Microsoft 365 Business Premium is the licence almost every UK accountancy practice under 300 people ends up on, and the question partners ask us most often is whether it is genuinely enough. It is a fair question, because the answer decides whether a practice is carrying an unfunded risk or paying twice for protection it already owns.
The honest answer is that Microsoft 365 Business Premium is enough for most of what an accountancy firm has to do, is emphatically not enough for a few things that matter a great deal to a regulated practice, and became a much better answer in October 2025 when Microsoft started selling security and compliance add-on suites designed specifically for it.
This guide takes the question seriously rather than answering it with a vendor comparison table. It works through what Microsoft 365 Business Premium actually licenses, where the ceiling sits on identity, email, devices, data classification, retention and audit, what the 300-seat cap really means for a growing practice, and what the new Microsoft Defender Suite and Microsoft Purview Suite add for £7.70 per user per month each. Along the way it prices a real 28-person, two-office practice four different ways. If you have already read our Microsoft 365 security checklist for accountancy firms, this is the licensing question that sits underneath every control in it.
Two related pieces are worth reading alongside this one. Cyber Essentials for accountancy firms covers the certification that most practices are asked for by clients and insurers, and Microsoft Copilot for accountants covers the add-on that changes the data-governance answer completely. All UK prices in this guide are the list prices published on Microsoft’s own UK storefront, excluding VAT, on an annual commitment.
Table of contents
- What Microsoft 365 Business Premium Actually Gives an Accountancy Firm
- The Short Answer: Where Microsoft 365 Business Premium Is Enough
- Identity: What Microsoft 365 Business Premium Covers With Entra ID P1
- Email: Microsoft 365 Business Premium Ships Defender for Office 365 Plan 1
- Devices: Microsoft 365 Business Premium Ships Defender for Business
- Data: What Microsoft 365 Business Premium Does and Does Not Classify
- Retention and Audit: The Accountancy Test Microsoft 365 Business Premium Half-Passes
- eDiscovery and Investigation When Microsoft 365 Business Premium Is All You Have
- The 300-Seat Ceiling in Microsoft 365 Business Premium
- What Microsoft 365 Business Premium Never Includes
- The Defender and Purview Suites: Microsoft 365 Business Premium Grew Up in October 2025
- Microsoft 365 Business Premium Versus E3, E5 and the New E7
- Copilot Changes the Microsoft 365 Business Premium Answer
- Does Microsoft 365 Business Premium Satisfy HMRC, Companies House and Cyber Essentials?
- A Worked Example: Microsoft 365 Business Premium in a 28-Person Practice
- Ten Ways Firms Make Microsoft 365 Business Premium Look Inadequate
- A 90-Day Plan to Make Microsoft 365 Business Premium Enough
- Frequently Asked Questions About Microsoft 365 Business Premium
- The Verdict: Three Practices, Three Different Answers
- References
What Microsoft 365 Business Premium Actually Gives an Accountancy Firm
Microsoft 365 for accountancy practices, for law firms and for hotels is the same product wearing three different sets of client obligations, so it helps to start with the shipping manifest rather than the marketing. Microsoft 365 Business Premium is the top small-business subscription, listed at £16.90 per user per month on an annual commitment, or £24.60 per user per month for the version with Microsoft 365 Copilot Business included. Everything below is licensed for up to 300 users.
The productivity layer nobody argues about
Microsoft 365 Business Premium includes the desktop, web and mobile Office applications, custom-domain email, Microsoft Teams, SharePoint and 1 TB of cloud storage per user. For a practice this is table stakes: accounts production, tax software and practice management usually sit outside Microsoft 365 anyway, and what the licence really provides is the mailbox, the document library and the meeting platform where all the client conversation happens.
The security layer that makes it Business Premium rather than Business Standard
The £6.10 per user per month gap between Business Standard and Microsoft 365 Business Premium buys four named products, and they are the reason this article exists at all. Microsoft 365 Business Premium adds Microsoft Entra ID P1 for policy-based identity and access management, Microsoft Intune Plan 1 for device and application management, Microsoft Defender for Business for endpoint protection, and Microsoft Defender for Office 365 Plan 1 for email and collaboration protection. It also adds Azure Information Protection Plan 1, sensitivity labelling, and data loss prevention for email and files.
What that combination is worth in practice
Read as a security product rather than an office suite, Microsoft 365 Business Premium is a genuinely capable stack. Conditional Access can require multi-factor authentication for every sign-in and block legacy protocols outright. Intune can enforce disk encryption, patching and a device compliance baseline. Defender for Business gives endpoint detection and response with automated remediation. Defender for Office 365 Plan 1 adds Safe Links, Safe Attachments and impersonation protection, which is exactly the control set that a payment-redirection attempt runs into. For a fifteen-person practice with no on-premises server, Microsoft 365 Business Premium plus a competent configuration is a defensible position.
| Component in Microsoft 365 Business Premium | What it does for a practice | Where its ceiling sits |
|---|---|---|
| Microsoft Entra ID P1 | Conditional Access, MFA enforcement, self-service password reset | No risk-based policies, no Privileged Identity Management |
| Microsoft Intune Plan 1 | Device compliance, encryption, patch and app policy | No Endpoint Privilege Management or Cloud PKI |
| Microsoft Defender for Business | Antivirus, EDR, attack surface reduction on 5 devices per user | No advanced hunting, no six-month telemetry |
| Defender for Office 365 Plan 1 | Safe Links, Safe Attachments, impersonation protection | No Threat Explorer, no automated investigation |
| Purview Information Protection | Sensitivity labels applied manually by staff | No automatic or service-side labelling |
| Purview Data Loss Prevention | DLP for Exchange, SharePoint and OneDrive | No endpoint DLP, no DLP for Teams chat |
| Purview Audit (Standard) | Unified audit log for investigations | Shorter retention than Audit (Premium) |
| Exchange, SharePoint, Teams, 1 TB OneDrive | The working estate of a modern practice | No native backup, no Teams Phone |
The Short Answer: Where Microsoft 365 Business Premium Is Enough
Partners want the summary before the detail, so here it is. For a UK accountancy firm, Microsoft 365 Business Premium is enough to run a well-defended practice, and it is not enough on its own to run a well-evidenced one. Those are different problems, and only the second one gets you through a professional indemnity renewal, an ICO enquiry or a client’s supplier assurance questionnaire without improvisation.
