Microsoft 365 Business Premium: 7 security features you are not using (and should)

If you are on Business Premium and you have not enabled all of these, you are paying for security features and getting consumer-grade protection. Here is what to switch on this week.

1. Conditional Access policies

What it does: Stops sign-ins that look risky. You write rules like “block sign-ins from outside the UK” or “require MFA when off the corporate network” or “block legacy authentication entirely”. Microsoft evaluates each sign-in against the policies and blocks, MFA-prompts, or allows accordingly.

Why most SMBs miss it: It lives in Entra ID (formerly Azure AD), not the M365 admin centre. People look for it under Microsoft 365 → Security and never see it.

Quick wins to enable:

• Block legacy authentication (POP, IMAP, SMTP basic auth) for everyone. This stops 60 percent of credential-stuffing attacks against M365.
• Require MFA for all admin role members.
• Require MFA for any sign-in classified as “medium” or higher risk.
• Block sign-ins from countries you don’t operate in (the standard UK SMB blocks Russia, China, North Korea, Iran, and a few others).

Time to enable: 30 to 60 minutes. Test in “report-only” mode for a week before enforcing.

2. Defender for Office 365 (Plan 1)

What it does: Protects email, Teams, and SharePoint against phishing, malicious attachments, and dodgy links. Adds Safe Attachments (sandbox-detonates files before delivery) and Safe Links (rewrites URLs and re-checks at click time).

Why most SMBs miss it: It is on by default but the policies ship with conservative settings. Without tuning, dangerous attachments get through and impersonation alerts go unread.

What to tune:

• Enable the Standard preset security policy for the whole tenant.
• Add your CEO, CFO, and senior partners to impersonation protection. Defender will then alert when external emails try to spoof their display name.
• Switch Safe Attachments policy from “off” to “block” for all users.
• Set Safe Links to “on” and tick “do not let users click through to the original URL” if you have a non-technical user base.

Time to enable: 45 minutes.

3. Defender for Business (the EDR)

What it does: Endpoint Detection and Response, the modern replacement for antivirus. Watches process behaviour on every laptop and desktop, detects ransomware, lateral movement, credential dumping, command-and-control traffic, and isolates compromised devices automatically.

Why most SMBs miss it: Defender for Business needs to be deployed via Intune (or onboarding scripts). Many SMBs are still relying on the consumer-grade Windows Security that ships with Windows.

Steps to deploy:

• Verify Defender for Business is in your licence (it is, on Business Premium).
• Onboard each device via Intune compliance policy or by running the onboarding script per machine.
• Set up automated investigation and remediation (turn it to “Full” so the platform can act without a human approving every alert).
• Subscribe a security mailbox to the alerts (or pipe to your MSP’s SOC).

Time to enable: 2 to 4 hours for a 25-person team.

4. Intune (and the device compliance policies that go with it)

What it does: Mobile Device Management (MDM) and Mobile Application Management (MAM). Enforces disk encryption, screen-lock timeouts, password complexity, OS patch level. Pushes apps and configurations. Wipes corporate data from a lost laptop or a leaver’s phone without touching personal photos.

Why most SMBs miss it: Intune feels enterprise-y. The setup is deeper than ticking a box. Most SMBs default to setting up devices manually and never enrol them.

Minimum viable setup:

• Enrol every Windows and macOS device into Intune.
• Apply a baseline compliance policy: BitLocker / FileVault on, password 8+ chars with complexity, screen lock at 5 minutes, OS up to date within 30 days.
• Apply the Microsoft Security Baseline for Windows (signed, sane defaults).
• For mobile devices, deploy App Protection Policies on Outlook, Teams, OneDrive: require PIN, block copy-paste to non-managed apps, allow remote wipe of corporate data only.

Time to enable: 1 day for the policies, plus 15 minutes per device to enrol.

5. Sensitivity labels (Microsoft Purview Information Protection)

What it does: Classify and protect documents and emails by sensitivity (Public / Internal / Confidential / Highly Confidential). Labels can apply encryption, watermarks, and access restrictions. They follow the document, so a labelled file cannot be opened by an unauthorised person even if it leaves the tenant.

Why most SMBs miss it: The naming changed five times in five years (Azure Information Protection, MIP, Purview…). Most SMBs gave up trying to keep up.

