You Are Already Paying for These Microsoft 365 Features. Most Businesses Never Turn Them On

Microsoft 365 Business Premium costs roughly twice what Business Standard does. The overwhelming majority of businesses that pay for it are using it as Business Standard with a higher bill.

This is not a criticism of those businesses. The additional capability is genuinely not obvious. It does not appear as new icons in Outlook or Teams. It sits in admin portals that a normal user never opens, most of it switched off by default, and Microsoft does not prompt you to configure it. If nobody has deliberately gone and turned it on, it is not on.

The practical consequence is that a lot of Australian SMBs are paying for security tooling they already own while considering whether to buy third-party equivalents. This post is about what is actually in there.

What the extra licence fee buys

Set aside the marketing names for a moment. In substance, the step up from Standard to Premium adds four things.

Conditional Access, through Entra ID Plan 1. The ability to make sign-in decisions based on context rather than just credentials. This is the most valuable single item on the list.

Device management, through Intune. The ability to require that devices meet a standard before they access company data, and to remove company data from a device you no longer control.

Advanced threat protection, through Defender for Office 365 Plan 1 and Defender for Business. Attachment and link scanning that goes beyond basic filtering, plus endpoint detection and response.

Information protection, through Azure Information Protection. Sensitivity labels, encryption that travels with the document, and data loss prevention.

Each of these is a product that businesses routinely buy separately. All four are included.

Conditional Access: the highest-value thing you are not using

If you configure only one item from this list, configure this one.

Conditional Access lets you set rules about the circumstances under which a sign-in is allowed, rather than treating a correct password and MFA code as sufficient in all contexts. The rules that deliver the most value for the least disruption are:

Block legacy authentication. Older protocols like IMAP and POP cannot enforce MFA. Attackers know this and target them specifically, because a valid password gets straight in regardless of what MFA you have configured. Blocking legacy authentication closes the most commonly exploited gap in SMB Microsoft 365 tenants. Check what still uses it before you enforce, because occasionally an old scanner or line-of-business application does, but the check is quick and the fix is usually a firmware update.

Require MFA for all administrative roles, without exception. Most tenants have MFA broadly enabled with a handful of exclusions that accumulated for convenience. Administrative accounts are exactly where exclusions must not exist.

Restrict sign-in by location. If your entire business operates in Australia, a sign-in from another country is either travel, which you can handle as an exception, or an attack. Blocking or challenging by geography removes a large volume of automated attempts.

Require compliant or managed devices for sensitive applications. This one depends on Intune being configured first, so it comes later in the sequence, but it is where the real strength is: even a fully compromised credential does not grant access from an unknown device.

Set session controls for unmanaged devices. Allow browser access without allowing download to a personal machine. This is often the compromise that makes a bring-your-own-device policy workable.

Configure these in report-only mode first. Every Conditional Access policy can run in a mode where it logs what it would have done without actually blocking anything. Run for a week, review what would have been affected, then enforce. This is how you avoid locking out your finance team at month end.

Intune: the part everyone defers

Device management has a reputation for being a large project. For a business under a hundred staff it is usually two days of configuration and a staged rollout, and it unlocks the strongest Conditional Access rules.

The capabilities that matter most:

Enforce a device baseline. Encryption on, firewall on, screen lock configured, operating system within a supported version range. These are the controls that cyber insurers ask about, and being able to demonstrate them centrally is worth a great deal at renewal time.

Separate company data from personal data on mobile devices. App protection policies let you control company data inside the Outlook and Teams apps without managing the employee's personal phone. Staff resistance to device management is almost always about personal privacy, and this addresses it directly: you are not managing their phone, you are managing your data inside two apps.

Selective wipe. When someone leaves or loses a device, remove company data without touching personal photos and messages. This is the capability businesses most wish they had at the moment they need it, which is invariably after they needed it.

Automated deployment. New laptops configure themselves from the cloud on first sign-in. For any business hiring more than occasionally, this converts a half-day of setup per starter into nothing.

Defender: turn on the settings that are off by default

Defender for Office 365 is partially active by default, but its most useful protections are not.

Safe Attachments opens attachments in an isolated environment before delivery and checks their behaviour. This catches malicious files that signature-based scanning misses because they are new.

Safe Links rewrites URLs so they are checked at the moment of clicking rather than at the moment of delivery. This matters because a common technique is to send a clean link and weaponise the destination afterwards, specifically to defeat delivery-time scanning.

Anti-phishing with impersonation protection is the one to configure carefully. Add your executives and your finance staff to the protected users list, and add your own domain and key supplier domains to the protected domains list. This is the control that addresses invoice fraud and payment redirection, which remains the attack that costs Australian SMBs the most money.

Defender for Business provides endpoint detection and response across your devices, which is a genuinely different capability from traditional antivirus: it detects behaviour patterns rather than known files, and it lets you isolate a compromised machine from the network remotely.

Sensitivity labels and data loss prevention

The lightest-touch high-value configuration here is a small set of labels, three or four, not twenty, applied to the categories of information that genuinely carry risk.

Labels can enforce encryption that travels with the file, so a document that leaves your tenant is still protected. Data loss prevention policies can detect and block the transmission of specific data patterns, and Australian-specific patterns including TFNs, Medicare numbers, and passport numbers are available out of the box.

Start in audit mode. Discovering where sensitive data actually lives is usually more valuable than any policy you would have written in advance, and it frequently changes what you decide to do.

The order to do this in

Attempting all of it at once is how these projects stall. The sequence that works:

1. Conditional Access baseline in report-only, then enforced. Highest value, lowest effort, no user-visible change if done properly.
2. Defender configuration. Safe Attachments, Safe Links, impersonation protection. Half a day, immediate effect, invisible to users.
3. Intune for company-owned devices. Baseline compliance policies, then enrol devices as they are replaced or as a staged rollout.
4. App protection for mobile. Low friction, high value for offboarding.
5. Device-based Conditional Access. Now that compliance is known, require it for sensitive applications.
6. Sensitivity labels and DLP, audit mode first.

Realistically this is two to three months elapsed for a fifty-person business, with perhaps six to eight days of actual configuration work spread across it.

Whether Premium is right for you at all

The honest counterpoint: if you are never going to configure any of this, Business Premium is poor value and Business Standard plus a deliberate third-party choice may serve you better.

The licence is only worth the premium if the capability gets switched on. What we see most often is businesses paying for Premium, running it as Standard, and separately evaluating security products that duplicate what they own. Working out which situation you are in is a worthwhile hour.

Our free IT health check includes a licence utilisation review: what you are licensed for, what is actually configured, and the specific gap between the two, with a prioritised list of what to enable first. Read-only, no changes made, no obligation.

Learn more about our Microsoft 365 services