Enough: stopping the attacks that actually target practices
The attacks that hit accountancy firms are overwhelmingly credential phishing, payment redirection and commodity malware on a laptop. Microsoft 365 Business Premium licenses a control for each of them. Phishing-resistant multi-factor authentication and Conditional Access shut down the first, Safe Links plus impersonation protection and a mandatory call-back process reduce the second, and Defender for Business handles the third. Nothing in the Microsoft 365 Business Premium licence stops a practice from implementing the twenty controls in our cyber security checklist for accountancy firms.
Not enough: proving what happened, six months later
Where Microsoft 365 Business Premium runs out is the evidence layer. If a client alleges that a member of staff exfiltrated their management accounts nine months ago, a practice on Microsoft 365 Business Premium alone will struggle to answer authoritatively. Audit (Premium), which provides up to one year of audit-log retention and high-value events such as mail-item access, is not part of the base licence. Insider risk management is not there. Endpoint DLP, which is what tells you a file went to a USB stick, is not there either.
Not enough: identity risk detection and privileged access
The second gap is identity. Microsoft Entra ID P1 in Microsoft 365 Business Premium gives you Conditional Access, but not Microsoft Entra ID Protection’s risk detections, not risk-based Conditional Access, and not Privileged Identity Management. For a practice where two or three people hold global administrator rights alongside their day jobs — which is nearly every practice — the inability to make those rights just-in-time and time-limited is a real weakness, and it is the one that auditors and insurers have started asking about.
Not enough: the growth cliff
The third gap is structural rather than technical. Microsoft 365 Business Premium, Microsoft Defender for Business and the new add-on suites are all capped at 300 seats. A practice that grows through a merger past that number does not get a warning; it gets a licensing conversation with a very different price on the other side of it.
| Practice requirement | Microsoft 365 Business Premium alone | What closes the gap |
|---|---|---|
| MFA on every account, no exceptions | Yes, via Conditional Access | Nothing needed |
| Block a leaked-credential sign-in automatically | No | Entra ID P2 via the Defender Suite |
| Time-limited global admin rights | No | Privileged Identity Management (Entra ID P2) |
| Phishing simulation for staff | No | Defender for Office 365 Plan 2 |
| Audit log older than the standard window | No | Audit (Premium) via the Purview Suite |
| Detect a leaver copying client files | No | Insider Risk Management and endpoint DLP |
| Restore a mailbox deleted 8 months ago | No | Backup, retention policy or litigation hold |
| Grow past 300 people | No | Microsoft 365 E3 or E5 |
Identity: What Microsoft 365 Business Premium Covers With Entra ID P1
Identity is where an accountancy practice is attacked, so it is where the Microsoft 365 Business Premium licence deserves the closest reading. The licence includes Microsoft Entra ID P1, which is a serious product and covers the majority of what a small firm needs.
What Entra ID P1 gives you inside Microsoft 365 Business Premium
Conditional Access is the headline. With Microsoft 365 Business Premium you can require multi-factor authentication for all users, require a compliant or hybrid-joined device for access to SharePoint, block sign-ins from outside the UK, block legacy authentication protocols, and require re-authentication for risky applications. You also get self-service password reset with on-premises writeback, group-based licensing, and Microsoft Entra Connect for practices still running a domain controller.
Why that matters for HMRC agent access in 2026
From Agent Update 141, published on 19 March 2026, HMRC requires multi-factor authentication for agents signing in on GOV.UK to both the agent services account and HMRC online services for agents. Accounts had to be enrolled in phases: requested by 30 June 2026 and switched on 15 July 2026, requested by 31 July 2026 and switched on 19 August 2026, with all remaining accounts moved between 28 September and 15 October 2026.
That is not a Microsoft control, but the practice hygiene it forces — every account named, at least two administrators per account because nobody can reset their own MFA, and a documented process for the authenticator seed key — is exactly the discipline Microsoft 365 Business Premium expects for its own tenant.
What Entra ID P2 adds, and why practices notice its absence
Microsoft Entra ID P2, listed separately at £7.70 per user per month, adds Microsoft Entra ID Protection, risk-based Conditional Access, Privileged Identity Management, access reviews and entitlement management. In plain terms: P1 lets you write the rule “everyone must use MFA”; P2 lets you write the rule “if this sign-in looks like it is using a credential that appeared in a breach dump, block it and force a password change”, and it lets a partner hold global administrator rights that only activate for four hours after an approval.
The practical identity ceiling
There is one more limit worth naming. Microsoft 365 Business Premium has no native way to prove, at audit time, who held privileged access on a given date. Access reviews and Privileged Identity Management both produce that record automatically, and both require Entra ID P2. Practices usually paper over this with a spreadsheet, which works right up until somebody asks who approved it.
| Identity capability | Entra ID P1 (in Business Premium) | Entra ID P2 (add-on) |
|---|---|---|
| Conditional Access policies | Yes | Yes |
| Self-service password reset with writeback | Yes | Yes |
| Sign-in and user risk detections | No | Yes |
| Risk-based Conditional Access | No | Yes |
| Privileged Identity Management | No | Yes |
| Access reviews and certification | No | Yes |
| Entitlement management | No | Yes |
Email: Microsoft 365 Business Premium Ships Defender for Office 365 Plan 1
Email is where the money is stolen. Every mandate-fraud case we have investigated in a practice started with a mailbox, so the exact plan of Microsoft Defender for Office 365 that Microsoft 365 Business Premium licenses is worth knowing precisely.
Plan 1 is what you have, and it is not thin
Microsoft’s own documentation is explicit that Defender for Office 365 Plan 1 is included in subscriptions aimed at small and medium businesses, naming Microsoft 365 E3 and Microsoft 365 Business Premium, while Plan 2 ships with the enterprise A5, E5 and G5 suites. Plan 1 gives a practice user and domain impersonation protection with the impersonation insight, mailbox intelligence, phishing thresholds, Safe Attachments in email and for files in SharePoint, OneDrive and Teams, Safe Links in email, Office clients and Teams, the email entity page, real-time detections and zero-hour auto purge for Teams.
