Microsoft says multifactor authentication can block more than 99.2% of account compromise attacks, and the simplest way to get it, security defaults, needs no extra licence. Yet the tenant settings, the plan you buy and the July 2026 price changes all affect how well a small company is protected. This guide covers what to switch on, in what order, for a Microsoft 365 tenant of up to 300 users.
Which Microsoft 365 plan gives you which protection
Microsoft announced on 4 December 2025 that commercial prices would rise from 1 July 2026. Business Basic went from $6 to $7 per user per month on a yearly commitment and Business Standard from $12.50 to $14, while Business Premium stayed at $22. Basic and Standard gained URL checks in Outlook and Office apps, a subset of the Safe Links protection that Premium already includes.
For security, Business Premium is the plan that matters. Microsoft lists Entra ID P1, Intune, Defender for Business, Defender for Office 365 and Purview data loss prevention and information protection, all for up to 300 users. A version without Teams costs $18.79. Teams on Basic or Standard can buy Defender for Office 365 Plan 1 as an add-on, which SoftwareOne lists at $2 per user per month.
| Plan | Price from 1 July 2026 | Previous price | Security highlights |
|---|---|---|---|
| Business Basic | $7 | $6 | Security defaults, URL checks in Outlook and Office apps |
| Business Standard | $14 | $12.50 | Security defaults, URL checks, desktop apps |
| Business Premium | $22 | $22 | Entra ID P1, Intune, Defender for Business, Defender for Office 365, Purview DLP |
| Business Premium (no Teams) | $18.79 | Not stated | Same security stack as Business Premium |
Turn on security defaults or Conditional Access
Security defaults are a free, preconfigured policy set in Microsoft Entra ID. They require every user to register for MFA, require MFA every time an administrator signs in, prompt users for MFA when risk signals suggest it, block legacy authentication such as IMAP, SMTP and POP3, and block the device code flow often abused in phishing. Microsoft reported in 2022 that organisations using security defaults saw 80% less compromise than the overall tenant population.
Security defaults are an on or off switch. If you buy Business Premium you get Entra ID P1 and can replace them with Conditional Access, which lets you require compliant devices, block sign-ins from countries you never work in and treat admins differently from staff. Do not simply turn security defaults off without Conditional Access policies ready, because that leaves the tenant with neither.
Admin accounts and Microsoft's mandatory MFA
Microsoft now enforces MFA on its admin portals itself. Phase 1, from October 2024, covers create, read, update and delete actions in the Azure portal, the Entra admin center and the Intune admin center. The Microsoft 365 admin center followed from February 2025. Phase 2, from 1 October 2025, covers command-line tools, PowerShell, infrastructure-as-code tools and the REST API, with postponement allowed only until 1 July 2026.
Use separate admin accounts that are not used for email, keep the number of Global Administrators small, and give helpdesk staff narrower roles such as User Administrator or Password Administrator. Keep at least one break-glass account with a long random password and a hardware key, stored offline, so that a broken Conditional Access policy cannot lock the whole company out.
Move users to phishing-resistant sign-in
Microsoft began rolling out passkeys as the default sign-in method in Entra ID from 1 September 2026, prompting users enabled for SMS or voice to register a passkey at their next MFA sign-in. Native SMS and voice delivery retires on 1 February 2027, after which organisations that keep those methods must contract a provider and pay carrier charges. Microsoft recommends FIDO2 security keys or Authenticator passkeys for privileged users.
The reason is that ordinary MFA can be bypassed. In Verizon's 2025 DBIR sample of 2,102 Microsoft 365 MFA bypass attacks, token theft was the most common technique at 31%, followed by MFA interrupt and adversary-in-the-middle attacks. Microsoft also cites research showing AI-written phishing reaching click-through rates of up to 54%, against about 12% for traditional campaigns. Passkeys tie the sign-in to the real site, which defeats most of these tricks.
Email protection in Exchange Online
Business Premium includes Defender for Office 365, which adds Safe Links, Safe Attachments and stronger anti-phishing policies. Turn on the preset Standard or Strict protection policies rather than building rules by hand, and apply them to all users. On Basic or Standard, the new URL checks help, but the $2 Defender for Office 365 Plan 1 add-on gives you the fuller set of protections.
Set up SPF, DKIM and DMARC for every domain in the tenant. DKIM signing for custom domains is turned on in the Defender portal, and DMARC should start at p=none with reports going to a mailbox you read. Disable automatic forwarding to external addresses, which is a common step after a mailbox is taken over, and confirm that legacy protocols such as POP3 and IMAP are blocked.
