Microsoft 365 Is Already Your Security Platform. Most Businesses Never Switch It On.

All three plans are for businesses with up to 300 users. All three give you business email with a 50 GB mailbox, Teams, 1 TB of OneDrive storage per person, and Copilot Chat. Where they differ is in two things: whether you get the desktop Office apps, and how much security and device management is built in.

Sources: Microsoft Learn, "Microsoft 365 for business security overview" (updated December 2025) and "Microsoft 365 for business overview" (May 2026); Microsoft UK Defender for Business page for the Business Premium price.

Who each plan suits

Business Basic is the right answer for people who genuinely only need email and Teams and work in a browser: front-line staff, a shared inbox, a part-timer who never opens Excel. It is not a defective product. It is a small one.

Business Standard is the classic "email and Office" plan, and for many years it was what a small business bought without thinking. It is still fine for a business that has strong security elsewhere and someone to manage it, or for businesses that need the desktop apps but have very few devices to look after.

Business Premium is the one to buy when the business owns laptops, holds client or personal data, has people working from home or on the move, or has to answer a supplier, insurer or Cyber Essentials questionnaire about how it protects itself. That is most businesses we meet, which is why the next section exists.

None of these is a legal requirement. Microsoft does not require you to buy Premium, and neither does any UK regulation. What follows is our professional recommendation, and we will tell you if we think it does not apply to you.

The usual objection is fair: "We already have email and Office. Why would we pay more for the same apps?"

Because the apps are the smallest part of what Premium adds. For roughly the price of a decent third-party antivirus plus a device-management tool plus an email-security add-on, bought separately from three vendors and never properly joined up, Premium gives you all three from one place, designed to work together. In plain terms, here is what it adds and what that means for a business:

The part most people miss

Every one of those capabilities arrives switched off, or on defaults that were chosen to avoid breaking things, not to protect you. Microsoft's own documentation tells administrators to configure Conditional Access, assign the preset email security policies, enrol devices and set compliance rules after setup. A Premium licence that nobody configured protects you only slightly better than Standard.

That is the reason we describe Premium as a baseline rather than a solution. It is the right set of tools. The value is in the hands that set them up and keep them set up, which is the subject of the two sections after next.

When a different approach is right

• Mixed licensing is normal. A 40-person firm might put 25 people who handle client data on Premium and 15 shop-floor or part-time staff on Basic. Conditional Access and Intune policies apply per user, so this works, provided the boundary is deliberate.
• Businesses over 300 users need the enterprise plans (Microsoft 365 E3 or E5), which have their own Defender and Intune components.
• Businesses with a strong existing security stack (a managed EDR they trust, an email-security gateway, a device-management platform) may be better off on Standard and keeping what works, at least until renewals line up. Paying twice for overlapping tools is a real cost and we will say so.

The add-on is called Microsoft Defender Suite for Business Premium. Until late 2025 it was sold as "Microsoft 365 E5 Security for Business Premium", and you will still see that name in older quotes. It can only be added to Business Premium licences, and it is not the same thing as Defender for Business, which Premium already includes.

The simplest way to understand it: Business Premium gives you the "Plan 1" versions of Microsoft's security products. The Defender Suite upgrades them to the "Plan 2" versions used by large enterprises, and adds two products Premium does not have at all.

Source: Microsoft Learn, "Add Microsoft Defender Suite for Business Premium to your subscription" (September 2025, updated April 2026).

UK price: [TO CONFIRM. Microsoft does not publish a UK web price for the add-on; UK resellers list it at around £9.24 per user per month on an annual commitment (Nov 2025). Quote from the current CSP price list.]

Do you need it? Not to start. Business Premium, properly configured and monitored, is a strong baseline for a typical small business. The Defender Suite is the next step for businesses that hold sensitive data, run any on-premises Active Directory, face regulatory or insurer expectations for detection and response, or want the automation that makes a small security team look like a larger one. Because it is priced per user, it can be applied to the finance team and the directors first.