What Plan 2 adds that a practice would actually use
Plan 2 adds attack simulation training, priority account protection, Threat Explorer instead of real-time detections, threat trackers, campaign views, advanced hunting on Teams messages and automated investigation and response. Two of those matter disproportionately to an accountancy firm. Attack simulation training is the only native way to run a phishing exercise against your own staff and produce the completion evidence that insurers ask for. Automated investigation and response is what soft-lands an incident at two in the morning in the middle of January, when nobody is watching the alerts.
The quick way to tell which plan a tenant is running
Microsoft documents a genuinely useful tell: in the Defender portal, if Email & collaboration shows Real-time detections, you are on Plan 1; if it shows Explorer, you are on Plan 2. That is a ten-second check that settles an argument about what a tenant on Microsoft 365 Business Premium is entitled to.
Where email protection is a licensing question and where it is a configuration one
It is worth being fair to the licence here. A large share of the email incidents in practices are not caused by a missing Plan 2 feature. They are caused by a Plan 1 feature that was never switched on: preset security policies left unconfigured, no DMARC record, quarantine notifications going to a shared mailbox nobody reads, or an inbox rule quietly forwarding to an external address. Microsoft 365 Business Premium ships the tools; the failures are usually ours.
| Email capability | Plan 1 (Business Premium) | Plan 2 (E5 or Defender Suite) |
|---|---|---|
| Safe Links and Safe Attachments | Yes | Yes |
| User and domain impersonation protection | Yes | Yes |
| Real-time detections | Yes | Replaced by Threat Explorer |
| Attack simulation training | No | Yes |
| Threat trackers and campaign views | No | Yes |
| Automated investigation and response | No | Yes |
| Priority account protection | No | Yes |
Devices: Microsoft 365 Business Premium Ships Defender for Business
Endpoints are the second front. Microsoft 365 Business Premium licenses Microsoft Defender for Business, which is a purpose-built small-business version of Defender for Endpoint, and Microsoft Intune Plan 1 to manage the devices it protects.
What Defender for Business covers
Defender for Business gives next-generation antivirus, attack surface reduction, endpoint detection and response, and automated investigation and remediation, with a simplified configuration experience aimed at firms without a security team. Microsoft’s licensing terms are specific: it is designed for organisations with up to 300 users, you can onboard and secure up to five client devices per user licence, and it protects Windows, macOS, Android and iOS.
Servers are a separate purchase, and practices forget
If a practice still runs a server — a legacy accounts production box, a file server, a Sage line — that server is not covered by the base licence. Microsoft Defender for Business servers is an add-on to Defender for Business and to Microsoft 365 Business Premium, priced at $3 per server instance, and above 60 servers you need a different licence entirely. This is the single most common licensing gap we find in practices: the laptops are protected and the one server holding twenty years of client files is not.
Where Defender for Business stops short of Defender for Endpoint Plan 2
Defender for Endpoint Plan 2 extends the same engine with core vulnerability management, advanced threat hunting and six months of data retention. Defender for Business has no advanced hunting, so if you want to ask “which of my devices ran this executable in April”, you cannot. It also supports only one web content filtering policy per organisation, and you cannot create custom attack surface reduction rules without using Intune.
The mixed-licensing trap that catches growing practices
This is the detail worth writing on a whiteboard. Microsoft states plainly that Defender for Business does not support mixed licensing: an organisation with Defender for Business from Microsoft 365 Business Premium and Defender for Endpoint Plan 2 for some users defaults to the Defender for Business experience for everyone.
Their worked example is 80 Business Premium users plus 30 on an E5 Security add-on — everybody still gets Defender for Business. To move to the Plan 2 experience you must license all users for Plan 2 and contact Microsoft Support to request the switch. Practices that intend to upgrade a few partners “as a pilot” should know this before they buy.
| Endpoint capability | Defender for Business | Defender for Endpoint Plan 2 |
|---|---|---|
| Next-generation antivirus and ASR | Yes | Yes |
| Endpoint detection and response | Yes | Yes |
| Automated investigation and remediation | Yes | Yes |
| Advanced hunting with KQL | No | Yes |
| Six months of telemetry retention | No | Yes |
| Multiple web content filtering policies | No | Yes |
| User cap | 300 | None |
Data: What Microsoft 365 Business Premium Does and Does Not Classify
Client confidentiality is the product an accountancy practice actually sells, so the data-protection layer of Microsoft 365 Business Premium deserves more attention than it usually gets during a licence renewal.
Sensitivity labels and encryption are included
Microsoft 365 Business Premium includes Azure Information Protection Plan 1 and Purview Information Protection sensitivity labelling. A practice can publish a label set — Public, Internal, Client Confidential, Restricted — apply encryption and watermarking to the top two, and have staff label documents and emails manually. Applied properly, a Client Confidential label survives the file being forwarded, which is the single most useful control in the whole Microsoft 365 Business Premium data stack.
Data loss prevention is included, but only for three workloads
Microsoft’s licensing guidance lists DLP for Exchange Online, SharePoint Online and OneDrive for Business as available to Microsoft 365 Business Premium alongside E3 and E5. So a practice can block or warn on an outbound email containing what looks like a National Insurance number or a bank account and sort code. That covers the classic accidental-disclosure route.
What is missing is the part that catches deliberate loss
Three DLP capabilities are not in Microsoft 365 Business Premium. Endpoint DLP — copying a client file to a USB stick or an unmanaged cloud sync folder — requires E5 or the Purview Suite. DLP for Teams chat and channel messages is the same. So is DLP for cloud apps in the browser and across the network. The pattern is consistent: Microsoft 365 Business Premium protects the accidental send, and the Purview Suite protects the deliberate copy.
Automatic labelling is the other missing half
Manual labelling depends on people, and people are busy in January. Automatic and service-side labelling, which can classify a document because it contains a UTR pattern or a payroll schedule without anyone touching it, sits above Microsoft 365 Business Premium. For a practice with twenty years of unclassified files in SharePoint, this is the difference between a labelling policy and a labelling project.
| Purview capability | Business Premium | With Purview Suite |
|---|---|---|
| Manual sensitivity labels and encryption | Yes | Yes |
| DLP for Exchange, SharePoint, OneDrive | Yes | Yes |
| Basic retention policies and labels | Yes | Yes |
| Endpoint DLP (USB, unmanaged sync) | No | Yes |
| DLP for Teams chat and channels | No | Yes |
| Insider Risk Management | No | Yes |
| Communication Compliance | No | Yes |
| Customer Key and Customer Lockbox | No | Yes |
| Advanced Message Encryption | No | Yes |
Retention and Audit: The Accountancy Test Microsoft 365 Business Premium Half-Passes
This is the section where a general answer about Microsoft 365 Business Premium stops being useful and an accountancy-specific one starts, because a practice does not get to choose how long it keeps things.
