Which Microsoft 365 Plan
Is Right for You?
Answer 10 questions about your organization. Get a specific license recommendation with cost comparison — and find out which paid-for security features you're not using yet.
How many employees need Microsoft 365 licenses?
Include full-time, part-time, and contract workers who need email or Office apps. This determines which plan families are available to you.
Do your users need desktop versions of Word, Excel, and PowerPoint?
Desktop apps offer full functionality and offline access. Web and mobile versions are included in all plans but have feature limitations.
Do you need Conditional Access policies to control who can sign in, from where, and on what devices?
Conditional Access lets you block sign-ins from risky locations, require MFA for admins, and enforce device compliance. It requires Entra ID P1 (Business Premium) or higher.
How important is advanced email threat protection for your organization?
Microsoft Defender for Office 365 adds Safe Links, Safe Attachments, and anti-phishing protection beyond basic Exchange Online Protection.
Do you need to manage and secure employee devices (laptops, phones, tablets)?
Microsoft Intune lets you enforce encryption, wipe lost devices, push security policies, and control which devices can access company data. Included in Business Premium and E3+.
Do you have regulatory compliance requirements (HIPAA, PCI, CMMC, FINRA, etc.)?
Compliance requirements typically need Data Loss Prevention (DLP), sensitivity labels, audit logging, and eDiscovery. Higher-tier plans include these features natively.
Do you want automatic detection and response to compromised accounts and risky sign-ins?
Entra ID Protection (P2) automatically detects impossible travel, credential leaks, and suspicious behavior — then enforces password resets or blocks access. Requires Entra ID P2 (E5 or add-on).
How many users have admin roles (Global Admin, Exchange Admin, SharePoint Admin, etc.)?
More admin accounts = more risk. Privileged Identity Management (PIM) makes admin roles just-in-time and time-limited. PIM requires Entra ID P2.
How much cloud storage do you need per user?
OneDrive storage varies by plan. Business plans cap at 1 TB per user. Enterprise plans offer unlimited storage (after 5+ users).
What's your top priority when choosing a plan?
This helps us weigh our recommendation. There's no wrong answer — it's about what matters most to your organization right now.
Your License Recommendation Is Ready
Enter your email to get a detailed recommendation with cost comparison and a list of unused security features you're paying for.
Microsoft 365 Licensing for Small Business: How to Pick the Right Plan and Stop Overpaying
Microsoft 365 licensing is one of those problems that feels simple until you actually try to solve it. There are five main plans for businesses, dozens of add-ons, overlapping feature sets across tiers, and a pricing structure that changes every couple of years. Most small businesses either pick the cheapest plan and miss out on security features they need, or pick Business Premium “to be safe” and pay for capabilities they never configure.
Industry research suggests that more than half of M365 licenses are underutilized. Organizations routinely pay for features that sit dormant — Conditional Access policies that were never created, Intune enrollment that was never completed, Defender for Office 365 that’s technically active but hasn’t been tuned. The license is there. The protection isn’t.
The tool above walks you through the decision systematically. Below, we break down what each plan actually includes from a security perspective, where the real cost differences are, and how to avoid the two most expensive licensing mistakes businesses make.
The Five Plans That Matter for Small and Mid-Sized Business
Microsoft offers Business plans (for organizations up to 300 users) and Enterprise plans (unlimited users). Here’s what you’re actually getting at each tier, focused on the security and management features that drive most of the cost difference.
Business Basic
Web and mobile Office apps, Exchange email (50 GB mailbox), Teams, SharePoint, 1 TB OneDrive. Security is limited to Security Defaults — a binary on/off switch for basic MFA with no granularity. No Conditional Access, no Intune, no Defender for Office 365, no DLP. This is the right plan for organizations with fewer than 25 users who need email and collaboration and don’t handle sensitive data.