How the three layers fit together

Buying the licence is the easy bit. Microsoft ships these tools with defaults that are safe to switch on, which is not the same as configured to protect a specific business. The work that turns a Premium licence into protection is ours, and it is the reason clients choose us over buying the same licences from a web form.

We're outstanding in our field for a reason: our engineers do this configuration every week, across many tenants, and we see which settings stop real attacks and which ones generate noise. [TO CONFIRM: proof points to insert here, e.g. certifications such as Cyber Essentials Plus or ISO 27001, Microsoft partner status, number of tenants under management, named client testimonials.]

What we configure [TO CONFIRM against our service scope]

• Identity and access. MFA for everyone with phishing-resistant methods for admins, Conditional Access policies that match how your people actually work (office, home, travelling), separate admin accounts, and a break-glass account that is tested.
• Devices. Every laptop and phone enrolled in Intune, disk encryption enforced, updates managed, compliance rules that block an out-of-date or unencrypted device from reaching company data, and a tested remote wipe.
• Email protection. The Defender for Office 365 preset policies applied and tuned, impersonation protection listing your directors and key suppliers, Safe Links and Safe Attachments on, and SPF, DKIM and DMARC set correctly so your own domain cannot be spoofed. You can check your domain's current state with our free domain security audit.
• Data. Sensitivity labels that match how you talk about information ("internal", "client confidential"), and DLP rules for the data you are most worried about losing.
• Policies and alerts. Alerting tuned so that a real incident is unmistakable and a false alarm does not wake anyone. The alerts are then routed to our SOC, which is the next section.

Why it has to be maintained

Microsoft changes these products monthly. New Conditional Access options appear, defaults shift, features are renamed, and every new starter, leaver and laptop is a change to your security posture. A configuration that was excellent in January is merely adequate by summer if nobody has touched it.

Our managed service keeps it current: changes are reviewed rather than accidental, new capabilities are adopted deliberately, joiners and leavers are handled the same way every time, and you get a plain-English report on where you stand. Secure Score, Microsoft's own measure of a tenant's configuration, is one of the numbers we track for clients over time. [TO CONFIRM: reporting cadence and format.]

A Security Operations Centre, or SOC, is a team of people whose job is to watch the alerts your security tools produce, decide which ones matter, and act on the ones that do. The tools generate the signals; the SOC supplies the judgement and the urgency.

Small businesses have historically had no SOC at all. Defender, Entra and Intune generate alerts, but if nobody reads them at two in the morning the alert is a diary entry, not a defence. Attackers know this. Account takeovers and ransomware deployments cluster in the evenings, at weekends and over bank holidays precisely because that is when nobody is looking.

Our 24/7/365 SOC service closes that gap. In outline:

1. Monitoring. Alerts from Defender, Entra ID and the wider Microsoft 365 tenant flow to our SOC platform around the clock. [TO CONFIRM: exact sources monitored, and whether the service requires Business Premium, the Defender Suite, or both.]
2. Investigation. An analyst looks at the alert in context: is this the finance director logging in from a hotel, or an attacker with her password? Most alerts end here, closed as benign, without disturbing you.
3. Escalation and response. Confirmed incidents are escalated to you and to our engineers according to an agreed procedure. [TO CONFIRM: containment actions the SOC is authorised to take directly, such as isolating a device with Defender, revoking sessions or disabling an account, versus actions that require your approval; response-time commitments; who is contacted and how.]

An illustrative out-of-hours incident

This scenario is illustrative. It is not a customer story.

It is 11:40 on a Saturday night. A member of staff, on holiday, taps a link in a text message that looks like a parcel notification and enters their Microsoft 365 password on a convincing fake page. Because MFA is enforced, the attacker cannot simply log in, so they try again and again, hoping the user approves a push notification by reflex.

Entra ID flags the unfamiliar sign-in attempts and the pattern of MFA prompts. The alert reaches our SOC within minutes. An analyst confirms the sign-ins originate from an address and country the user has never used, sees the failed MFA attempts, and escalates. Under the agreed procedure [TO CONFIRM], the account's active sessions are revoked and the password is reset so the stolen credential is useless, and the user is contacted on Sunday morning to re-enrol. An engineer checks the mailbox on Monday for forwarding rules or other tampering.