The retention obligations a UK practice is actually under
Regulation 40 of the Money Laundering Regulations 2017 requires customer due diligence and transaction records to be kept for five years. A practice acting as a Companies House authorised corporate service provider must keep identity-verification records for seven years and notify Companies House within 14 days of a relevant change. Add the practice’s own tax and correspondence retention, typically six years, and you have three different clocks running over the same mailboxes and document libraries.
What Microsoft 365 Business Premium can enforce
Basic Purview retention policies and retention labels are available to Microsoft 365 Business Premium, so a practice can apply a five-year or seven-year retention policy across Exchange, SharePoint, OneDrive and Teams, and it can publish retention labels for staff to apply to specific document sets. For the majority of small firms, this genuinely satisfies the requirement — provided somebody configures it, and provided nobody relies on staff to apply the labels by hand.
Where the audit trail falls short
Purview Audit (Standard) is included with Microsoft 365 Business Premium. Audit (Premium) is not: Microsoft’s service description lists it against E5, Office 365 E5 and — this is the important addition — the Microsoft Purview Suite for Business Premium add-on. Audit (Premium) provides up to one year of audit-log retention, custom retention policies, and crucial investigation events such as mail-item access, which is the event that tells you whether an intruder actually read a mailbox or merely had access to it.
Why an accountancy firm should care about that specific gap
Practice-level breaches are usually discovered late. A client notices a redirected payment, a bank flags an anomaly, or the National Crime Agency calls. The Information Commissioner’s Office fined DPP Law Ltd £60,000 in a case where an attacker brute-forced an infrequently used administrator account with no MFA, moved laterally and took 32 GB of data — and the firm only learned about it when the NCA reported client data on the dark web. By the time that call comes, the question is what your logs can prove, and the standard audit window in Microsoft 365 Business Premium may already have closed.
| Obligation or need | Period | Can Business Premium enforce it? |
|---|---|---|
| MLR 2017 reg 40 CDD records | 5 years | Yes, retention policy |
| ACSP identity verification records | 7 years | Yes, retention policy |
| Practice tax and correspondence | 6 years typical | Yes, retention policy |
| Records management and disposition review | Ongoing | No, needs Purview Suite |
| Audit log for a 9-month-old incident | Up to 1 year | No, needs Audit (Premium) |
| Mail-item-access forensic events | Per incident | No, needs Audit (Premium) |
| Point-in-time restore of a mailbox | Per incident | No, needs backup |
eDiscovery and Investigation When Microsoft 365 Business Premium Is All You Have
Sooner or later a practice has to search its own tenant under pressure — a subject access request, a partnership dispute, a professional indemnity claim, or a regulator’s enquiry.
What you can do on the base licence
Microsoft Purview eDiscovery (Standard) — content search, legal hold and exporting search results across email, sites and files — is broadly available and covers Microsoft 365 Business Premium. For most practice scenarios this is sufficient: place a hold on three mailboxes, search for a client name across the tenant, export the results, hand them to the solicitor.
What eDiscovery (Premium) adds
eDiscovery (Premium) adds custodian management, legal hold notifications, review sets, near-duplicate detection, threading and analytics. Microsoft’s service description lists it against E5 and against the Purview Suite, including the Purview Suite for Business Premium. A twelve-person practice will probably never need it. A forty-person practice in the middle of a contested partner exit will feel its absence within a week.
The investigation gap is wider than the eDiscovery gap
Be clear about which gap you are actually trying to close. Searching for documents is well covered on Microsoft 365 Business Premium. Reconstructing an attack is not: without advanced hunting on the endpoint, Threat Explorer on email, Audit (Premium) on the tenant and Insider Risk Management on user behaviour, a practice on Microsoft 365 Business Premium alone is dependent on whatever its incident-response firm can recover from a device image.
The pragmatic middle position
Most firms should not buy an investigation capability they cannot operate. The realistic middle position for a practice on Microsoft 365 Business Premium is to buy the retention and audit depth — so the evidence exists — and to retain an incident-response provider on a call-off basis to do the analysis. Evidence you never analyse is still evidence; analysis you cannot perform on evidence that was never kept is nothing at all.
The 300-Seat Ceiling in Microsoft 365 Business Premium
The seat cap is the most under-discussed constraint in the whole licence, and for a growing or merging practice it is the one that arrives fastest.
Every layer of the stack stops at 300
Microsoft 365 Business Premium is licensed for up to 300 users. Defender for Business is designed for organisations with a maximum of 300 users. Both the Microsoft Defender Suite and the Microsoft Purview Suite for Business Premium state a maximum of 300 seats and require a Microsoft 365 Business Premium base licence. There is no partial extension: the ceiling is the same at every layer.
What Microsoft says to do when you outgrow it
Microsoft’s guidance is direct. A firm that has grown from 250 to 330 people and now holds 300 Defender for Business licences plus 30 Microsoft 365 E3 licences is told to move, at renewal, to an enterprise plan for everyone: Microsoft 365 E5, Microsoft 365 E3, or standalone Defender for Endpoint Plan 1 or 2. Combined with the no-mixed-licensing rule, this means a merger does not just add seats — it changes your security platform.
The number that matters is headcount plus identities
Practices routinely miscount this. The cap applies to licensed users, and firms forget that shared mailboxes and resource accounts are free but that contractors, subcontracted bookkeepers and part-time seasonal staff in January are not. A 260-person firm that takes on 25 seasonal tax preparers and merges with a 30-person practice is over the ceiling in the same quarter.
Plan the crossing before you need it
If a practice is above roughly 200 people, the licensing conversation should be scheduled, not triggered. Model both paths — staying on Microsoft 365 Business Premium with add-on suites while you can, versus moving the whole firm to E3 or E5 — and put a review date in the partnership calendar. Every practice we have seen do this badly did it in the eight weeks after a merger completed, which is the worst possible time.
What Microsoft 365 Business Premium Never Includes
Some things are not a gap in the security tier at all — they are simply outside the subscription, and a practice that assumes otherwise discovers it at the worst moment.
