Microsoft 365 Business Premium: Security Setup Order for Small Businesses

Many small businesses pay for Microsoft 365 Business Premium and still run it with little more than default settings, leaving most of its security value unused. Business Premium is Microsoft's plan for organisations of up to 300 users, and it bundles Microsoft Entra ID P1 (Conditional Access), Microsoft Intune, Microsoft Defender for Business and Defender for Office 365 Plan 1 alongside the productivity apps. This guide explains what each component does for identity and access, how to protect admin accounts, how to control app consent and integrations, what you can log and detect at this licence level, and the order in which to switch things on. It is for IT managers, managed service providers and the one or two people who look after IT in a small firm. For enterprise-wide Microsoft 365 controls, read the Microsoft 365 Security Guide; this page stays within what Business Premium includes. Facts are from Microsoft Learn, checked on 8 November 2026.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

• Replace security defaults with Conditional Access. Microsoft states that organisations with Entra ID P1 licences are probably not suited to security defaults; Business Premium includes P1, so build Conditional Access policies, then turn security defaults off.
• Admins need separate, phishing-resistant accounts. Use dedicated admin accounts with least-privilege roles, require passkeys or Windows Hello for Business through authentication strength, and keep two emergency access accounts.
• Turn on the email protection you already pay for. Defender for Office 365 Plan 1 is included; apply the Standard or Strict preset security policy so Safe Links, Safe Attachments and impersonation protection actually cover users.
• Close the consent door. Restrict user consent to verified publishers and low-impact permissions and enable the admin consent workflow, because OAuth consent phishing bypasses MFA.
• Know the licence edges. Business Premium does not include Privileged Identity Management, Threat Explorer, automated investigation for email or one-year audit retention; plan compensating controls or add-ons.

How identity and access work in Microsoft 365 Business Premium

Business Premium runs on a Microsoft Entra ID tenant. Every user, admin, guest and app registration is an Entra object, and the licence adds the P1 features that let you write access rules rather than accept Microsoft's fixed baseline.

What the licence includes for security

Microsoft's Business Premium FAQ notes that the security benefits apply to users licensed for Business Premium, and recommends licensing every user. Plan Defender licensing for the whole tenant: if you add Defender for Endpoint Plan 2 (for example through the Microsoft Defender Suite add-on) to only some users, the whole tenant keeps the Defender for Business experience until all users are licensed and Microsoft Support switches it.

Security defaults versus Conditional Access

Microsoft's guidance is explicit that organisations implementing Conditional Access policies that replace security defaults must disable security defaults, and should enable their policies immediately afterwards. Build and test the policies in report-only mode first so there is no gap. See the Conditional Access Guide.

A starter Conditional Access set for a small business:

• Require MFA for all users: all cloud apps, excluding only the emergency access group.
• Require phishing-resistant authentication strength for admin roles: target directory roles such as Global Administrator, Exchange Administrator and User Administrator.
• Block legacy authentication: client apps condition set to Exchange ActiveSync and other clients.
• Block device code flow: unless a named meeting room or kiosk device needs it.
• Require compliant devices for business data on desktops: once Intune enrolment covers all company PCs; use app protection policies for personal phones instead.

Credential attacks you are blocking here include ATT&CK T1110.003 Password Spraying and T1078.004 Cloud Accounts. For the wider small business identity picture, see the Small Business Identity and Access Security Guide.

Admin roles and privileged access

Microsoft's Business Premium guidance on protecting admin accounts sets the baseline:

• Separate accounts: daily work from an ordinary licensed account; admin tasks from a dedicated admin account. Microsoft notes admin-only accounts do not need a Microsoft 365 for business licence, and suggests names that do not reveal admin status.
• Least privilege: someone who creates users gets User Administrator, not Global Administrator. Keep Global Administrator to two or three named people plus emergency accounts. See Microsoft 365 admin centres and admin roles.
• Passwordless for admins: Microsoft Authenticator, passkeys (FIDO2) and Windows Hello for Business are available on every plan; Business Premium adds the ability to require them with Conditional Access authentication strength.
• Clean sessions: close personal email and unrelated tabs before admin work, use a private browser window, and sign out afterwards.

