Microsoft 365 Business Premium: the security features included and what you still have to turn on

The short answer: Microsoft 365 Business Premium includes five security components, for businesses of up to 300 users. Entra ID P1 protects accounts, Intune Plan 1 manages devices, Defender for Business protects endpoints, Defender for Office 365 Plan 1 protects email and files, and Purview protects data. But a license is not protection: most of it still has to be configured, and several needs sit outside the plan, including servers, phishing simulation and backup.

We already compare the three plans in Business Basic, Standard or Premium. This guide goes further on one point: what you are actually buying on the security side, what works without any action, and what you still have to turn on. At ALLSAFE SOLUTIONS, a Microsoft partner in Casablanca, we supply these licenses with or without setup. The facts below come from Microsoft Learn documentation and Microsoft pages consulted on November 5, 2026; Microsoft changes its plans over time, so check the exact SKU when you order.

What is included, component by component

Area	Component	What it provides	At the start
Accounts	Entra ID P1	Conditional Access, MFA	Security defaults on; Conditional Access to configure
Devices	Intune Plan 1	Device management (MDM) and app management (MAM) on Windows, macOS, iOS and Android	To configure, devices to enroll
Endpoints	Defender for Business	Next-generation antivirus, attack surface reduction, EDR, automated investigation	Default policies ready, devices to onboard
Email and files	Defender for Office 365 Plan 1	Safe Links, Safe Attachments, impersonation protection	Built-in protection on; Standard and Strict to turn on
Data	Purview	Sensitivity labels, data loss prevention (DLP), message encryption	To configure

Source: Microsoft Learn, “Add Microsoft Defender Suite for Business Premium”, “Best practices for securing Microsoft 365 for business”, “Microsoft Defender for Business FAQ” and “Preset security policies”.

Entra ID P1: deciding who signs in, and from where

MFA already exists in all Business plans through security defaults, which Microsoft describes as on by default. What Business Premium adds is Conditional Access: rules such as “require a compliant device to open email” or “block sign-ins from a given country”.

Be careful with the transition. Microsoft says organizations that adopt Conditional Access policies as a replacement must disable security defaults, then immediately enable their own policies. Turning off the first without preparing the second leaves accounts unprotected. The sequence is covered in rolling out MFA in an SMB.

Intune Plan 1: managing devices, even personal ones

Intune enforces device compliance, deploys settings and updates, and can remotely wipe work data from a lost phone. It also covers personal devices through app management. Its real value shows up with Conditional Access: a non-compliant device no longer reaches your data. We detail the setup in Microsoft Intune for SMBs, and encryption in BitLocker for business.

Defender for Business: protecting and isolating endpoints

Microsoft states up to five client devices per user license, on Windows, Mac, iOS/iPadOS and Android, with no device minimum. Real-time protection is on by default, and default policies cover next-generation protection and the firewall. The device still has to be onboarded: onboarding is automatic only for Windows devices enrolled in Intune, and only if that option was selected. Two limits to know: a single web filtering policy for the whole organization, and Intune is needed to create custom attack surface reduction rules. See our Defender for Business deployment guide and, for the principle, EDR vs antivirus.

Defender for Office 365 Plan 1: filtering beyond the baseline

All plans have built-in filtering against spam, malware and phishing. Plan 1 adds:

• Safe Attachments for email attachments and for files in SharePoint, OneDrive and Teams;
• Safe Links in email, Office clients and Teams;
• user and domain impersonation protection, and mailbox intelligence, which spots unusual senders;
• investigation tools, such as real-time detections and dedicated reports.

This is where the gap between license and protection is widest. The Built-in protection policy, on by default, only gives basic Safe Links and Safe Attachments protection. According to Microsoft, the Standard and Strict preset policies are likely to be off on your first visit: you have to turn them on and assign them. Microsoft also recommends configuring SPF, DKIM and DMARC, which we explain in SPF, DKIM and DMARC in Morocco.

Purview: protecting the document itself

Business Premium includes sensitivity labels for email, files and Teams meetings, DLP and message encryption (Microsoft Purview Message Encryption). Microsoft gives the labels Normal, Personal, Private and Confidential as examples, which you can customize. None of this protects a document until the labels are published and DLP policies are created. It is often the last component deployed, yet the most useful one when you handle personal data subject to Morocco’s Law 09-08.

