Microsoft 365 Business Standard and Business Premium both include the same core applications: Word, Excel, PowerPoint, Outlook, Teams, OneDrive, and SharePoint. The key difference is that Business Premium adds a layer of security and device management tools that Standard simply does not have. These include Microsoft Defender for Business (endpoint protection for your computers), Microsoft Intune (which lets you manage and remotely wipe company devices), Defender for Office 365 Plan 1 (which protects your email from sophisticated phishing and malicious attachments), and Conditional Access (which lets you control who can sign into your Microsoft 365 account and from where).

Most small businesses running Microsoft 365 are on Business Standard, and for good reason. It does a great job of giving you everything you need to get stuff done: the full Office apps, email, Teams, OneDrive, SharePoint, and a solid set of collaboration tools that keep a small team connected and productive. 

Business Standard includes what Microsoft calls Exchange Online Protection, which handles obvious spam and known malware coming into your email. It’s the equivalent of a lock on the front door, and it does its job against the basic stuff. 

What it doesn’t do is protect the devices your team uses to access Microsoft 365. It doesn’t have anything meaningful to say about sophisticated phishing emails that pass the basic filters. And if a laptop gets stolen, Business Standard gives you no way to wipe it through Microsoft 365 remotely. 

Let’s take a look at some features of Business Premium which are relevant to businesses in Worcestershire & Warwickshire:

Microsoft Defender for Business: Protection for your computers

Microsoft Defender for Business is endpoint protection, which is the technical term for security software that sits on your computers and actively monitors for threats. 

Windows has had Windows Defender built in for years, and it’s reasonably capable. Defender for Business is different in that it gives you centralised management and visibility across all the devices in your business, not just passive protection on individual machines. If something suspicious is happening on one of your computers, it doesn’t just sit there quietly hoping nobody notices. It flags it, it can respond automatically, and you or whoever manages your IT can see what’s happening across the whole business from one place. For a small business that probably has neither the budget nor the desire to manage a complicated separate security product, having that level of protection built into your existing Microsoft subscription is genuinely useful.

Intune: Manage and secure your devices

Microsoft Intune is a device management platform, and at first glance it can sound like something only a large corporate would need. In practice, even for a small business, there are features in Intune that are immediately, practically useful.

The most obvious one is remote wipe. If one of your team’s laptops or phones goes missing, Intune lets you remotely wipe the device to protect any company data on it. Without Business Premium, if a laptop is lost or stolen, you have no way to do this through Microsoft 365. With it, you can act quickly and limit the damage. For any business that has staff working from laptops, whether in the office, from home, or out visiting clients around Worcestershire and Warwickshire, that’s a genuinely important capability.

Intune also lets you set and enforce security policies across your devices, so you can make sure that the computers accessing your Microsoft 365 environment are doing so from devices that meet a baseline standard of security. You can require devices to have a PIN or password, ensure company data isn’t being copied to personal cloud storage, and keep a clear picture of which devices are enrolled and active. None of this needs to be complicated to set up at a small business scale, and having it in place puts you in a much stronger position should anything go wrong.

Defender for Office 365: Smarter protection for your email

Phishing emails have become significantly more convincing over the last few years. The days of obvious scam emails full of spelling mistakes asking you to wire money to a Nigerian prince are largely behind us. Today’s phishing attempts are targeted, well-written, and in many cases impersonate suppliers, banks, or colleagues convincingly enough to fool people who are being reasonably careful. 

Business Standard’s basic email filtering catches the obvious stuff. Defender for Office, which is included in Business Premium, goes considerably further.

Safe Links checks URLs in emails and documents in real time, at the moment you click them, rather than just scanning them on arrival. This matters because attackers can send an email with a legitimate-looking link and then change the destination after the email has passed through the initial filters. Safe Attachments goes further still, opening suspicious email attachments in a sandboxed environment to check what they actually do before delivering them to your inbox. Anti-phishing protection adds another layer specifically targeting the impersonation attempts that are increasingly common. For a small business, your email is both your most important communication tool and your most common attack surface, and better email security is one of the most valuable things you can invest in.

Conditional Access: Control over who gets in, and from where

Conditional Access is one of those features that sounds more complicated than it is, and it’s worth understanding what it actually does before deciding whether it matters to your business. 

In simple terms, it lets you set rules around access to your Microsoft 365 environment. You can require that anyone signing into Microsoft 365 must do so from a managed device, or from certain locations, or always with multi-factor authentication regardless of whether they’ve previously saved their login. 

It gives you control over the circumstances under which your company data can be accessed, rather than leaving the door open to anyone with the right username and password.

For small businesses with remote or hybrid working arrangements, this is particularly relevant. If a member of staff’s account credentials are compromised and someone tries to sign in from an unusual location or an unmanaged device, Conditional Access can block that attempt or require additional verification before allowing access. It’s the kind of protection that most small businesses would benefit from but that, without Business Premium, simply isn’t available within Microsoft 365.

Who should consider upgrading to Business Premium?

If your business has staff working remotely or from home regularly, Business Premium is worth serious consideration, because the combination of device management, better email security, and Conditional Access gives you a much more credible security posture for a distributed team. 

If your staff use laptops that leave the office, the remote wipe capability alone is worth thinking about. If you handle any kind of sensitive client data, whether that’s financial information, personal data, or confidential business information, the gap between what Business Standard offers and what Business Premium offers in terms of protection is meaningful.

For businesses in Worcestershire and Warwickshire, particularly those with any element of remote or hybrid working, Business Premium offers a meaningful and practical security upgrade for a cost that is hard to argue against. 

It’s not a silver bullet, and it’s not a replacement for good security habits, but it closes a lot of gaps that Business Standard leaves open, and it does it through tools that are already integrated into a platform most businesses are using every single day.

Frequently Asked Questions

What is Microsoft Intune and do I need it as a small business?

Microsoft Intune is a device management platform that lets you apply security policies to the computers and phones used to access your Microsoft 365 environment. At a small business level, the most immediately useful capability is remote wipe, which lets you remotely erase company data from a device that has been lost or stolen. Beyond that, Intune lets you enforce requirements like mandatory screen lock passwords, prevent company data from being copied to personal cloud storage, and maintain a register of enrolled devices. It doesn’t require a complicated setup to get meaningful value from it at a small business scale.

Can I upgrade some users to Business Premium and keep others on Business Standard?

Yes, Microsoft 365 allows you to mix licence types within the same organisation. So if you have five users and decide that three of them, perhaps those who handle sensitive data or work remotely more regularly, would benefit from Business Premium while two others work exclusively on-site and are well-served by Standard, you can run both plans simultaneously. This can be a practical way to manage the cost while ensuring the people who need the additional security features have access to them. Your Microsoft 365 admin centre or a Microsoft partner can help with managing mixed-licence environments.

Does Microsoft 365 Business Premium help with Cyber Essentials certification?

Business Premium addresses several of the five Cyber Essentials controls in a meaningful way. Defender for Business covers the malware protection control. Intune helps with secure configuration and access control by allowing you to enforce device policies and manage who has access to what. Conditional Access supports the access control requirement by allowing you to enforce multi-factor authentication and restrict access based on device compliance. Having Business Premium in place doesn’t automatically certify you for Cyber Essentials, as the certification process looks at your whole IT environment, but it makes meeting several of the required controls considerably more straightforward than if you were starting from Business Standard.

Gavin Moorhouse is the CEO of Lucid Computer Solutions, a leading Worcestershire-based IT Services business. Give them a call on 01527 908646.