Most organizations on Microsoft 365 Business Premium don’t need either add-on yet. They need to turn on what Business Premium already includes. The Defender Suite and Purview Suite make sense when you have a specific need: an on-premises Active Directory to watch, legal holds to run, audit records you must keep for a year, or staff using AI and cloud apps you can’t see.
Microsoft announced three add-ons for Business Premium in September 2025: the Defender Suite, the Purview Suite, and the two combined. Each requires a Business Premium license, and the total across all add-ons is capped at 300 seats per customer.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
What the Defender Suite adds
| Adds | Over what Business Premium includes | What it’s for |
|---|---|---|
| Microsoft Entra ID P2 | Entra ID P1 | Risk-based sign-in rules (ID Protection) and automated access reviews and onboarding (ID Governance) |
| Microsoft Defender for Identity | Nothing comparable | Watches an on-premises Active Directory for identity attacks |
| Microsoft Defender for Endpoint Plan 2 | Defender for Business | Threat hunting, live response and six months of device data |
| Microsoft Defender for Office 365 Plan 2 | Plan 1 | Attack simulation training, automated investigation and response, threat explorer |
| Microsoft Defender for Cloud Apps | Nothing comparable | Finds shadow IT and risky AI apps, and manages app permissions |
The Defender Suite replaced the earlier Microsoft 365 E5 Security add-on for Business Premium, according to Microsoft Learn.
The licensing catch
Defender for Business doesn’t support mixed licensing. Microsoft’s example: with 80 Business Premium users and the Defender Suite on 30 of them, every device stays on the Defender for Business experience. To move to Defender for Endpoint Plan 2, you license every user for it and ask Microsoft Support to switch the tenant. Buying the Defender Suite for a few people won’t upgrade their laptops.
What the Purview Suite adds
- Insider Risk Management, which flags patterns like an employee downloading large numbers of files before leaving
- Data loss prevention and sensitivity labels beyond the Business Premium baseline, plus Message Encryption and Customer Key
- Communication Compliance for email and Teams
- Data Security Posture Management for AI, which shows how Copilot and other AI apps touch sensitive data
- Records and Data Lifecycle Management for automatic retention and deletion
- eDiscovery (Premium) for legal holds, investigations and exports
- Audit (Premium), which keeps Exchange, SharePoint, OneDrive and Entra ID audit records for one year instead of 180 days
The audit retention difference matters more than it sounds. With Business Premium alone, audit records are kept for 180 days. If an account takeover is found seven months after it started, the record of the attacker’s first sign-in is already gone.
Who needs which add-on
| Your situation | What to look at |
|---|---|
| You still run an on-premises Active Directory server | Defender Suite (Defender for Identity) |
| Staff use AI tools and cloud apps nobody approved | Defender Suite (Cloud Apps), or Purview Suite (DSPM for AI) if the worry is the data going in |
| You place legal holds or respond to discovery requests | Purview Suite (eDiscovery Premium) |
| An insurer, auditor or client asks for a year of audit history | Purview Suite (Audit Premium) |
| You want to know when a departing employee takes files | Purview Suite (Insider Risk Management) |
| You haven’t set up Conditional Access, Intune or Defender for Business yet | Neither. Start with Business Premium. |
For law firms and practices that answer to HIPAA or the FTC Safeguards Rule, we’d usually look at the Purview Suite first, because their hardest questions are about records: who opened what, and can you prove it. For an organization with an on-premises server or a lot of unapproved apps, we’d start with the Defender Suite.
Add-ons don’t replace the people
Both suites produce more alerts, more reports and more settings. None of it helps unless someone reviews it. Our clients’ devices are watched by a security operations center around the clock, and we write the policies these tools enforce. If you’re weighing an add-on, the first question is who will act on what it finds.
If someone has quoted you an add-on, bring the quote. Book a 15-minute call and we’ll tell you whether your tenant is ready for it, or what to turn on first. See our Microsoft 365 managed services and compliance services.
Related reading
Frequently asked questions
Can I buy the Defender Suite or Purview Suite without Business Premium?
No. Both are add-ons that require a Microsoft 365 Business Premium license, and the combined seat count across the add-ons is capped at 300 per customer.
Do I need to buy the add-on for every user?
For the Defender Suite, yes, if you want the Defender for Endpoint Plan 2 experience, because Defender for Business doesn’t support mixed licensing. For the Purview Suite, check which features you need for which users before you buy.
Does Business Premium include Defender for Endpoint?
Not Defender for Endpoint Plan 2. Business Premium includes Defender for Business, which is built for organizations up to 300 users. The Defender Suite adds Plan 2, but because Defender for Business doesn’t support mixed licensing, every user needs the add-on before Microsoft will switch the tenant.
How long does Microsoft 365 keep audit logs?
With Business Premium, standard audit records are kept for 180 days. Audit (Premium), included in the Purview Suite, keeps Exchange, SharePoint, OneDrive and Entra ID audit records for one year. If an insurer, auditor or client asks for a year of history, that difference matters.
Sources
- Microsoft Security Community Blog, Introducing new security and compliance add-ons for Microsoft 365 Business Premium, September 2025
- Microsoft Learn, Add Microsoft Defender Suite for Business Premium
- Microsoft Learn, What’s new in security in Microsoft 365 for business
- Microsoft Learn, Manage audit log retention policies
Next step
Let us handle this for you.
Licensing through our Microsoft partnership, migrations, and the security settings Microsoft leaves off.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
15 minutes
