includes a whole range of security features that smaller companies would otherwise have to buy one by one. Yet in a first tenant review I find the same thing almost every time: the licence is paid for, but the features are not set up. This article covers what the licence contains, where I start, and where Business Premium reaches its limits. The observations come from tenant reviews, most recently in 2026.

What I usually find on a first look at the tenant

The most common surprise is not an exotic gap but basic settings. Licences are paid for but not assigned to anyone, or they keep running for people who have left. The tenant runs in its default configuration, where the security features exist but are not switched on.

• Multi-factor authentication is active for only some accounts, or none at all.
• Individual accounts hold permanent global admin rights, and people use them for everyday work.
• Accounts of former staff are still active or licensed.
• SPF, DKIM and DMARC for the email domain are incomplete.
• Sharing with external people is possible without restriction, and it is being used.
• There is no Microsoft 365 backup beyond the recycle bin.

No single switch fixes any of these. Each security feature has to be adapted once to the way the company works, its devices and its responsibilities. That is exactly the step companies often skip after buying the licence.

Which security features does Business Premium include?

Then there is Windows LAPS, which rotates the passwords of local administrator accounts regularly and stores them centrally. LAPS itself is free; in practice I manage it through Intune. I rarely find this set up at Business Premium customers either.

Why the security defaults are not enough

Every new tenant starts with Microsoft’s security defaults. They enforce multi-factor authentication and block legacy sign-in methods. That is better than nothing, but you cannot adjust them: no exclusions for emergency accounts, no rules by device or location, no graded treatment of administrators. With Business Premium I therefore replace the security defaults with Conditional Access as early as possible. That happens during the initial assessment, not at the end of a project.

Where I start

1. Emergency accounts and Conditional Access. First I create two emergency access accounts that are excluded from the access rules and specially protected. Then come the rules themselves: multi-factor authentication for everyone, legacy sign-in blocked, stricter requirements for administrators.
2. Time-limited admin rights. I replace permanent global administrators with rights that an administrator activates for a limited time when needed, with a justification and an audit trail. This is what Privileged Identity Management (PIM) does.
3. Defender for Office 365. I switch on Safe Links, Safe Attachments and extended phishing protection through the preset security policies and then adapt them to the environment.

After that come Intune with encryption and compliance policies, Defender for Business on the devices, LAPS, archiving and information protection. The order depends on what I find. The first three steps, however, are almost always at the start.

Basic and Standard are no longer enough

Many clients still work with Business Basic or Business Standard. Both licences only include the free tier of Entra ID, and so no Conditional Access. They also lack device management with Intune and endpoint protection with EDR. If you want to manage devices centrally, I advise against buying Business Standard.

The same applies the other way round. For companies with fewer than 300 users I usually consider E3 or E5 unnecessary. Business Premium for staff and targeted add-on licences such as Entra ID P1 or P2 for IT cover most requirements. What Business Premium costs by comparison, and how Copilot fits in, I have worked through in the article on the Copilot and Business Premium bundle price.

What can be dropped afterwards

Once the included features are set up, the question is which additional products you still need. Some clients were then able to cancel a separate endpoint protection product and an upstream mail gateway. I mainly use additional email protection where the licence does not include Defender for Office 365. That is not a general recommendation: where an additional service adds clear value, it stays. But I only make that decision once it is clear what the licence you already pay for can do.

Frequently asked questions

Are Microsoft’s security defaults enough?

No. The security defaults enforce multi-factor authentication and block legacy sign-in methods, but you cannot adjust them: no exclusions for emergency accounts, no rules by device or location. With Business Premium I therefore replace them with Conditional Access as early as possible.

Is PIM included in Business Premium?

No, Privileged Identity Management (PIM) is not one of the security features in Business Premium. It requires Entra ID P2 or Entra ID Governance. Only the accounts that activate or approve admin rights need that licence, so a few add-on licences for IT are usually enough.

Do small companies need Microsoft 365 E3 or E5?

For companies with fewer than 300 users I usually consider E3 or E5 unnecessary. Business Premium for staff and targeted add-on licences such as Entra ID P1 or P2 for IT cover most requirements.

Sources

• Security features by licence: Microsoft Learn – Microsoft 365 for business security overview
• Conditional Access: Microsoft Learn – What is Conditional Access?
• Security defaults: Microsoft Learn – Security defaults in Microsoft Entra ID
• Emergency access accounts: Microsoft Learn – Manage emergency access accounts
• Licence requirements for PIM: Microsoft Learn – Microsoft Entra ID Governance licensing fundamentals
• Defender for Business: Microsoft Learn – Microsoft Defender for Business overview
• Defender for Office 365: Microsoft Learn – Microsoft Defender for Office 365 overview
• Sensitivity labels: Microsoft Learn – Learn about sensitivity labels
• Archiving: Microsoft Learn – Exchange Online Archiving service description
• Autopilot: Microsoft Learn – Overview of Windows Autopilot
• Self-service password reset: Microsoft Learn – Licensing requirements for Microsoft Entra self-service password reset
• Windows LAPS: Microsoft Learn – What is Windows LAPS?