Devices with Intune and Defender for Business
Verizon found that 46% of systems in infostealer logs holding corporate logins were unmanaged devices that mixed personal and business credentials. Business Premium includes Intune for Windows, Mac, iOS and Android management, and Windows Autopilot to set up laptops with BitLocker and company policies before they reach the user. Enrol every company device and require a compliant device for access to email and files.
Defender for Business, built on Defender for Endpoint, protects PCs against ransomware, malware and phishing and adds vulnerability management. Turn on tamper protection, attack surface reduction rules and automatic updates. On personal phones, use app protection policies so that company data stays inside managed apps and can be wiped without touching personal photos.
Baseline checklist for a small tenant
These steps follow Microsoft's own guidance for small business tenants. The first four cost nothing on any plan; the rest assume Business Premium or the relevant add-on. XDQ Labs runs authorised configuration reviews for small Microsoft 365 tenants and fixes what it finds.
| Step | Plan needed | What it stops |
|---|---|---|
| Security defaults on, or Conditional Access | Any plan, P1 for Conditional Access | Password-only sign-ins |
| Separate admin accounts and few Global Admins | Any plan | Full tenant takeover from one phished mailbox |
| Legacy authentication blocked | Any plan | Sign-ins that cannot do MFA |
| SPF, DKIM and DMARC | Any plan | Spoofed mail from your domain |
| External auto-forwarding disabled | Any plan | Silent mailbox data theft |
| Preset Defender for Office 365 policies | Premium or Plan 1 add-on | Malicious links and attachments |
| Intune enrolment and compliant device rule | Premium | Access from unmanaged or infected devices |
| Passkeys or FIDO2 keys for admins | Any plan | Token theft and adversary-in-the-middle phishing |
When to add the Defender or Purview suites
Business Premium covers most small companies. Microsoft sells add-on suites for Premium tenants that need more: in the UK, the Defender Suite and the Purview Suite are each listed at £7.70 per user per month and the combined Defender and Purview Suites at £11.50, billed yearly. The Defender Suite includes Defender for Endpoint Plan 2.
Consider these when you handle regulated data, sell to enterprise customers who audit your controls, or need deeper threat hunting than Defender for Business provides. For most teams, the better first investment is finishing the baseline above, because Verizon found stolen credentials behind 22% of breaches and the free controls address that directly.
Frequently asked questions
Is Microsoft 365 Business Premium worth it for security?
For most small companies, yes. At $22 per user per month on a yearly commitment, Business Premium adds Entra ID P1 for Conditional Access, Intune device management, Defender for Business and Defender for Office 365. Having them in one licence is simpler than stacking add-ons on Business Standard, which costs $14 from July 2026.
Are Microsoft 365 security defaults free?
Yes. Security defaults need no licence and are available on every tenant. They require MFA registration for all users, MFA for admins, block legacy authentication and block device code flow. Microsoft reported 80% less compromise in tenants that use them. Organisations with Entra ID P1 should use Conditional Access instead.
Did Microsoft 365 business prices go up in 2026?
Yes. From 1 July 2026, Business Basic rose from $6 to $7 and Business Standard from $12.50 to $14 per user per month on a yearly commitment. Business Premium stayed at $22. Microsoft announced the change on 4 December 2025 and added URL checks to Basic and Standard.
Does Microsoft require MFA for admin accounts?
Yes. Microsoft has enforced MFA for actions in the Azure portal, Entra admin center and Intune admin center since October 2024, and for the Microsoft 365 admin center from February 2025. Command-line and API access followed from 1 October 2025, with postponement possible only until 1 July 2026.
Sources
- Microsoft 365 Business Premium, Microsoft, 2026
- Microsoft July 1 price increases, SoftwareOne, 2025
- Microsoft 365 Business price increase: who pays more in 2026, Office Watch, 2026
- Security defaults in Microsoft Entra ID, Microsoft Learn, 2026
- Planning for mandatory multifactor authentication for Azure and other admin portals, Microsoft Learn, 2026
- Microsoft 365 Business Premium security: frequently asked questions, Microsoft Learn, 2026
- Raising the baseline security of all organizations in the world, Microsoft Tech Community, 2022
- 2025 Data Breach Investigations Report (full report), Verizon Business, 2025
- Microsoft and Google push passkeys deeper into workplace authentication, Biometric Update, 2026
- Microsoft 365 Business Premium security add-on plans, Microsoft UK, 2026
