- Business Premium bundles Entra ID Plan 1, Intune, Defender for Business, and Defender for Office 365 that small companies once bought separately.
- It is a security and device-management platform that happens to include email and Office, not the other way around.
- Unconfigured tools mean paying twice for third-party antivirus, remote-access, and password managers the plan already covers.
- A co-managed engagement turns on conditional access, MFA, Intune enrollment, and Defender, then retires the duplicate tools.
Most companies on Microsoft 365 Business Premium use a fraction of what they're paying for. The familiar parts, Outlook, Teams, Word, and Excel, get used every day. The reason the plan costs what it does, a genuine business-class security and management stack, usually sits switched off. Turning it on is most of what a good co-managed IT relationship does.
Here's what's actually in the box, in plain terms.
The security and management tools you already own
Business Premium bundles a set of tools that small companies used to buy separately, or do without:
- Microsoft Entra ID Plan 1, the identity layer: single sign-on, multi-factor authentication, conditional access (rules about who can sign in from where), and self-service password reset.
- Microsoft Intune, for managing devices: pushing security policies to laptops and phones, and setting up new machines without touching them (Autopilot).
- Microsoft Defender for Business, real endpoint protection: not just antivirus, but the ability to detect and isolate a compromised device.
- Microsoft Defender for Office 365, email security: scanning links and attachments for phishing and malware before they reach an inbox.
- Sensitivity labeling and basic data-loss prevention, to classify and protect documents.
- Windows 11 Pro use rights and the full Office apps, on top of Exchange, SharePoint, OneDrive, and Teams.
The short version: Business Premium isn't an email-and-Office plan with some security bolted on. It's a security and device-management platform that happens to include email and Office. Most SMBs have it backwards, which is why so much of it goes unused.
Why this matters for managed and co-managed IT
When these tools sit unconfigured, two things happen. First, you're paying twice, often buying a third-party antivirus, a separate remote-access tool, and a password manager that Defender, Intune, and Entra already cover. Second, you're exposed, because the protections you're entitled to aren't actually running.
A co-managed engagement, where an outside team works alongside your internal person or handles it end to end, is largely about closing that gap: turning on conditional access and MFA, enrolling devices in Intune, switching Defender on, and retiring the duplicate tools. The licensing is already bought. The value is in the configuration and the ongoing management.
What to do about it
If you're on Business Premium, the single most useful exercise is an audit: what's switched on, what's switched off, and which third-party tools you're paying for that the plan already replaces. That audit usually pays for itself in dropped subscriptions, before you even count the security improvement.
If you'd like a clear picture of what you already own and aren't using, that's exactly the kind of review we do. Let's talk it through.