Backup is not included, and Microsoft does not pretend it is
Microsoft 365 Business Premium includes retention, versioning and recycle bins. It does not include backup. Microsoft 365 Backup exists as a separate, pay-as-you-go service billed through an Azure subscription, covering Exchange, SharePoint and OneDrive. Retention protects you from deletion; backup protects you from a bad restore point, a ransomware event that encrypts synced files, and a departing employee who cleaned up thoroughly. A practice under MLR and ACSP record-keeping duties should treat this as a requirement rather than an option.
Telephony, analytics and virtual desktops are add-ons
Teams Phone, audio conferencing and Windows 365 are all listed as add-ons to Microsoft 365 Business Premium rather than inclusions. Power BI Pro is not included either. None of these are security issues, but they are the four line items that most often turn a quoted per-user price into a different real one.
On-premises servers need their own licences
The one surviving server in the back office needs a Windows Server licence, a Defender for Business servers add-on at $3 per server instance if you want it monitored in the same portal, and its own backup. Microsoft 365 Business Premium covers user devices, not infrastructure.
Security operations is a service, not a licence
The largest omission is not a product at all. Nothing in Microsoft 365 Business Premium watches the alerts at 3am on a Sunday. Defender for Business will raise and often auto-remediate an incident, but somebody has to triage what it cannot. A practice either buys that as a managed service or accepts that alerts are reviewed when the office opens — an entirely defensible decision, provided it is a decision and not an assumption. Our guide to IT support for accountancy firms covers what that service layer looks like around a Microsoft 365 Business Premium tenant.
The Defender and Purview Suites: Microsoft 365 Business Premium Grew Up in October 2025
This is the development that changes the answer to the question in the title, and many practices have not heard about it yet.
What Microsoft launched
On 1 October 2025 Microsoft renamed its enterprise mini-suites — Microsoft 365 E5 Security became the Microsoft Defender Suite and Microsoft 365 E5 Compliance became the Microsoft Purview Suite — and, crucially, released versions of both that sit on top of a Microsoft 365 Business Premium base licence for organisations of 1 to 300 seats. Microsoft’s own Purview service description now carries the footnote that these add-ons “require a Microsoft 365 Business Premium base license and are capped at 300 seats total”.
What the Microsoft Defender Suite adds
The Microsoft Defender Suite for Microsoft 365 Business Premium is £7.70 per user per month on an annual commitment and adds Microsoft Entra ID P2, Microsoft Defender XDR, Microsoft Defender for Endpoint Plan 2, Microsoft Defender for Office 365 Plan 2, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps and Microsoft Defender for IoT enterprise IoT security. In one line item, that closes the identity-risk gap, the attack-simulation gap, the advanced-hunting gap and the shadow-IT gap.
What the Microsoft Purview Suite adds
The Microsoft Purview Suite for Microsoft 365 Business Premium is also £7.70 per user per month and adds Purview Information Protection with automatic labelling, the full DLP surface including endpoint DLP, Insider Risk Management, Audit (Premium), eDiscovery (Premium), Data Lifecycle Management, Compliance Manager, Communication Compliance, message encryption, Customer Lockbox, Customer Key, information barriers and privileged access management.
The combined suite is the number to remember
Bought together as Microsoft Defender and Purview Suites for Microsoft 365 Business Premium, the price is £11.50 per user per month, again with the 300-seat maximum and the Business Premium prerequisite. So the real question for most practices is no longer “is Microsoft 365 Business Premium enough” but “is Microsoft 365 Business Premium at £16.90, or Microsoft 365 Business Premium plus £11.50, the right number for this firm”.
| Add-on for Business Premium | UK price per user per month | Headline additions |
|---|---|---|
| Microsoft Defender Suite | £7.70 | Entra ID P2, Defender XDR, Endpoint P2, Office 365 P2, Identity, Cloud Apps |
| Microsoft Purview Suite | £7.70 | Audit Premium, eDiscovery Premium, Insider Risk, endpoint DLP, auto-labelling |
| Both suites together | £11.50 | Everything above in one line item |
| Microsoft 365 Copilot Business | £7.70 uplift | Takes Business Premium from £16.90 to £24.60 |
| Defender for Business servers | $3 per server | Brings a server into the same portal |
The catch worth naming
Two constraints travel with the suites. First, the 300-seat cap does not move, so the suites extend the capability of Microsoft 365 Business Premium but not its lifespan as a firm grows. Second, the no-mixed-licensing rule for endpoints still applies: buying the Defender Suite for six partners does not give those six a Defender for Endpoint Plan 2 experience while everyone else stays on Defender for Business. Plan the suites as a whole-firm purchase or accept that the endpoint tier stays where it is.
Microsoft 365 Business Premium Versus E3, E5 and the New E7
Now the money. Every price below is the UK list price per user per month on an annual commitment, excluding VAT, taken from Microsoft’s UK storefront.
The ladder
Microsoft 365 Business Basic is £5.40. Microsoft 365 Apps for business is £9.80. Microsoft 365 Business Standard is £10.80 on its own, or £18.10 with Copilot included. Microsoft 365 Business Premium is £16.90, or £24.60 with Copilot. Microsoft 365 E3 is £33.50, Microsoft 365 E5 is £51.60, and the new Microsoft 365 E7 is £81.60.
Where Microsoft 365 Business Premium plus both suites lands
Microsoft 365 Business Premium at £16.90 plus the combined suites at £11.50 is £28.40 per user per month. That is £5.10 less than Microsoft 365 E3 and £23.20 less than Microsoft 365 E5, and it delivers a security and compliance surface far closer to E5 than to E3. For a practice under 300 people this is, on price alone, the most efficient point on the entire ladder.
What E3 actually buys a practice, and why it usually is not the answer
Microsoft 365 E3 lifts the seat cap, adds Windows Enterprise rights and enterprise Exchange features, and includes Defender for Endpoint Plan 1 — but it does not include Defender for Office 365 Plan 2, Entra ID P2, Audit (Premium), Insider Risk Management or endpoint DLP. A practice that moves from Microsoft 365 Business Premium to E3 for security reasons will usually find it has paid £16.60 more per user per month for a worse security position, because Defender for Office 365 Plan 1 is common to both while the small-business bundle also carried Intune and Defender for Business.
