In short: Microsoft 365 Business Premium security includes Defender for Business for devices, Defender for Office 365 Plan 1 for email and Teams, Entra ID P1 for conditional access, Intune for device management and Purview Information Protection and data loss prevention basics. It is capped at 300 users, and add-ons extend it towards E5-level protection.
What security Business Premium includes
| Component | What it does | Our guide |
|---|---|---|
| Microsoft Defender for Business | Next-generation antivirus, attack surface reduction, EDR, automated investigation, vulnerability management | Defender for Business |
| Microsoft Defender for Office 365 Plan 1 | Safe Links, Safe Attachments and impersonation protection for email, Teams, SharePoint and OneDrive | Defender for Office 365 |
| Microsoft Entra ID P1 | Conditional access, MFA, self-service password reset, group-based access | Entra ID P1 and P2 |
| Microsoft Intune | Device enrolment, compliance, configuration, app protection on phones | Microsoft Intune |
| Microsoft Purview Information Protection | Sensitivity labels for email and documents | Microsoft Purview |
| Microsoft Purview Data Loss Prevention | DLP policies for email and files | Data loss prevention |
| Exchange Online Protection and archiving | Built-in email filtering and mailbox archiving | Email security |
All of this sits alongside the usual Microsoft 365 apps, Exchange, SharePoint, OneDrive and Teams. Incidents from Defender for Business and Defender for Office 365 come together in Microsoft Defender XDR.
The 300-user cap
Business Premium, like the other Microsoft 365 business plans, is limited to 300 users. Defender for Business has the same cap. If you are approaching it, plan ahead: you can mix Business Premium with enterprise plans for users beyond 300, but security features differ between them, and Microsoft recommends a subscription that includes Defender for Endpoint for everyone once you pass 300.
The usual paths are Microsoft 365 E3 (which includes Defender for Endpoint Plan 1 and Defender for Office 365 Plan 1) with the Microsoft Defender Suite add-on, or Microsoft 365 E5. Forever Group's Microsoft licensing team can model the commercial options.
What to switch on first
- Replace security defaults with conditional access: require MFA for all users, block legacy authentication, and require phishing-resistant MFA for admins
- Lock down admin accounts: separate admin accounts, as few Global Administrators as practical, and emergency access accounts
- Apply the preset security policies in Defender for Office 365 and add impersonation protection for senior staff
- Enrol devices in Intune and set compliance policies, then require compliant devices for access to company data
- Onboard every device to Defender for Business, including Macs and phones, and remove old antivirus
- Tighten sharing in SharePoint, OneDrive and Teams, then publish a few simple sensitivity labels
- Create DLP policies for the sensitive data you hold, starting in test mode
- Check email authentication: SPF, DKIM and an enforced DMARC policy
- Decide who responds to incidents, and back up Microsoft 365 data
A Microsoft 365 security assessment shows which of these are already in place in your tenant.
Add-ons for Business Premium
Microsoft has introduced add-ons that bring E5 security and compliance features to Business Premium customers, within the same 300-licence limit:
| Add-on | What it adds |
|---|---|
| Microsoft Defender Suite for Business Premium | Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps and Entra ID P2 |
| Microsoft Purview Suite for Business Premium | Wider data loss prevention (including endpoints), automatic classification and labelling, Insider Risk Management, Data Lifecycle Management, audit and eDiscovery |
| Defender and Purview Suites for Business Premium | Both suites together |
| Microsoft Defender for Business servers | Protection for Windows Server and Linux servers |
These add-ons became available to buy through Microsoft's Cloud Solution Provider programme in January 2026. The Defender Suite is the one Business Premium organisations usually consider first, because it adds identity threat detection, SaaS controls, risk-based conditional access and Privileged Identity Management. Read Microsoft's note on mixed Defender licensing on our Defender for Business page before buying it for only some users. Pricing for all add-ons: ask us for a quote.
What Business Premium does not cover
Business Premium is broad, but a few gaps come up in almost every review:
- Backup: retention and recycle bins are not a backup you control; see Microsoft 365 backup
- 24/7 response: Defender raises incidents but nobody watches them overnight unless you arrange it; see MDR
- Identity attacks on on-premises Active Directory: needs Defender for Identity, see ITDR
- Security Copilot: Business Premium is not part of Microsoft's E5 and E7 inclusion, see Security Copilot
- People: technical controls work best alongside security awareness training
How we help
We configure Business Premium end to end or pick up a tenant that is part-way there: conditional access, Defender, Intune, sharing, labels and DLP, then support it. Because we are independent, we will also tell you where a non-Microsoft layer makes more sense than an add-on.
Contact us to review your Business Premium security.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What security features are in Microsoft 365 Business Premium?
Business Premium includes Defender for Business, Defender for Office 365 Plan 1, Microsoft Entra ID P1 with conditional access, Microsoft Intune, and Purview Information Protection and data loss prevention for email and files, alongside Exchange Online Protection.
Is Microsoft 365 Business Premium enough for security?
For many organisations under 300 users, yes, provided it is fully configured and someone responds to incidents. Common additions are a backup service, managed detection and response, and the Microsoft Defender Suite add-on for identity and SaaS protection.
What is the difference between Business Premium and Business Standard for security?
Business Standard has the Microsoft 365 apps and built-in email filtering but lacks Defender for Business, Defender for Office 365, Entra ID P1 conditional access and Intune. Business Premium adds all of those, which is why it is Microsoft's recommended plan for security-conscious small businesses.
Can I add E5 security to Business Premium?
Yes. The Microsoft Defender Suite for Business Premium adds Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps and Entra ID P2, within the 300-user limit.
What happens when we go over 300 users?
Business Premium cannot be licensed for more than 300 users. Additional users go on an enterprise plan such as Microsoft 365 E3 or E5, and Microsoft recommends moving everyone to a subscription that includes Defender for Endpoint so security features stay consistent.