Practical first labels to deploy:

• Public — no protection, fine to share externally.
• Internal — default for everything; watermark optional.
• Confidential / Client — only people inside your org plus the named client domain can open it. Encryption applied.
• Highly Confidential / Board — only named users can open it; copy/paste blocked; expires after 90 days.

Time to enable: Half a day for the policies. Ongoing change management to get users adopting them.

6. Data Loss Prevention (DLP) policies

What it does: Automatically detects when sensitive data (UK National Insurance numbers, credit card numbers, medical record IDs, custom keywords) is shared in email, Teams, OneDrive, or SharePoint and either warns the sender, blocks the action, or alerts the admin.

Why most SMBs miss it: Same reason as labels: the templates are intimidating and the consequences of misconfiguring (blocking legitimate work) feel scary.

Sensible starting policies:

• Block external sharing of files containing UK National Insurance numbers, credit card data, or passport numbers.
• Warn and log when staff send 10+ rows of customer email addresses outside the org.
• Detect and block external sharing of files labelled “Highly Confidential”.
• Alert when documents are downloaded to unmanaged devices.

Time to enable: 2 to 3 hours, plus a 2-week monitor-only period before enforcing.

7. Self-Service Password Reset (SSPR) with strong methods

What it does: Lets users reset their own password securely without ringing IT, using verified methods (Microsoft Authenticator, security questions, mobile phone). Saves help desk time, but more importantly, makes it harder for attackers to social-engineer your help desk into resetting a password for them.

Why most SMBs miss it: It is buried in Entra ID under Password Reset, and the registration prompt is easy to dismiss.

How to set up properly:

• Enable SSPR for all users.
• Require two authentication methods (e.g. Microsoft Authenticator + mobile phone).
• Disable “security questions” as a method (they are guessable).
• Force a registration campaign so all users complete enrolment within 14 days.
• Set the on-premises AD writeback if you still have a hybrid identity setup.

Time to enable: 1 hour plus the rollout window.

Bonus: enable audit logging and Sentinel-lite (Defender XDR)

Two more items most SMBs miss:

• Unified audit log. Off by default in some older tenants. Turn it on. Without it, you cannot investigate “who deleted that mailbox” or “where did this file go”.
• Defender XDR portal. The unified incident queue across Defender for Office, Defender for Endpoint, and Defender for Identity (if licensed). Subscribe a SecOps mailbox.

Your day-1 checklist

If you only have one day, do these in order:

1. Enable Conditional Access: block legacy auth, MFA on all admins.
2. Apply the Standard preset security policy in Defender for Office.
3. Onboard one pilot laptop into Defender for Business and confirm it appears in the Defender XDR portal.
4. Enrol one pilot laptop into Intune with the baseline compliance policy.
5. Enable SSPR with Authenticator + phone.
6. Turn on the unified audit log.

That gets you 80 percent of the protection in less than a day. The remaining 20 percent (DLP, sensitivity labels, full Intune rollout) is a 2 to 3 week project.

What you would pay for these features standalone

To put a number on what is sitting unused in your licence, here are the rough standalone costs of equivalent tooling:

• Conditional Access (no Microsoft equivalent without Entra P1) — ~£5 per user per month
• Defender for Office 365 standalone — ~£1.50 per user per month
• Comparable EDR (CrowdStrike Falcon, SentinelOne) — £5 to £9 per user per month
• MDM (Jamf, Workspace ONE) — £3 to £5 per user per month
• DLP (Symantec, Forcepoint) — £3 to £7 per user per month
• SSPR (Okta or similar) — included in IDaaS subscriptions ~£3 to £6 per user per month

Conservative total: £20 to £32 per user per month for equivalent third-party tooling. You are paying for it. Use it.

How Smart Start IT helps

This is exactly the work we do for clients on our managed IT services at Standard and Premium tiers. We deploy these features as part of onboarding, tune them to your specific risk profile, and train your team in 30 minutes.

If you are not sure whether your tenant is configured properly, a free IT health check includes a 15-point M365 security review. We tell you which of the seven features above is on, off, or misconfigured.

Related reading: our cyber security service, Cyber Essentials UK guide, IT support cost guide.

Frequently asked questions