Emergency access accounts

Create at least two cloud-only emergency access accounts on the onmicrosoft.com domain with Global Administrator. Microsoft's Business Premium admin page describes excluding them from MFA with long passwords; Microsoft Entra's current emergency access guidance instead recommends a passwordless, phishing-resistant method (a FIDO2 passkey, or certificate-based authentication if you run PKI) that differs from your other admins' methods, and states these methods satisfy the mandatory MFA requirements. Follow the Entra guidance. Exclude the accounts, through a dedicated group, from Conditional Access policies that block or restrict sign-in; store the security keys in safes in separate locations; alert on every sign-in; and test them at least every 90 days. See the Break-Glass Account Guide.

What is missing at this licence level

Privileged Identity Management (just-in-time role activation) and Entra ID Protection risk-based policies are Entra ID P2 features and are not part of Business Premium. Compensate with a small number of standing admins, phishing-resistant MFA, admin sign-in alerts and a monthly role review, or add Entra ID P2 for admins only. See the Privileged Identity Management (PIM) Guide. If an outside IT provider administers the tenant, govern its access as carefully as your own staff; see Choosing an IT Support Provider or MSP Securely.

Integrations, API tokens and service accounts

Small tenants accumulate non-human identities quickly: line-of-business apps, scanners that send email, backup services, accounting integrations and AI add-ins. Each is an app registration, enterprise application or shared mailbox with its own access.

• User consent: Microsoft recommends allowing user consent only for apps from verified publishers. Consent phishing turns a user's click into a long-lived token for an attacker (ATT&CK T1528 Steal Application Access Token); restricting user consent is the main mitigation. See the Entra ID Applications and Consent Guide.
• Mail-capable apps: review which apps hold Mail.Read, Mail.Send or full_access_as_app and narrow them. See How to review Microsoft 365 app registrations with mail permissions and the Microsoft 365 Application Access Policies and RBAC for Applications Guide.
• Secrets on app registrations: list expiring and long-lived client secrets and replace them; see How to find expiring app secrets and certificates in Entra ID.
• Local admin passwords on PCs: manage them with Windows LAPS through an Intune account protection policy so every device has a unique, rotated password. See the Local Administrator Password Solution (LAPS) Guide.
• Service accounts disguised as users: accounts like "scanner@" with a password and no MFA are frequent targets; replace them, or at minimum keep them inside your MFA policy and restrict them by location with Conditional Access.

Logging and detection

Business Premium gives you Audit (Standard), where Microsoft retains audit records generated from 17 October 2023 for 180 days; one-year retention needs E5-level licences for the users who generate the activity. Export what you need for longer to a SIEM or storage. See the Microsoft 365 Unified Audit Log Guide for Detection.

Defender for Office 365 Plan 1 provides Real-time detections rather than Threat Explorer, and automated investigation and response for email is a Plan 2 capability; plan manual email investigation accordingly. For a structured response if an account or tenant is compromised, use the Microsoft 365 Tenant Compromise Playbook.

Metrics that show it is working:

• Percentage of users covered by a Conditional Access MFA policy (target 100%, with only the emergency group excluded).
• Number of standing Global Administrators (target two to four, plus emergency accounts).
• Percentage of company devices enrolled in Intune and onboarded to Defender for Business.
• Users covered by the Standard or Strict preset security policy.
• Enterprise apps with high-privilege permissions reviewed in the last quarter.
• Days since emergency account last tested (target under 90).

Hardening baseline

Switch things on in this order. Each step is reversible: Conditional Access policies can be returned to report-only, preset security policies turned off, and Intune policies unassigned.

