What Your Microsoft 365 Licence Actually Lets You See
By Andrew McDowell
There is a question nobody asks before buying a Microsoft 365 security tool, and it decides how much of that tool you will ever be able to use: what does my licence let anyone see?
It matters because Microsoft does not sell you security features. It sells you tiers, and the security data sitting behind those tiers is not the same at each one. A tool that reads your tenant can only read what your licence exposes. If the demo you watched was run on Microsoft's top tier, and it almost certainly was, parts of what you saw are not available to you at any price short of upgrading.
We ran into this ourselves, which is why this article exists. We built a connector that reads Microsoft 365 tenants (basically your organisation's Microsoft 365 account), tested it on our own, and found a whole feature returning an access error. Not a bug. A licence.
The three tiers most small businesses are actually on
Ignore the enterprise plans for a moment. Australian small businesses are overwhelmingly on one of three plans.
| Business Basic | Business Standard | Business Premium | |
|---|---|---|---|
| Desktop Office apps | No | Yes | Yes |
| Entra ID P1 | No | No | Yes |
| Conditional Access | No | No | Yes |
| Intune device management | No | No | Yes |
| Defender for Business | No | No | Yes |
| Defender for Office 365 Plan 1 | No | No | Yes |
Read that middle column carefully, because it is where most businesses sit and it is the one that surprises people. Business Standard buys you the Office apps, not security. Everything in the security column arrives at Premium.
That is not a criticism of the plan. It is a criticism of how it gets sold. As the sensible middle option, when in security terms it is identical to the cheapest one.
The thing nobody tells you about Secure Score
If you have opened the Microsoft admin centre, you may have seen a Microsoft Secure Score: a percentage, with a list of recommended improvements underneath it.
It is a genuinely useful number and it is free with your subscription. But it has a property that almost nobody realises, and misreading it will make you feel considerably safer than you are.
Your Secure Score is graded against the products your subscription includes. Microsoft only marks you on protections that are available to you. A tenant on a cheaper plan is sitting a shorter exam.
The consequence is uncomfortable. A Business Standard tenant scoring 70% and a Business Premium tenant scoring 70% are not equally secure, the Premium tenant answered more questions to get there. Most of the high-value improvement actions, the ones worth the most points, depend on tooling that only exists at Premium: Conditional Access, device compliance, the Defender policies.
So the score is honest about what you are doing with what you have. It is silent about what you have chosen not to have. If you compare your percentage against someone else's, you are comparing two different exams.
Where the wall is: multi-factor authentication reporting
Here is the specific one that caught us.
"How many of my staff have multi-factor authentication turned on, and which of my administrators don't?" is close to the single most useful security question a small business can ask. Compromised accounts without MFA are not an exotic attack. They are the ordinary way small businesses get hurt.
Microsoft can answer this. There is a standard report that returns exactly which sign-in methods each person has registered, filterable to your administrators. Any tool that reads your tenant (including ours) gets it from the same place, an interface Microsoft calls Graph.
It requires an Entra ID P1 licence — Microsoft's paid identity tier, and the thing Business Premium quietly buys you that Business Standard does not. Below it the information simply isn't available. So on Business Premium you can see which of your staff have MFA enabled and which do not; on Business Standard or Basic you cannot, which is a shame, because it is one of the most useful things a small business could know about itself.
Our own tenant is Business Standard. So the first time we ran our own connector against our own business, the multi-factor section rendered nothing. Correct permissions, correct consent, correct code. The problem was the licence.
We have left that in the product deliberately. If your plan cannot supply the data, we tell you that is why, rather than showing you an empty panel and letting you conclude the tool is broken or that nobody in your business has MFA.
The one to watch out for in vendor demos
There is a category of Microsoft security data that sounds like it should be in Business Premium and is not: Defender Vulnerability Management.
This is the software-inventory-and-known-vulnerabilities view. Every application on every device, matched against published CVEs (these are holes in software systems discovered by IT security researchers and then documented into a public library for reference). It demos beautifully. It is the screen most likely to make an owner reach for the credit card.
Business Premium includes Defender for Business, which is a real and worthwhile product. But Microsoft Defender Vulnerability Management is not currently available to Defender for Business customers. Getting it means Defender for Endpoint Plan 2 with the vulnerability management add-on, which in practice means an enterprise licence or a per-device surcharge.
If a vendor shows you a device software inventory, ask which licence it needs. The answer is not Business Premium.
What we read, at each tier
Since the whole point of this article is that vendors should say where their walls are, here is ours.
On any plan, including Business Basic and Standard:
- Your Microsoft Secure Score, and the settings behind it
- Microsoft's own recommended improvements, ordered by what is worth most in your tenant, each with a link into the admin centre page where you make it
- A 90-day trend, so you can see whether it is moving
- How you compare with organisations of a similar size
Adds at Business Premium (or anything else with Entra ID P1):
- Multi-factor authentication coverage across your staff, and specifically which administrators do not have it
Adds at E3 or E5: nothing.
That last line is the honest one. We do not read Defender Vulnerability Management data, so an enterprise licence buys you nothing extra from us. Our ceiling is Business Premium. We would rather say that than imply a bigger product for bigger customers.
We also cannot see two things at any licence tier, and they are worth stating plainly: your backups, which Microsoft does not expose in a form we can read, and application control, where what we can see is thin. If either matters to you, and backups should, that stays a question you answer yourself.
So should you upgrade?
We are not going to tell you to. It depends on things we do not know about your business, and the honest answer for a lot of small firms is that Business Standard plus disciplined basics beats Business Premium bought and never configured.
What we would say is this. The gap between Standard and Premium is not "nicer Office". It is the entire identity and device security layer, and it is the layer that decides whether a stolen password becomes an incident. If you are being asked to evidence your security position by an insurer at renewal, a client during procurement, or a government tender, that is the layer they are asking about.
Find out where you stand before you decide. Our Microsoft 365 connector is included on every plan we offer, including the free one. It takes a Global Administrator about a minute, it is read-only, we hold no write access of any kind, and your administrator can withdraw it at any time from the Microsoft 365 admin centre without contacting us.
Whatever your licence lets us see, we will show you — and where it lets us see nothing, we will tell you that instead.
Sources for the licensing claims in this article: Microsoft Entra licensing · Microsoft Entra authentication methods API overview · Compare Microsoft Defender Vulnerability Management plans and capabilities · Microsoft Secure Score. Microsoft changes licensing regularly; check against current documentation before making a purchasing decision.