Microsoft 365 Business Premium security: what’s included and what to turn on

Microsoft 365 Business Premium includes endpoint detection and response for your computers, device management, sign-in controls, and protection for email and files. Most of it does nothing until someone configures it. When we review a new client’s Microsoft 365, we usually find Microsoft’s defaults everywhere, auditing off, no Conditional Access, and Intune licensed but never used.

What Microsoft 365 Business Premium security includes

Business Premium is Microsoft’s plan for organizations with up to 300 users. On top of everything in Business Standard (Office apps, Exchange, Teams, OneDrive and SharePoint), it adds these security tools:

Microsoft lists these in its security overview for Microsoft 365 for business. In the same comparison, Business Standard has Entra ID Free and none of Intune, Defender for Business or Defender for Office 365. An office on Standard that handles client, patient or financial records usually needs Premium.

The settings to turn on first

Here’s the order we work in on a new tenant.

1. Replace security defaults with Conditional Access

Every Microsoft 365 for business tenant starts with security defaults, which turns on multi-factor authentication. That’s a good floor. Business Premium lets you replace it with Conditional Access policies that do more: require MFA for everyone, block older sign-in methods that skip MFA, block sign-ins from countries where you don’t work, and require a managed device for administrators.

We use phishing-resistant sign-in (security keys or passkeys) for administrator accounts and number matching for everyone else. We also block sign-ins from abroad unless someone confirms them, and we watch for impossible travel, such as a sign-in from Baton Rouge and another from overseas an hour later.

2. Separate and protect admin accounts

Nobody should read email with an account that can change the whole tenant. Give each administrator a separate admin account, keep the number of global admins small, and put the strictest sign-in rules on those accounts.

3. Apply the preset email protection policies

Defender for Office 365 comes with preset security policies (Standard and Strict) that turn on Safe Links, Safe Attachments and anti-phishing with Microsoft’s recommended settings. Apply Standard to everyone and Strict to the people most likely to be targeted: owners, finance and anyone who approves payments.

4. Onboard every computer to Defender for Business

Defender for Business protects only the devices that are onboarded to it. Microsoft’s setup wizard can onboard Windows devices automatically as they enroll in Intune, which closes the gap of a new laptop that never got protected.

5. Enroll devices in Intune and set compliance rules

Intune is where you require disk encryption, a screen lock, current Windows updates and a supported operating system. Tie those rules to Conditional Access, and a lost or out-of-date laptop can’t reach company data. For staff who use personal phones, app protection policies keep company email and files inside managed apps without taking over the whole phone.

6. Check that audit logging is on

The audit log is how you find out what happened after an account is taken over: which mail was read, which rules were created, which files were downloaded. In Business Premium, audit records are kept for 180 days, according to Microsoft Learn. It should be on by default, but we still find tenants where it was turned off. Check it before you need it.

7. Block automatic forwarding to outside addresses

A forwarding rule to a personal or outside address is one of the first things an attacker sets up in a taken-over mailbox. Block automatic external forwarding in the outbound spam policy, and allow exceptions by name only.

8. Start data loss prevention in test mode

Turn on a data loss prevention policy for the data you hold (health records, Social Security numbers, card numbers or bank details) in test mode first. Watch what it would have blocked for a few weeks, then turn it on. Sensitivity labels can follow once people are used to it.

Things Business Premium doesn’t do on its own

• 01Someone has to read the alerts. Defender for Business raises them around the clock; it doesn’t call you at 2 a.m.
• 02Retention settings and the recycle bin aren’t a backup. We back up Microsoft 365 three times a day to storage that can’t be altered once written.
• 03Your domain still needs DMARC set to reject email that fakes it. Every client domain we manage is at p=reject.
• 04Staff still need training and phishing tests.

Once these are in place, the Microsoft 365 posture section of our clients’ technology business reviews tracks the drift: users without MFA, licensed accounts nobody uses, guest accounts, accounts created outside IT, and external forwarding rules.

If you’re paying for Business Premium, there’s a good chance some of it is still switched off. Book a 15-minute call and we’ll tell you what we’d check first in your tenant. See our Microsoft 365 managed services.

Frequently asked questions