The point of the story is not that the attack was stopped, though in this case it was. It is that the alert was read, at 11:40 on a Saturday, by someone who knew what it meant. No system prevents every attack, and we will never tell you otherwise. Monitoring means that when something gets through, you find out in minutes rather than in the invoice fraud three weeks later.

Four situations we see in real businesses. Each one shows the Microsoft technology involved, the configuration it needs to actually work, and the part our managed service plays. None of these are customer stories and there are no invented statistics.

The common thread: in every case the technology already exists in the licence, the configuration is what makes it work, and the managed service is what turns an alert into an outcome.

There are three separate costs, and it helps to keep them apart.

1. Microsoft licences. Business Premium is £16.90 per user per month on an annual commitment, excluding VAT, at Microsoft's UK price on 10 September 2026 (£14.40 without Teams). Monthly-commitment billing costs more. Basic and Standard are cheaper; confirm current figures against Microsoft's UK price list or ask us.
2. Additional security licences. Microsoft Defender Suite for Business Premium, per user, only where it is justified [TO CONFIRM price]. Defender for Business servers if you still run Windows servers [TO CONFIRM price; a low per-server monthly add-on]. Microsoft 365 Copilot if you want it; see our Copilot guide.
3. Our managed service. Configuration, ongoing management and SOC monitoring are priced separately from the licences, per user or per device. [TO CONFIRM: pricing model and starting price.] This is the cost that most often gets compared with "just buying the licence", so it is worth being clear about what it buys: the setup that makes the licence work, the people who keep it working, and someone reading the alerts at night.

Overlapping tools

Moving to Premium often means you can stop paying for things: a third-party antivirus, a separate email-security add-on, a device-management tool, a standalone password or MFA product, sometimes a backup product bundled with the old antivirus. We list these in the licence review. It is common for the removed subscriptions to offset a meaningful part of the Premium uplift, though we will not put a number on that until we have seen your invoices.

A transparent example (illustrative)

A 20-person business currently on Business Standard with a separate antivirus:

The honest summary: the licence uplift is usually smaller than people expect once overlaps are removed, and the managed service is the larger line. What you are paying for is not the software. It is the configuration, the maintenance and the monitoring, which is where the protection actually comes from.

We do not quote breach-cost statistics or "return on investment" for security. The value is a business that keeps trading when something goes wrong, and an honest answer to your insurer's and your customers' questions about how you protect their data.

[TO CONFIRM: the steps below describe our proposed delivery process and should be checked against how we actually deliver.]

1. Discovery call. How your business works, what you have today, what worries you. Outcome: a clear view of your current position and whether this is the right path.
2. Licence and security review. We look at your tenant, licences, devices and existing security tools, and score the configuration against Microsoft's recommendations and our baseline. Outcome: a written report: what you have, what is missing, what overlaps, and a costed recommendation.
3. Licence changes. Moving users to the right plans, removing overlapping subscriptions, timed around renewals where possible.
4. Configuration. Identity, Conditional Access, Intune enrolment, email protection, data labels and alerting, applied in a staged order so nothing breaks on day one. We pilot policies with a small group before they go to everyone.
5. Rollout to staff. Device enrolment, MFA re-registration where needed, a short briefing on what changes for them (usually: a new prompt or two) and where to get help.
6. Onboarding to monitoring. Alerts connected to our SOC, escalation contacts and procedures agreed and tested.
7. Ongoing management. Regular reviews, change control, joiner and leaver processes, and reporting.

Disruption, honestly

Most of this work is invisible to staff. The parts they notice are MFA prompts, device enrolment, and occasionally a policy that blocks something they used to do. We stage changes, pilot them, and give people a route to ask for help. We will not promise that every migration is seamless; older devices, unusual line-of-business applications and personal phones sometimes need individual attention. We will tell you where we expect friction before we start.