Microsoft 365 Business Premium: what you actually get
What Microsoft 365 Business Premium includes for security, who it is for (up to 300 users), and how a London IT partner sets it up properly.
Guide · 22 Oct 2026Microsoft Solutions PartnerLondon
300Maximum users Business Premium is designed for
5Security and management tools added on top of Business Standard
4Steps in a proper setup
Many London businesses pay for Microsoft 365 but only use the email and Office apps. Business Premium adds a set of security and device-management tools that are often switched on only partially, or not at all.
Standards
What's included on top of Business Standard
According to Microsoft's documentation, Business Premium adds these five.
1
Microsoft Defender for Business
Endpoint protection against ransomware, malware and phishing, with endpoint detection and response.
2
Defender for Office 365 Plan 1
Protection for email and files.
3
Microsoft Intune Plan 1
Manage and secure Windows, macOS, iOS/iPadOS and Android devices, including staff using personal phones.
4
Microsoft Entra ID P1
Conditional Access, so sign-in rules can depend on user, device and location.
5
Microsoft Purview
Information Protection and data loss prevention: sensitivity labels and DLP for email and files.
Overview
Security defaults vs Conditional Access
Two ways to enforce sign-in security. Microsoft does not intend them to be combined.
Security defaults
A free baseline for every tenant.
- MFA registration for all users
- MFA for administrators
- Blocking of legacy authentication protocols
Conditional Access
Needs at least Entra ID P1, which Business Premium includes.
- Fully customisable rules
- Sign-in conditions based on user, device and location
- Enable policies straight away once security defaults is turned off
In detail
The common gap
Owning a licence is not the same as configuring it.
Typical gaps we see
Devices not enrolled in Intune.
Defender not onboarded.
No Conditional Access policy in place after security defaults is disabled.
In detail
What a proper setup covers
Four steps, in this order.
1
Enrol devices
Enrol and onboard all devices.
2
Conditional Access
Replace security defaults: MFA for all users, stronger MFA for admins, block legacy authentication.
3
Protect email and files
Turn on email and file protection.
4
Labels and DLP
Apply sensitivity labels and DLP where regulated data is involved.
FAQ
Frequently asked questions
Quick answers, based on Microsoft's own documentation.
Who is Microsoft 365 Business Premium for?
Microsoft designs Business Premium for small and medium-sized businesses of up to 300 users.
What does Business Premium add to Business Standard?
Microsoft Defender for Business, Defender for Office 365 Plan 1, Intune Plan 1, Entra ID P1 (including Conditional Access) and Microsoft Purview Information Protection with data loss prevention.
Can I use security defaults and Conditional Access together?
No. Microsoft states the two are not meant to be combined: creating Conditional Access policies means turning security defaults off, and you should enable Conditional Access policies straight away when you do.
What are the common gaps?
Devices not enrolled in Intune, Defender not onboarded, and no Conditional Access policy in place after security defaults is disabled. Owning a licence is not the same as configuring it.
In detail
Keep reading
More from Foxcomm on keeping a London business secure and supported.
Windows 10 end of support
What London businesses should do now: upgrade, replace or ESU.
Read moreMicrosoft 365 services
Migration, licensing and management from a Microsoft Solutions Partner.
Read moreIT services in London
Managed IT support, Microsoft 365, cloud and security for London businesses.
Read moreTalk to Foxcomm
Foxcomm is a Microsoft Solutions Partner and holds ISO 27001 and Cyber Essentials Plus. Book a free consultation and we will review how your current Microsoft 365 tenant is configured.