Microsoft 365 licensing and security features: a reference

On Business Premium vs E3 security features, Microsoft’s documentation lists Entra ID P1 (which Conditional Access needs), Intune Plan 1 and Defender for Office 365 Plan 1 in both plans, with Plan 1 included in Microsoft 365 E3 from 1 July 2026. Microsoft says Business Premium also includes Defender for Business, and that the Business plans are for organisations with up to 300 users.

Microsoft’s service descriptions are authoritative. Microsoft changes what each plan includes, renames features and introduces new add-ons regularly. This page summarises what Microsoft’s documentation said on 21 October 2026. Before relying on any row, check the linked Microsoft page and confirm with the organisation’s licensing provider. This page isn’t licensing or purchasing advice, and it contains no prices.

Many Microsoft 365 security guides start with “this needs licence X”. This reference brings together what Microsoft’s own pages say about the security features in the plans small and medium organisations most often use, including how Microsoft 365 Business Premium and E3 compare: Microsoft 365 Business Basic, Business Standard and Business Premium, and Microsoft 365 E3 and E5.

The Business plans and the 300-seat limit

Microsoft’s Business FAQ says the Business plans “are designed for organizations with up to 300 users only”, and that organisations “may only provision up to 300 seats total across all of our Business family of plans”. It says Business Premium “includes everything in Microsoft 365 Business Standard”, plus security products including Microsoft Defender for Business and Microsoft Defender for Office 365 Plan 1.

How to check which plans a tenant has

Based on Microsoft’s instructions (checked October 2026). Microsoft’s “What Microsoft business subscriptions do I have?” page has the latest steps.

1. Sign in to the Microsoft 365 admin center as a Global Administrator or Billing Administrator (Microsoft says one of these roles is needed).
2. In the Dashboard view, go to Billing > Your products. In the Simplified view, select Subscriptions.
3. Compare the plan names listed there with the columns in the table below.

Reference table

“E3” and “E5” below mean Microsoft 365 E3 and E5, not Office 365 E3 and E5, which differ. “Not covered” means the cited pages didn’t state it either way.

What some rows mean

• Security defaults are a set of baseline identity settings that Microsoft’s Entra licensing page says are “available for all customers”. Conditional Access is the more configurable alternative, explained in the guide to security defaults vs Conditional Access.
• Defender for Office 365 Plan 1 adds, according to Microsoft, Safe Links, Safe Attachments and user and domain impersonation protection. Microsoft describes Plan 2 as all of Plan 1 plus tools such as Threat Explorer, automated investigation and response, and attack simulation training. The guide to Defender for Office 365 Plan 1 vs Plan 2 covers these features.
• Intune Plan 1 is Microsoft’s device and app management service. Microsoft’s Business Premium overview says it “improves upon Basic Mobility and Security”, including support for more device types such as macOS. The guide to Microsoft Intune for small business explains enrolment, app protection and compliance.
• Defender for Business is, in Microsoft’s words, “an endpoint security solution based on Microsoft Defender for Endpoint… designed for small and medium sized business up to 300 users”.
• Sensitivity labels. The table rows follow the Purview service description’s feature tables, which list manual sensitivity labelling for Business Premium and Microsoft 365 E3 and E5. The same page also contains the sentence “Sensitivity labeling, including automatic or policy-based labeling, requires a Microsoft 365 E5 license or Microsoft 365 Information Protection and Governance (IPG)”, which doesn’t match its own tables. Microsoft or a licensing provider can confirm which applies to a particular tenant.
• Purview features are explained in the guides to sensitivity labels vs DLP in Microsoft 365 and Microsoft 365 audit log retention and alerts.

Common add-ons Microsoft describes

• Microsoft Defender Suite for Business Premium. Microsoft’s Business Premium overview lists it as purchased separately, adding Entra ID P2, Defender for Identity, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2 and Defender for Cloud Apps.
• Microsoft Purview Suite for Business Premium. Microsoft’s Purview service description lists Purview suites for Business Premium among the plans with Audit (Premium). It states these add-ons “require a Microsoft 365 Business Premium base license and are capped at 300 seats total”.
• 10-Year Audit Log Retention. Microsoft’s Purview pages describe this as a separate add-on licence.
• Intune Plan 2 and Intune Suite. Microsoft’s Intune licensing page describes both as add-ons to Intune Plan 1.
• Defender for Business (standalone). Microsoft says it is available to eligible organisations with up to 300 users, giving Business Basic, Business Standard and Office 365 E1 as examples.

Things that change

Microsoft’s Defender for Office 365 service description states that Plan 1 is included “in Microsoft 365 Business Premium and, effective July 1, 2026, in Office 365 E3 and Microsoft 365 E3”, adding Plan 1 protection but not Plan 2 capabilities. Microsoft also notes its feature table “may change without notice”. Some non-Microsoft sites describe other features being added to Microsoft 365 E3 and E5 from July 2026; this page lists only what Microsoft’s own pages state. Plan names, bundles and add-ons change regularly; the linked Microsoft pages are the places to check what is current.

Common questions

What is the difference between Business Premium and E3 for security?

On Microsoft’s pages, the two plans share most core security features: Entra ID P1 with Conditional Access, Intune Plan 1, Audit (Standard) and Defender for Office 365 Plan 1, which Microsoft says is in Microsoft 365 E3 from 1 July 2026. Microsoft says Business Premium includes Defender for Business and is limited to 300 users across the Business plans. The cited pages don’t state whether E3 includes Defender for Business. The reference table shows each row with its source.

Does Microsoft 365 Business Premium include Conditional Access?

Yes. Microsoft says Conditional Access needs Microsoft Entra ID P1, and lists P1 in Business Premium, Microsoft 365 E3 and E5. Business Basic and Business Standard have Entra ID Free with security defaults, which Microsoft’s Entra licensing page says are “available for all customers”. The guide to security defaults vs Conditional Access explains how the two compare.

What security features does Microsoft 365 Business Standard include?

Microsoft lists Entra ID Free with security defaults, the built-in email protection included with every Exchange Online cloud mailbox, Basic Mobility and Security for device management, and Audit (Standard). It doesn’t list Conditional Access, Defender for Office 365 or Intune Plan 1 for Business Standard. Microsoft says Defender for Business is available standalone for eligible organisations. The reference table has the full comparison.

How many users can Microsoft 365 Business Premium have?

Microsoft’s Business FAQ says the Business plans “are designed for organizations with up to 300 users only”, and that organisations “may only provision up to 300 seats total across all of our Business family of plans”. Microsoft also says its Purview suites for Business Premium are capped at 300 seats total. The Business plans and the 300-seat limit quotes Microsoft’s wording.

Does Business Premium include Entra ID P2?

Not in the base plan, according to Microsoft’s pages. Microsoft’s Entra licensing page lists Entra ID P2, which ID Protection and Privileged Identity Management need, in Microsoft 365 E5. For Business Premium, Microsoft lists it through the Microsoft Defender Suite for Business Premium, a separately purchased add-on that also includes Defender for Endpoint Plan 2 and Defender for Office 365 Plan 2. Common add-ons Microsoft describes lists the others.

How do I check which Microsoft 365 plan I have?

Microsoft’s instructions say to sign in to the Microsoft 365 admin center as a Global Administrator or Billing Administrator, then go to Billing > Your products in the Dashboard view, or Subscriptions in the Simplified view. The plan names listed there can be compared with the columns in this page’s table. How to check which plans a tenant has links to Microsoft’s latest steps.

Related guides

• Security defaults vs Conditional Access
• Microsoft 365 security baseline
• Audit logs and alerts in Microsoft 365