Microsoft 365 Business Premium, explained for small businesses

What Business Premium adds over Business Standard

Both plans give each user Exchange Online (Plan 1) mail, SharePoint, OneDrive and the Microsoft 365 desktop apps. Business Basic has the web and mobile apps only. The difference between Standard and Premium is almost entirely about security and management. Microsoft's licensing reference lists these service plans in Business Premium that are absent from Business Standard:

The licensing table also lists smaller items such as Windows 10/11 Business, Universal Print and Office shared computer activation. They rarely decide the choice.

When Premium is worth it

Look hard at Premium if any of these describe you:

• You own the laptops. Without Intune, nobody can see whether a device is encrypted or patched, and a lost laptop depends on its owner having set a good password.
• People work from home, client sites or overseas. Conditional Access is how you require MFA everywhere, block old sign-in methods, and stop sign-ins from devices you don't manage.
• An insurer, client or contract asks about the Essential Eight. Several of its controls (MFA, patching, application control, macro settings) are far easier to show with Intune, Entra ID P1 and Defender in place.
• You want new laptops delivered straight to staff. Windows Autopilot needs Entra ID P1 and an MDM service such as Intune. Business Premium is one of the subscriptions Microsoft lists as meeting that requirement.

When Business Standard can be enough

Standard can be the right call for a very small team with no company-owned computers, or where the only people who need the security layer are a handful of staff. Microsoft also sells Entra ID P1, Intune and Defender for Business separately, so a business can add them to Standard for selected users. Once you need the same protections for most of the team, it is worth costing that against moving everyone to Premium. Mixed licensing also makes the setup harder to reason about, because a Conditional Access rule only protects the people licensed for it.

If you have more than 300 users, the Business plans aren't designed for you. Look at the enterprise plans instead.

Common licensing mistakes

1. Assuming the licence switches the protection on. Business Premium gives you the tools. Conditional Access policies, Intune enrolment, compliance rules, Defender onboarding and Defender for Office 365 policies all have to be configured and checked. A tenant can hold Premium licences for years with very little of that done.
2. Forgetting the 300-seat ceiling. Microsoft's service description says the Business plans are designed for organisations of up to 300 users, and that it can enforce a tenant limit of 300 licences across the Business family combined. Two hundred and fifty Premium seats leave room for 50 more Business licences of any kind.
3. Leaving some users on Standard and expecting full coverage. Intune's licensing page says a licence is needed for any user or device that benefits from the service. A user without Intune or Entra ID P1 isn't properly covered by the device and access rules you build for everyone else.
4. Mixing Defender for Business with Defender for Endpoint Plan 2. Microsoft says Defender for Business doesn't support mixed licensing. If some users are licensed for Defender for Endpoint Plan 2 (for example through an E5 Security add-on), the whole organisation stays on the Defender for Business experience until every user is licensed for Plan 2 and Microsoft Support makes the switch.
5. Counting servers as covered. Defender for Business protects up to five client devices per user licence across Windows, Mac, iOS and Android. Windows or Linux servers need their own licence, such as the Defender for Business servers add-on.
6. Expecting risk-based sign-in policies. Policies that react to a risky sign-in or a risky user need Entra ID Protection, which is an Entra ID P2 feature. Business Premium includes P1. With P1 you see a limited risky sign-ins report without the risk detail or level. Microsoft lists P2 as included in the Defender Suite and the Defender and Purview Suites sold for Business Premium.
7. Buying licences nobody is assigned to. Seats bought but never assigned protect nobody, and Autopilot only enrols devices for users who have the licence assigned.

Why we add Defender for Endpoint Plan 2

Business Premium's endpoint protection is Defender for Business. Microsoft describes it as including the features of Defender for Endpoint Plan 1, some features of Plan 2, and some extras for smaller businesses. It is good protection. On the tenants we manage, we still license Microsoft Defender for Endpoint Plan 2 on top of Business Premium, for three reasons:

• Advanced hunting. Microsoft's comparison table gives advanced hunting over 30 days of data, and six months of data retention, to Defender for Endpoint Plan 2 and not to Defender for Business. Advanced hunting is a query tool for searching raw device, email and identity events for signs of an attack, and the same queries can run as custom detection rules.
• Richer signals for the security operations centre. Plan 2 includes the full endpoint detection and response feature set (Microsoft marks Defender for Business's version as "optimised") and the longer data retention. When our 24/7 cybersecurity remediation SOC investigates an alert, it has more history to work with.
• App Control for Business in the same stack. Application control lets a device run only code your policy trusts. Microsoft lists it among Defender for Endpoint Plan 1 capabilities, which Plan 2 extends, and it is also a Windows feature in its own right. So Plan 2 doesn't unlock it on its own; it simply puts App Control alongside hunting and detection in one place. App Control isn't switched on across a fleet from day one: we audit what your devices run, formulate a policy and work towards enforcing it over time.

Microsoft's mixed-licensing rule decides how this has to be bought. A tenant with Defender for Business and some Plan 2 licences stays on the Defender for Business experience. To get the Plan 2 experience, every user must be licensed for Plan 2, and the switch is then requested through Microsoft Support. So we license Defender for Endpoint Plan 2 for every managed user, not just some of them. As with every licence, it is passed through at cost.

How 365msp handles licensing

Jinba IT is a Microsoft CSP partner and passes licences through at its CSP price with no markup, so we earn nothing from recommending one plan over another. That is also why this page has no licence prices. They change, and you would see the same rate we pay. The free tenant review looks at your current licence mix against the users you actually have, and the Conditional Access baseline and Intune rollout guide show what Premium's components look like once they are switched on.