Business Standard
Everything in Basic plus the full desktop Office suite (installed Word, Excel, PowerPoint, Outlook) and business apps like Bookings and Loop. Security is identical to Basic — still Security Defaults only. The extra cost is purely for desktop app access. If your team needs installed Office but doesn’t need advanced security, this is the tier. If security matters, skip this and go to Premium.
Business Premium
The security inflection point. Adds Entra ID P1 (Conditional Access, App Proxy), Intune for device management, Defender for Office 365 Plan 1 (Safe Links, Safe Attachments, anti-phishing), DLP, sensitivity labels, and Defender for Business (endpoint protection). This is where you get granular access control, device compliance enforcement, and real email threat protection. For most businesses under 300 users with any security obligations, this is the plan.
Microsoft 365 E3
Removes the 300-user cap, adds unlimited OneDrive storage, eDiscovery, Windows 11 Enterprise, and Information Barriers. Security features are comparable to Business Premium with expanded compliance capabilities. If you’ve outgrown the Business plan user limit or need deep compliance and audit functionality, E3 is the step up.
Microsoft 365 E5
The full stack. Adds Entra ID P2 (risk-based Conditional Access, automated compromise detection), Privileged Identity Management (just-in-time admin roles), advanced audit logging (1+ year retention), Microsoft Defender for Endpoint Plan 2, Cloud App Security, and Power BI Pro. This is for organizations that need automated threat response, advanced compliance, or have enough admin accounts to warrant PIM.
The Two Most Expensive Licensing Mistakes
Mistake 1: Buying Premium and Not Configuring It
This is the most common pattern we see. A business upgrades to Business Premium for the security features — often after an incident, an audit, or a conversation with their insurance provider. They’re now paying $22 per user per month. But nobody actually sets up the features they’re paying for.
Conditional Access policies don’t create themselves. Intune doesn’t enroll devices automatically. Defender for Office 365 ships with default settings that leave significant gaps in phishing and impersonation protection. DLP policies need to be built around the specific types of sensitive data your business handles. Sensitivity labels need to be designed, published, and communicated to users.
The result is a Business Premium license running at Business Standard capability. The $9.50 per user per month premium is going entirely to waste. For a 50-person company, that’s $5,700 per year in security features that exist on paper but aren’t doing anything.
Mistake 2: Staying on Basic or Standard When You Need Premium
The flip side. A business stays on Business Basic or Standard because “we’ve always been on it” or “we don’t have IT staff to manage the extra features.” They’re saving $9.50–$16 per user per month compared to Premium. But they’re also running without Conditional Access, without device management, without advanced email protection, and without DLP.
When these businesses need security — after a phishing incident, a compliance requirement, or a cyber insurance application — they discover that the features they need either require upgrading or purchasing expensive add-ons. Defender for Office 365 Plan 1 as a standalone add-on is $2 per user per month. Intune Plan 1 standalone is $8 per user per month. Entra ID P1 standalone is $6 per user per month. Adding those three individually costs $16 per user per month — more than the $9.50 upgrade to Premium that includes all of them plus DLP, sensitivity labels, and endpoint protection.
When to Consider Enterprise Plans (E3/E5) as a Small Business
Business plans cap at 300 users, which makes the Enterprise decision obvious for growing organizations. But there are four scenarios where businesses under 300 users should consider E3 or E5 instead of Business Premium.
You need unlimited OneDrive storage. Business plans cap at 1 TB per user. E3 and E5 offer unlimited storage (for tenants with 5+ users). If your team works with large media files, design assets, or project archives, the storage ceiling matters.
You need eDiscovery. Legal holds, content searches across mailboxes and SharePoint, and case management aren’t available in Business plans. If you’re in a regulated industry where litigation holds are a reality, E3 is the minimum.
You need risk-based Conditional Access or PIM. Entra ID P2 features — automatic detection of impossible travel, compromised credentials, and anomalous sign-ins — are only included in E5 (or as an add-on to E3 or Premium). If you have multiple admin accounts and want just-in-time activation with automatic expiration, you need PIM, which also requires P2.
