A lot of small offices are on whichever Microsoft 365 plan was in the cart the day someone set up email, and nobody has looked at it since. Choosing properly comes down to two things for each person on the team. Do they need Word and Excel installed on a computer? And do you need a say over the laptop or phone they open work files on?

What every business plan includes

Business Basic, Standard and Premium all give each person a mailbox on your own domain, OneDrive file storage, SharePoint for shared files and Teams for chat and calls. Microsoft's plan comparison for Australia lists 100 GB of primary mailbox storage and 1 TB of cloud storage per user on all three, so moving up a plan won't get anyone more room for email.

Business Basic

Word, Excel, PowerPoint and Outlook come as phone apps and run in a web browser. You can't install the desktop versions on Basic.

That covers a plumber who reads job emails between calls and opens the shared quote folder on their phone. Most people on the tools never need more.

Business Standard

Standard adds the desktop Office apps, and each person can install them on their own computers. Anyone who builds quotes in Excel, writes tenders in Word or keeps desktop Outlook open all day needs Standard or Premium.

The browser versions are fine for fixing a typo in a letter. Large spreadsheets, macros and heavy formatting are where they fall over, and some add-ins only run on the desktop version.

Business Premium: Intune and Defender

Premium is Standard with security and device management added. Microsoft's Business Premium page lists Intune for managing devices and apps, Defender for Business for protecting laptops and desktops, and Defender for Office 365 for phishing protection on email.

Intune sets rules for any laptop or phone that opens business data, such as a screen lock and an encrypted drive. If a phone goes missing or someone leaves, you can remove the business data from it.

Defender for Business takes the place of basic antivirus on each computer. It watches for ransomware and other attacks, and flags machines that have fallen behind on updates.

Sign-in rules come through Entra ID. The comparison page calls Premium's identity features "policy-based" access, which in practice means rules like blocking sign-ins from overseas or from computers you don't manage.

Look hard at Premium once staff take laptops home or to site, or open client files and work email on their own phones. The same goes if you hold records you'd have to report after a leak, such as health details or payment information, or if an insurer, head contractor or government client has asked what security you run. A team that works from two office computers, with none of that going on, will be fine on Standard.

Multi-factor authentication works on every plan

Multi-factor authentication asks for a code or a phone approval on top of the password. The Australian Cyber Security Centre calls it one of the most important cyber security measures an organisation can implement, and its setup example works on any Microsoft 365 business plan.

On Basic and Standard you turn it on with Microsoft's security defaults, a single switch with few options. Premium lets you write your own rules, so admin accounts get asked every time and everyone else only when a sign-in looks unusual.

Mixing plans across the team

Licences are per person, so one business can run all three plans under the same domain. The office manager might be on Premium, the estimator on Standard and the apprentices on Basic.

Microsoft caps the business plans at 300 users combined. Its plan FAQ gives the example of a business with 250 Premium licences, which can add only 50 more across all the business plans. Past 300 you're into the enterprise plans.

Intune and Defender only cover people and devices licensed for Premium. If the owner's laptop is managed and the bookkeeper's isn't, client files on the bookkeeper's laptop sit outside the rules.

Questions to answer before you buy

Go through the team one person at a time.

  • Who needs the desktop Office apps, and who gets by with a browser and a phone?
  • Which devices open business email and files, and who owns each one?
  • Does anyone share a login like info@? Turn it into a shared mailbox, which doesn't need its own licence.
  • Who holds the admin login, and is it in the business's name?
  • Has a client, insurer or contract asked for device management or particular security controls?

Our Microsoft 365 setup starts from that same list. We confirm who owns the domain and the Microsoft account, then put each person on a plan.