E5 and the new E7
Microsoft 365 E5 is the complete stack and the right answer above 300 seats. Microsoft 365 E7, announced on 9 March 2026 and generally available from 1 May 2026 at $99 per user per month in the US, bundles E5 with Microsoft 365 Copilot, the Entra Suite and Agent 365 — Microsoft’s governance plane for AI agents. It is the first new enterprise tier since E5 launched in 2015, and no UK accountancy practice under 300 people needs it in 2026. It matters here only as a marker of where the platform is heading: agent governance is becoming a licensed product.
| Capability | Business Premium | Premium + suites | E3 | E5 |
|---|---|---|---|---|
| UK price per user per month | £16.90 | £28.40 | £33.50 | £51.60 |
| Seat cap | 300 | 300 | None | None |
| Intune device management | Plan 1 | Plan 1 | Plan 1 | Plan 1 |
| Endpoint protection | Defender for Business | Endpoint P2 | Endpoint P1 | Endpoint P2 |
| Email protection | Office 365 P1 | Office 365 P2 | Office 365 P1 | Office 365 P2 |
| Identity tier | Entra ID P1 | Entra ID P2 | Entra ID P1 | Entra ID P2 |
| Audit (Premium) | No | Yes | No | Yes |
| Insider Risk and endpoint DLP | No | Yes | No | Yes |
| Windows Enterprise rights | No | No | Yes | Yes |
Copilot Changes the Microsoft 365 Business Premium Answer
If a practice is buying Microsoft 365 Copilot, the licensing question changes shape, because Copilot’s value depends entirely on the permission and classification state of the data underneath it.
The price mechanics
Microsoft now sells Microsoft 365 Business Premium in a bundle that includes Microsoft 365 Copilot Business at £24.60 per user per month, against £16.90 for the plain licence — an uplift of £7.70 per user per month, the same figure as either security suite. For a firm licensing Copilot for a subset of staff, that is the number to model, and our analysis of Microsoft 365 Copilot cost versus return works through the payback arithmetic.
The governance detail that catches practices out
Here is the one to read twice. Microsoft’s Purview licensing table for DLP for Microsoft 365 Copilot — the control that stops Copilot processing files and emails a user should not be summarising — lists Microsoft 365 Business Basic, Standard and Premium as No. That capability sits with E5, the Purview Suite and the Defender + Purview Suite. So a practice can license Copilot on Microsoft 365 Business Premium and have no licensed way to stop it reasoning over the partnership’s payroll folder if permissions are loose.
Oversharing is the real risk, not hallucination
Copilot does not break permissions; it surfaces the consequences of the permissions you already had. In a practice, the classic finding is a SharePoint site created for a single audit that was shared with “everyone in the organisation” three years ago. On plain Microsoft 365 Business Premium, the mitigation is manual: audit sharing links, fix site permissions, publish sensitivity labels and train people. With the Purview Suite, automatic labelling and endpoint DLP do the heavy lifting.
The sequencing recommendation
Order matters. Fix permissions, publish labels and turn on retention before the Copilot licences land, not after. If a practice is going to spend an extra £7.70 per user per month on anything alongside Microsoft 365 Business Premium in the same year it adopts Copilot, the Purview Suite is a stronger first purchase than the Defender Suite — the exposure Copilot creates is a data-governance exposure.
Does Microsoft 365 Business Premium Satisfy HMRC, Companies House and Cyber Essentials?
A licence does not comply with anything by itself, but it either can or cannot support the controls a UK practice is being asked to demonstrate. On that test, Microsoft 365 Business Premium does well.
Cyber Essentials
Cyber Essentials is the certification most clients and insurers ask for, and the current question set — the Danzell question set, live from 26 April 2026, with existing certificates on the previous version accepted until 26 October 2026 — makes multi-factor authentication on cloud services an automatic failure if missing, and requires security updates to be applied within 14 days.
Microsoft 365 Business Premium can satisfy both: Conditional Access enforces the MFA requirement across the tenant and Intune Plan 1 enforces and reports the update window. Nothing in the Danzell question set requires a capability that sits above Microsoft 365 Business Premium. Our Cyber Essentials guide for accountancy firms works through the whole question set.
HMRC agent access
HMRC’s multi-factor authentication requirement for agent services accounts and HMRC online services for agents is outside the Microsoft tenant, so no licence covers it. What Microsoft 365 Business Premium contributes is the surrounding discipline: named accounts rather than shared logins, a secured mailbox for the account recovery address, and Conditional Access on the devices those sign-ins happen from. Practices with a single shared agent login should fix that before worrying about licence tiers.
Companies House and the ECCTA regime
Identity verification became a legal requirement at Companies House on 18 November 2025, with the transition for existing directors, people with significant control and LLP members closing on 18 November 2026. An authorised corporate service provider must keep identity records for seven years and notify Companies House within 14 days of a relevant change, including loss of AML supervision. Retention policies in Microsoft 365 Business Premium can hold those records for seven years; what the base licence cannot do is prove, a year later, exactly who opened them.
UK GDPR and the ICO’s expectations
The Information Commissioner’s Office issued 28 monetary penalty notices in 2025, its highest annual total under UK GDPR, with the average penalty rising from around £150,000 to over £2.8m, including a £14m fine against Capita on 15 October 2025. The DPP Law case is the more instructive one for a practice of this size, because the failure was mundane: an unused administrator account without MFA. That is a Microsoft 365 Business Premium control, available on the base licence, not configured.
The honest verdict on compliance
Microsoft 365 Business Premium passes the certification tests and supports the retention duties. Where it comes up short is the evidential layer that turns compliance into demonstrable compliance — the audit depth, the access reviews, the insider-risk signal. That is a considered risk decision for a partnership to take, not a technical fault in the licence.
| Requirement | Source | Business Premium verdict |
|---|---|---|
| MFA on all cloud services | Cyber Essentials Danzell | Passes on the base licence |
| Security updates within 14 days | Cyber Essentials Danzell | Passes with Intune Plan 1 |
| Malware protection on all devices | Cyber Essentials Danzell | Passes with Defender for Business |
| CDD records kept 5 years | MLR 2017 reg 40 | Passes with retention policies |
| Identity records kept 7 years | Companies House ACSP rules | Passes with retention policies |
| Appropriate technical measures | UK GDPR Article 32 | Passes if actually configured |
| Evidence of who accessed what, a year on | ICO investigations, PI insurers | Falls short without Audit (Premium) |
| Periodic review of privileged access | Practice assurance, client audits | Falls short without Entra ID P2 |
A Worked Example: Microsoft 365 Business Premium in a 28-Person Practice
Abstract licensing arguments are easy to win and useless to act on, so here is the arithmetic for a real shape of firm: a two-office general practice with 28 people.