What is not included

Need	Required item	How to get it
Protecting Windows and Linux servers	Defender for Business servers, or Defender for Servers beyond 60 servers	Extra license
Phishing simulation	Attack simulation training (Defender for Office 365 Plan 2)	Defender Suite, or another tool
Temporary elevation of admin rights	Privileged Identity Management (Entra ID P2)	Defender Suite
Detecting risky sign-ins	Entra ID Protection (Entra ID P2)	Defender Suite
Threat hunting, six-month data retention	Defender for Endpoint Plan 2	Defender Suite
Visibility on unapproved apps	Defender for Cloud Apps	Defender Suite
Identity threat detection	Defender for Identity	Defender Suite
Large-scale classification and insider risk	Advanced Purview features	Purview Suite
Backup of Microsoft 365 data	No service described in the security pages consulted	Separate backup solution

Source: Microsoft Learn (Defender for Business FAQ, Entra licensing, Defender for Office 365 overview) and Microsoft’s page on security add-ons for Business Premium.

Three practical remarks:

• The add-ons require Business Premium. Microsoft presents Defender Suite and Purview Suite as add-ons to this plan.
• You cannot mix experiences. Microsoft is clear: if some users have Defender for Business and others Defender for Endpoint Plan 2, everyone’s experience defaults to Defender for Business. To switch, you must license all users for Plan 2 and ask Microsoft Support.
• Protection is not backup. Accidental deletion or a compromised account can still happen. Read Microsoft does not back up your email and our backup and business continuity offering.

For simulation, a phishing awareness program remains essential, whichever tool you use. And without PIM, good privileged admin account management matters all the more.

What to check before buying

• The number of users. The plan is designed for up to 300 users. If you are getting close, the Defender for Business FAQ points to an enterprise plan at renewal.
• The Windows edition. The Defender for Business requirements list Windows 10 or 11 Business, Pro and Enterprise. Windows Home is not on the list, so inventory your devices. In the pages consulted, we found no Windows Enterprise right included in the plan.
• Where the data sits. Among the Defender for Business requirements, Microsoft lists a data center in the European Union, the United Kingdom, the United States or Australia. If this matters to you, read our guide on transferring data outside Morocco.
• Servers. Count your Windows and Linux servers before comparing offers.
• License mix. Not everyone necessarily needs Premium. Allocate licenses by profile, as explained in our comparison, checking who must benefit from each protection.

In what order to turn security on

Here is the order we follow, because each step builds on the previous one.

1. Secure the administrators: dedicated accounts, emergency accounts and phishing-resistant MFA. Start with the 10 settings to secure Microsoft 365.
2. Move to Conditional Access: prepare your policies and test them on a pilot group before disabling security defaults.
3. Strengthen email: turn on the Standard policy for everyone, Strict for the most exposed profiles (management, accounting), then SPF, DKIM and DMARC.
4. Enroll devices in Intune: Windows devices first, then mobiles. Select automatic onboarding to Defender for Business for all enrolled devices, as Microsoft recommends.
5. Check endpoints in Defender: are all devices reporting? Add attack surface reduction rules and web filtering.
6. Require compliance: only then tie device state to Conditional Access, once the fleet is compliant, so nobody gets blocked by surprise.
7. Classify data: publish simple labels, then a first DLP policy on a limited scope.
8. Complete the setup: backup, awareness, servers and alert monitoring.

The mistakes we come across

1. Paying for Premium without configuring anything: the licenses exist, but Conditional Access is empty and no device is onboarded.
2. Believing Premium covers servers: that is often where a ransomware attack plays out.
3. Disabling security defaults before Conditional Access policies are ready.
4. Requiring a compliant device too early: users get locked out on the very morning of go-live.
5. Forgetting emergency accounts excluded from policies, with the risk of locking out all administrators.
6. Looking at no alerts: an EDR with no one to handle its alerts loses most of its value.
7. Confusing security with backup: no filter replaces a restorable copy.

Is Business Premium enough for your company?

Your situation	Our reading
Windows fleet, few or no servers, team on Microsoft 365	Business Premium covers the baseline; it still needs configuring and monitoring
On-premises servers to protect	Add the server license, or another solution for servers
Third-party antivirus or EDR already in place and working well	Compare before switching; see how to choose a business antivirus
Need for PIM, risky sign-in detection or threat hunting	Look at Defender Suite
More than 300 users, or growth close to that threshold	Look at an enterprise plan

Business Premium covers accounts, endpoints, email and data. It does not replace the firewall, network segmentation or the recovery plan: it fits into a broader approach to business cybersecurity in Morocco.

How we work

We start with a free initial audit of your licenses, accounts and devices, to find out what you already pay for without using. We then assign the right edition to each profile, see buying Microsoft 365 in Morocco, and turn on the protections in the order above with a pilot group. You can entrust operations to us through our Azure and Microsoft 365 in Morocco offering: 24/7 monitoring and critical incidents handled in under 15 minutes. Or you can stay in control and only have us supply the licenses.

Request your free initial audit: we reply within 24 business hours.