1. Prepare admin access: create separate admin accounts, register passkeys for them, create two emergency access accounts and the sign-in alert, and reduce Global Administrators.
2. Build Conditional Access in report-only: create the starter policies above, review the report-only results in sign-in logs for a week, fix exceptions.
3. Switch over: turn the policies on and disable security defaults in the same change window.
4. Lock down consent: set user consent to verified publishers and low-impact permissions, enable the admin consent workflow, and review existing grants.
5. Protect email: apply the Standard preset security policy to all users and Strict to finance, directors and admins (Email & collaboration > Policies & rules > Threat policies > Preset Security Policies), add key people and partner domains to impersonation protection, and tag priority accounts. See the Microsoft Defender for Office 365 Configuration Guide.
6. Enrol devices: use Windows Autopilot or enrolment for company PCs, app protection policies for personal phones, and compliance policies requiring encryption and a supported OS. See the Small Business Device Management Guide.
7. Onboard Defender for Business: use the simplified configuration to apply next-generation protection, firewall and attack surface reduction policies, starting attack surface reduction rules in audit mode for a pilot group.
8. Add compliance-based access: once devices are enrolled, require compliant devices for desktop access to business data.
9. Protect data: publish sensitivity labels and email encryption for confidential mail, and set sharing limits for SharePoint and OneDrive. See the Microsoft Purview Information Protection Guide.
10. Back up and review: confirm a backup approach for mail and files (see the Microsoft 365 Backup) and schedule a monthly review of roles, apps, guests and alerts.

Decision guidance: a firm under about 25 users with no IT staff should aim for steps 1 to 5 in the first month and lean on an MSP for devices. A firm approaching the 300-user cap, or with regulated data, should consider the Defender Suite add-on (Defender for Endpoint Plan 2) and Entra ID P2 for admins, since PIM, Threat Explorer and longer audit retention start to matter more than cost. Business Premium cannot be used above 300 users; growth beyond that means an enterprise plan.

Framework mapping

Common misconfigurations

• Security defaults left on with P1 available: it prevents Conditional Access and leaves no way to require phishing-resistant MFA for admins or compliant devices.
• Turning security defaults off before policies are ready: the tenant sits without MFA enforcement until someone builds policies. Do both in one change.
• Everyone is a Global Administrator: common where the owner, office manager and MSP all share the top role from daily accounts. One phished mailbox becomes a tenant takeover.
• Preset policies never assigned: Standard and Strict apply to no one until you turn them on and assign recipients; only Built-in protection covers everyone by default, and its Safe Links settings allow click-through.
• Open user consent: the legacy "Allow user consent for apps" setting lets any user grant any app non-admin permissions to their mail and files.
• Licensed "service users" with passwords: scanner and integration accounts excluded from MFA become the easiest way in. See the Email Identity and BEC Guide for how attackers use mailbox access.

Practitioner checklist

• Confirm every user who needs protection holds a Business Premium licence.
• Create separate admin accounts with least-privilege roles and phishing-resistant sign-in.
• Create two emergency access accounts with FIDO2 keys, sign-in alerts and a 90-day test.
• Build Conditional Access in report-only, switch it on, and disable security defaults in the same change.
• Restrict user consent to verified publishers and enable the admin consent workflow.
• Apply Standard and Strict preset security policies and configure impersonation protection.
• Enrol company devices in Intune, onboard them to Defender for Business, and deploy Windows LAPS.
• Review app registrations, mail permissions, secrets and guests every quarter.
• Export audit logs beyond 180 days if you need longer history.
• Decide whether Entra ID P2 or the Defender Suite add-on is justified for admins or high-risk users.

Standards and references

• Microsoft Learn: Microsoft 365 Business Premium documentation
• Microsoft Learn: Protect your administrator accounts (Business Premium)
• Microsoft Learn: Microsoft 365 Business Premium security FAQ
• Microsoft Learn: Security defaults in Microsoft Entra ID
• Microsoft Learn: Manage emergency access admin accounts
• Microsoft Learn: Preset security policies in EOP and Defender for Office 365
• Microsoft Learn: Configure how users consent to applications
• Microsoft Learn: Manage audit log retention policies

Related NHI Mgmt Group resources: Microsoft 365 Security Guide · Microsoft 365 Security Checklist · Small Business Cybersecurity Basics Guide · Conditional Access Guide