The estate
The practice has 5 partners, 14 qualified and part-qualified accountants, 3 tax specialists and 6 administrative staff, which is 28 named staff. Alongside those it runs 7 shared mailboxes — info, payroll, tax, accounts, audit, careers and practice — and 3 dedicated administrator accounts, so the tenant holds 38 identities, of which 10 are shared or privileged. Shared and resource mailboxes do not consume a licence, so the licence count is 28.
Option one: Microsoft 365 Business Premium alone
28 × £16.90 = £473.20 per month, which is £5,678.40 per year, or £202.80 per person per year. For that the practice gets Conditional Access, Intune, Defender for Business, Defender for Office 365 Plan 1, sensitivity labels, DLP on mail and files, and retention policies long enough to satisfy the five-year and seven-year duties.
Option two: Microsoft 365 Business Premium plus both suites
Add the combined suites at 28 × £11.50 = £322 per month, which is £3,864 per year. The total becomes £795.20 per month, which is £9,542.40 per year, or £340.80 per person per year. The increment over option one is £138 per person per year, and it buys Entra ID P2, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Audit (Premium), eDiscovery (Premium), Insider Risk Management and endpoint DLP.
Options three and four: the enterprise counterfactuals
Microsoft 365 E3 for the same 28 people is 28 × £33.50 = £938 per month, or £11,256 per year — £1,713.60 more per year than option two, for a weaker security position. Microsoft 365 E5 is 28 × £51.60 = £1,444.80 per month, or £17,337.60 per year. Option two therefore saves £7,795.20 per year against E5 while delivering most of the same security and compliance capability.
Putting the increment in proportion
The £3,864 per year that the suites cost is £322 per month, or about £15.33 per working day across a 21-day month. Set against the £60,000 penalty the ICO issued to DPP Law, the suites would have to run for more than 15 years to cost what that single failure cost — and the failure in question was an administrator account without MFA, which the base Microsoft 365 Business Premium licence could already have prevented.
If the practice also wants Copilot
Licensing Microsoft 365 Copilot for the 5 partners, the 3 tax specialists and one practice manager — 9 seats — at the £7.70 uplift is £69.30 per month, which is £831.60 per year. That is affordable next to the security spend, but the sequencing point stands: the Purview Suite should land before the Copilot licences, not after.
| Option for the 28-person practice | Per month | Per year | Per person per year |
|---|---|---|---|
| Business Premium alone | £473.20 | £5,678.40 | £202.80 |
| Plus Defender Suite only | £688.80 | £8,265.60 | £295.20 |
| Plus both suites | £795.20 | £9,542.40 | £340.80 |
| Microsoft 365 E3 | £938.00 | £11,256.00 | £402.00 |
| Microsoft 365 E5 | £1,444.80 | £17,337.60 | £619.20 |
Ten Ways Firms Make Microsoft 365 Business Premium Look Inadequate
In most practices we assess, the licence is not the limiting factor. Configuration is. These are the ten findings that recur, all of which are fixable inside a Microsoft 365 Business Premium subscription.
Identity and access mistakes
One. Global administrator rights held permanently by two or three partners as a convenience, with no separate admin accounts. Two. Conditional Access left in report-only mode after a pilot, so no policy is actually enforced. Three. Legacy authentication never blocked, which quietly defeats MFA for anything still speaking IMAP or POP. Four. Break-glass accounts either missing entirely or excluded from every policy and never monitored.
Email and data mistakes
Five. Preset security policies never applied, leaving Safe Links and Safe Attachments off despite being licensed. Six. No DMARC record, so impersonation protection is doing more work than it should. Seven. External forwarding permitted tenant-wide, which is the mechanism half of all mandate frauds rely on — a topic covered in depth in our guide to invoice fraud and business email compromise in accountancy firms.
Device and evidence mistakes
Eight. Devices enrolled in Intune but with no compliance policy, so the tenant reports green while enforcing nothing. Nine. The one on-premises server never onboarded to Defender for Business because the servers add-on was never bought. Ten. No retention policy at all, meaning the practice’s MLR and ACSP obligations depend on nobody deleting anything.
| Finding | Licensed in Business Premium? | Effort to fix |
|---|---|---|
| Permanent global admin rights | Separate admin accounts: yes | Half a day |
| Conditional Access in report-only | Yes | Half a day plus a pilot week |
| Legacy authentication allowed | Yes | One hour plus testing |
| Preset security policies not applied | Yes | One hour |
| External forwarding allowed | Yes | One hour |
| No Intune compliance policy | Yes | One to two days |
| Server not onboarded | Needs servers add-on | Half a day plus licence |
| No retention policy | Yes | One day with partner sign-off |
A 90-Day Plan to Make Microsoft 365 Business Premium Enough
If the conclusion is “keep Microsoft 365 Business Premium and configure it properly, then buy one suite”, here is the sequence that works in a practice without disrupting a filing season.
Days 1 to 30: use what you already pay for
Enforce MFA for every account through Conditional Access, block legacy authentication, create separate administrator accounts with break-glass exclusions documented, apply the Standard preset security policies in Defender for Office 365, publish an SPF, DKIM and DMARC record set, block tenant-wide external forwarding, and enrol every device in Intune with a real compliance policy. That is 12 controls, all licensed, none requiring a purchase.
Days 31 to 60: classification and retention
Publish a four-label sensitivity scheme, apply encryption to the top two labels, switch on DLP policies for UK financial and identity data across mail, SharePoint and OneDrive, write the retention policy set that matches the five-year, six-year and seven-year duties, and onboard any surviving server with the Defender for Business servers add-on. That takes the cumulative total to 22 controls.
