How the plan picker decides
Microsoft 365 for business comes in three main plans — Business Basic, Business Standard and Business Premium — all designed for organizations of up to 300 users. They share the same core: business email, Teams, SharePoint and OneDrive. The differences come down to two questions: do your people need the installed desktop apps, and how much security and device management do you need built in?
The picker follows that logic:
- If you need any of the security or management features — Intune, Conditional Access, Defender for Business, Defender for Office 365, or protection for sensitive data — it suggests Business Premium.
- Otherwise, if people need desktop Word, Excel, PowerPoint or Outlook, it suggests Business Standard.
- Otherwise, Business Basic covers email, Teams, file sharing and Office in the browser.
- More than 300 users, or frontline staff on shared devices, add notes about the Enterprise (E3/E5) and frontline (F1/F3) families.
"Not sure" answers don't push you up a plan on their own, but they're flagged so you can find out. Your answers are saved in your browser only, so you can come back to them.
What each plan includes, in plain English
Business Basic is the cloud essentials: a mailbox on your own domain, calendars, Teams chat and meetings, SharePoint and OneDrive for files, and Word, Excel and PowerPoint in a web browser and on phones. It suits staff who spend their day in another system — a practice-management or EHR (electronic health record) app — and just need email and Teams.
Business Standard adds the installed desktop apps for Windows and Mac. If your bookkeeper lives in Excel or your front desk prefers desktop Outlook, this is the minimum.
Business Premium includes everything in Standard plus the security tools that Microsoft documents as part of the plan:
- Microsoft Entra ID P1 — Entra ID is the sign-in system behind Microsoft 365. P1 adds Conditional Access: rules like "only allow sign-in from company computers" or "block sign-ins from overseas".
- Microsoft Intune Plan 1 — manages Windows PCs, Macs, iPhones and Android devices: enforce encryption, push settings and apps, set up new laptops automatically with Autopilot, and wipe a lost device. See our Intune guide for small businesses.
- Microsoft Defender for Business — endpoint protection for computers, including EDR (endpoint detection and response), which watches for and stops attacks in progress, not just known viruses.
- Microsoft Defender for Office 365 Plan 1 — Safe Links (checks links when they're clicked), Safe Attachments (opens attachments in a sandbox first) and impersonation protection against fake "CEO" emails.
- Microsoft Purview Information Protection and data loss prevention (DLP) — sensitivity labels and rules that warn or block when someone tries to email, say, a patient list outside the practice.
Basic and Standard aren't unprotected. Every plan includes built-in anti-spam, anti-malware and anti-spoofing for email, multifactor authentication through Microsoft's "security defaults", and Basic Mobility and Security — a limited subset of Intune that can set passcode rules and wipe enrolled devices. What they lack is the finer control and the endpoint protection.
Basic Mobility and Security vs Intune
| Capability | Basic Mobility and Security (Basic, Standard) | Intune Plan 1 (Premium) |
|---|---|---|
| Wipe or retire a lost device | Yes | Yes |
| Manage Macs | No | Yes |
| Deploy apps, Wi-Fi and VPN profiles | No | Yes |
| App protection for personal phones (MAM) | No | Yes |
| Autopilot zero-touch setup for new PCs | No | Yes |
| BitLocker recovery key for Windows | No | Yes |
| Block non-compliant Windows PCs from data | Not on Windows PCs | Yes (with Conditional Access) |
Source: Microsoft Learn, Overview of Basic Mobility and Security.
What about HIPAA and sensitive data?
According to Microsoft's HIPAA/HITECH documentation, Microsoft makes its HIPAA business associate agreement (BAA) available by default through its online services data protection terms to customers that are covered entities or business associates, and in-scope services include Exchange Online, SharePoint, OneDrive and Teams. Microsoft also says plainly that the BAA alone doesn't achieve compliance — your setup and processes do.
That's why we steer medical and dental practices toward Business Premium. The HIPAA Security Rule expects you to control access, protect devices and guard against malware; Premium puts the tools for that in one license. Read more in Is Microsoft 365 HIPAA compliant? and HIPAA-compliant email encryption. CPA firms have similar duties under the FTC Safeguards Rule — see our guide for CPA firms.
More than 300 users, or frontline staff
Microsoft's plan options service description caps the Business family at 300 licenses in total; Enterprise plans have no cap. Frontline plans are for people on shared devices: Microsoft 365 F3 includes Teams, a kiosk mailbox, Office for the web and 2 GB of OneDrive, while F1 includes Teams and read-only Office on the web without mailbox rights. You can mix these with Business plans.
Business Premium customers can also add the Microsoft Defender Suite for Business Premium, which upgrades to Entra ID P2, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity and Defender for Cloud Apps. Most small offices don't need it on day one.
Mistakes we see
- Buying Premium and never switching it on. Intune, Conditional Access and Defender do nothing until they're configured. Many offices pay for Premium and still run with default settings.
- Mixing plans without a plan. Putting the owner on Premium and everyone else on Basic leaves most mailboxes and devices without the extra protection — and attackers usually go for the least-protected account.
- Paying for desktop apps nobody uses. Staff who only use the EHR and email in a browser may be fine on Basic — provided they don't handle data that needs Premium's protection.
- Assuming the license makes you HIPAA compliant. The BAA and the plan give you tools; you still need policies, a risk assessment and correct configuration. Our HIPAA security checklist is a good start.
- Using shared logins. One "frontdesk@" account used by three people can't have proper MFA or an audit trail. Give each person their own account and use a shared mailbox for the shared address.
Before you buy
- Licenses don't configure themselves. Premium's value comes from turning on and tuning Intune, Conditional Access and Defender.
- Count shared mailboxes (front desk, billing) — they usually don't need their own license.
- Check the commitment: monthly and annual terms are priced differently.
- Make sure multifactor authentication is on for everyone, whatever plan you pick.
Our full comparison, Business Basic vs Standard vs Premium, goes deeper. Plan details were checked on Microsoft Learn in October 2026; Microsoft updates plans, so confirm before you buy. Need help setting up Microsoft 365 properly? See our services or book a free call.