You want a single vendor for endpoint detection and response. Defender for Endpoint Plan 2 in E5 provides full EDR capabilities — automated investigation and remediation, threat hunting, attack surface reduction. If you’re currently paying for a separate EDR tool, consolidating into E5 may actually reduce total cost.
How to Audit Your Current Licensing
If you already have Microsoft 365 and want to know whether you’re on the right plan, here’s a quick self-assessment.
- Check your plan in the Admin Center. Go to admin.microsoft.com → Billing → Your Products. This tells you exactly which plan each user is on and what you’re paying.
- Check your Secure Score. Go to security.microsoft.com → Secure Score. Microsoft grades your tenant’s security configuration. If your score is below 50%, you likely have features available that haven’t been configured — especially if you’re on Business Premium or higher.
- Check Conditional Access. Go to entra.microsoft.com → Protection → Conditional Access. If you’re on Business Premium and this page is empty, you’re paying for a feature you’re not using.
- Check Intune enrollment. Go to intune.microsoft.com → Devices. If you’re on Premium and no devices are enrolled, your device management is inactive.
- Check Defender policies. Go to security.microsoft.com → Policies. Look for anti-phishing, Safe Links, and Safe Attachments policies. If they’re all defaults or missing, your email protection has gaps.
If any of those checks reveal unconfigured features, you’re paying for protection you’re not getting. That’s the gap we close for our clients.
Frequently Asked Questions
Can I mix different Microsoft 365 plans in the same tenant?
Yes. Microsoft allows you to combine different license types within the same tenant. You can put executives and finance staff on Business Premium for full security features while keeping frontline workers on Business Basic for email and Teams. This mix-and-match approach is one of the most effective ways to optimize licensing costs without sacrificing security where it matters.
What’s the difference between Business Premium and E3?
Business Premium ($22/user/mo) and E3 ($36/user/mo) have similar security features, but E3 removes the 300-user cap, adds unlimited OneDrive storage, includes eDiscovery and advanced compliance tools, and bundles Windows 11 Enterprise. If you’re under 300 users and don’t need eDiscovery or unlimited storage, Business Premium gives you comparable security at a lower price.
Is it cheaper to buy add-ons or upgrade to a higher plan?
In most cases, upgrading is cheaper. For example, adding Defender for Office 365 ($2), Intune ($8), and Entra ID P1 ($6) individually to Business Standard costs $16/user/month — more than the $9.50 difference between Standard and Premium, which includes all three plus DLP, sensitivity labels, and endpoint protection. The add-on approach only makes sense when you need a single feature for a small subset of users.
How do I know if I’m using the security features I’m paying for?
Check three places in your admin portals: Conditional Access policies in Entra (should have active policies, not empty), device enrollment in Intune (should show your managed devices), and threat protection policies in Microsoft Defender (should have custom anti-phishing, Safe Links, and Safe Attachments policies). If any of these are empty or using only default settings, you have paid features that aren’t protecting you. Microsoft Secure Score also provides a percentage-based grade of how much of your available security configuration you’ve actually implemented.
Are Microsoft 365 prices increasing?
Microsoft announced price increases effective July 1, 2026 for most plans. Business Basic rises from $6 to $7, Business Standard from $12.50 to $14.50, and E3 from $36 to $39 per user per month. Business Premium stays at $22 — making it an even better value relative to the other tiers. Locking in annual commitments before the increase date can protect current pricing through your agreement term.
Do I need Entra ID P2 (E5) for Conditional Access?
No. Basic Conditional Access policies — MFA enforcement, legacy auth blocking, location-based restrictions, device compliance — require Entra ID P1, which is included in Business Premium and E3. Entra ID P2 (included in E5) adds risk-based policies that automatically respond to suspicious sign-ins and compromised credentials. If you want policies that react to impossible travel or leaked passwords automatically, you need P2. For most small businesses, P1 covers the critical use cases.