You Already Pay for Microsoft 365 Business Premium. Here’s the Security You’re Not Using.
If your invoice says Business Premium, you already own a serious security stack. Most Windsor small businesses never turn it on.
Here's a pattern that shows up in almost every office assessment. The business pays for Microsoft 365 Business Premium, the top small-business tier. Then it also pays for a separate antivirus, a separate email filter, and sometimes a separate backup, because someone sold them those years ago. Meanwhile the Premium features that would replace all three sit switched off.
Premium costs more than Business Standard for a reason. The extra money buys security tooling. If nobody configures it, you're paying the premium and getting Standard.
What's in the box
Defender for Business
Antivirus and threat protection on every PC, managed from one place instead of whatever each laptop shipped with.
Defender for Office 365
Scans email attachments and links before they reach the inbox. This is the layer that stops most phishing.
Intune
Device management. Enforce a screen lock, require disk encryption, and wipe a lost laptop remotely.
Entra ID P1 (conditional access)
Rules like “no sign-ins from outside Canada” and “MFA required on every account.” The single most effective setting most businesses never enable.
Exchange Online Archiving
Keeps a copy of mail even after someone deletes it. Useful when a dispute comes up two years later.
Purview Information Protection
Label documents as confidential and stop them leaving the company by email. Overkill for some, essential for clinics and offices handling client data.
Why it's usually off
None of this turns itself on. Each piece needs policies written, tested against how your staff actually work, and rolled out without locking the owner out of their own email on a Friday afternoon. Microsoft's defaults are deliberately loose because a locked-down default would break things for millions of customers on day one.
So it sits there. The business pays for duplicate tools from other vendors, and the one thing that would have stopped the phishing email never got switched on.
The three settings that matter most
- Multi-factor authentication on every account, enforced, not suggested. This alone stops the majority of account takeovers.
- Conditional access blocking sign-ins from countries you don’t operate in.
- Safe Links and Safe Attachments in Defender for Office 365, so a bad link is rewritten and checked at click time, not just at delivery.
If you check nothing else this month, check those three. Open the Microsoft 365 admin centre, or ask whoever manages it to show you where each one is set.
What Premium doesn't do
Two gaps worth knowing. First, Microsoft does not back up your Microsoft 365 data in the way most people assume. Deleted mail and files are recoverable for a window, then gone. A separate Microsoft 365 backup covers that. Second, Defender will alert you to a threat, but someone has to be awake to read the alert and act. That's the job of a security operations centre, and it's why managed security plans pair Microsoft's tools with 24/7 human monitoring.
How Specter Systems handles it: on a managed plan, Business Premium gets configured and managed as part of the service. You stop paying for duplicate tools, and the ones you already own finally do their job.
Want to know what's switched on in yours?
A free assessment includes a walk through your Microsoft 365 tenant. You'll leave knowing what you own and what's idle.