Days 61 to 90: decide the suite question with evidence
Now the practice has a working baseline and can answer the licensing question properly. Review the audit window against a realistic worst-case discovery delay, list the privileged accounts and how their access is currently reviewed, and price the combined suites for the whole firm. Then buy — or record the decision not to buy, with the risk accepted in the partnership minutes, which is itself a governance artefact. With the suite decision made and the final controls in place, the practice ends the quarter at 30 controls.
Who owns each phase
Give phase one to whoever administers the tenant, phase two to a partner jointly with the person responsible for AML compliance — because retention periods are a professional judgement, not an IT setting — and phase three to the partnership as a whole, because it is a spending decision. A plan with no named owner per phase is the reason most Microsoft 365 Business Premium hardening projects stall at day 34.
Frequently Asked Questions About Microsoft 365 Business Premium
Is Microsoft 365 Business Premium enough for a small accountancy practice?
For a practice under about 30 people with no on-premises server, yes — provided it is configured properly and backed up. Microsoft 365 Business Premium licenses every control needed to pass Cyber Essentials and to satisfy MLR and ACSP retention duties. The gaps are evidential rather than preventive.
When should a practice add the Defender or Purview Suites?
Add the Purview Suite when the practice starts holding regulated identity evidence at scale, adopts Copilot, or is asked by a client for insider-risk or audit assurances. Add the Defender Suite when privileged access review, phishing simulation or automated investigation become a partnership priority. At £11.50 per user per month together, buying both is usually simpler than arguing about which.
Is Microsoft 365 E3 an upgrade from Microsoft 365 Business Premium?
Not for security. E3 lifts the 300-seat cap and adds Windows Enterprise rights, but drops to Defender for Endpoint Plan 1 and keeps Defender for Office 365 Plan 1 without adding Entra ID P2, Audit (Premium) or endpoint DLP. Treat E3 as a scale upgrade, not a security one.
Does Microsoft 365 Business Premium include backup?
No. It includes retention, versioning and recycle bins. Microsoft 365 Backup is a separate pay-as-you-go service billed through Azure, and a third-party backup product is the more common choice in practices.
What happens to a practice that passes 300 users?
Microsoft 365 Business Premium, Defender for Business and both add-on suites all stop at 300 seats. Microsoft’s own guidance is to move the whole organisation to an enterprise plan at renewal rather than run a mix, because a mixed endpoint estate defaults everyone to the Defender for Business experience.
Can a practice buy the suites for only some staff?
Commercially yes, but the endpoint experience is tenant-wide, so a partial purchase does not give the licensed users a Defender for Endpoint Plan 2 experience. Identity and compliance features are per-user and do work when licensed selectively.
Does Copilot work on Microsoft 365 Business Premium?
Yes. Microsoft sells Microsoft 365 Business Premium with Copilot Business at £24.60 per user per month against £16.90 without. The caveat is that DLP for Microsoft 365 Copilot is not licensed at the Business Premium tier, so data governance has to be handled by permissions, labels and training, or by adding the Purview Suite.
How long does it take to configure Microsoft 365 Business Premium properly?
For a practice of 20 to 40 people, the 90-day plan above is realistic at a few days of effort per phase. The long poles are the retention decision, which needs partner input, and the device compliance rollout, which needs a pilot group.
The Verdict: Three Practices, Three Different Answers
“Is Microsoft 365 Business Premium enough” has no single answer, because the honest one depends on what a practice holds, how many people it employs and what it has promised its clients.
The 12-person practice with no server
Microsoft 365 Business Premium is enough. Configure it properly, add a backup product, buy Cyber Essentials, and put the money you did not spend on suites into training and a call-off incident-response arrangement. The realistic threat to this firm is a phished mailbox, and Microsoft 365 Business Premium licenses everything needed to stop that.
The 40-person practice acting as an authorised agent
Microsoft 365 Business Premium is the right base, and the Purview Suite is the right first addition. This firm holds verified identity evidence under seven-year retention, files for clients at Companies House and HMRC, and will one day have to explain who accessed something. It needs Audit (Premium), and it will use eDiscovery (Premium) at least once. At £28.40 per user per month with both suites, it is still well under Microsoft 365 E3.
The 200-person firm heading for a merger
Microsoft 365 Business Premium is enough today and will not be in two years. Buy the suites now if the security gap is real, but model the enterprise move at the same time, because the 300-seat ceiling and the no-mixed-licensing rule together mean the transition is a project rather than a purchase. Book the licensing review before the merger paperwork, not after.
The question behind the question
When partners ask whether Microsoft 365 Business Premium is enough, they usually mean “have we bought the right thing, and are we exposed?” In our experience the honest answer at least half the time is that the licence was never the problem: the practice owns capability it has not switched on. Audit the configuration first. Then, and only then, does the suite decision become a real decision rather than a guess.
References
Microsoft 365 Business Premium (UK)
Microsoft: Compare all Microsoft 365 business plans
Microsoft Defender Suite for Microsoft 365 Business Premium
Microsoft Purview Suite for Microsoft 365 Business Premium
Microsoft 365 enterprise plans and pricing
Microsoft Entra plans and pricing
Microsoft Purview service description
Microsoft 365 guidance for security and compliance licensing
Microsoft: Why do I need Defender for Office 365?
Microsoft Defender for Business frequently asked questions
Microsoft Defender for Business overview
Microsoft Defender for Endpoint documentation
Microsoft Purview Audit (Premium)
Microsoft Purview auditing solutions overview
Microsoft Purview retention policies and labels
Microsoft Purview Data Loss Prevention
Microsoft Purview Endpoint DLP
Microsoft Purview Insider Risk Management
Microsoft Purview sensitivity labels
Microsoft Entra Conditional Access overview
Microsoft Entra Privileged Identity Management
Microsoft: Mandatory multifactor authentication for Microsoft Entra
Microsoft: Product names and service plan identifiers for licensing
Microsoft Intune documentation
Microsoft: Get started with attack simulation training
Microsoft 365 Backup consumption and invoices
Microsoft 365 Copilot data, privacy and security
Cyber Security Breaches Survey 2025/2026
NCSC: Cyber Essentials overview
NCSC: Small organisations guide to cyber security
NCSC: Cyber Action Toolkit for small businesses
ICO: Report a personal data breach
Money Laundering Regulations 2017, regulation 40
GOV.UK: Money laundering regulations, your responsibilities
Companies House: Changes to accounts filing
ATT: Multi-factor authentication, how can agents prepare?
ICAEW: Cyber security resources
