9 Ways to Harden Microsoft 365 Business Premium, With the Settings

Every item uses something already in the license except item 8, which is pay-as-you-go through Azure. Microsoft's own setup guidance (Microsoft Learn, September 2025) covers the same ground; this is that guidance with the settings filled in.

A new tenant starts with security defaults on: every user must register for MFA, administrators are challenged on every sign-in, users are challenged when Microsoft judges it necessary, and legacy authentication and device code flow are blocked (Microsoft Learn, July 2025). That floor cannot be tuned, and it cannot coexist with Conditional Access: policies can exist but not be turned on while security defaults are enabled.

Business Premium includes Entra ID P1, so recreate the floor as four policies you control, each in report-only mode for a week first: require MFA for all users and all resources, excluding only the emergency accounts; block legacy authentication and device code flow; require the phishing-resistant MFA authentication strength (passkeys, FIDO2 keys or Windows Hello for Business) for the administrator roles Microsoft lists (Microsoft Learn, March 2026); and require a compliant device for the Microsoft admin portals once item 5 has produced compliant devices.

Microsoft now creates managed Conditional Access policies in eligible tenants in report-only mode and turns them on no less than 30 days later unless you act (Microsoft Learn, May 2026). Conditional Access policies every business should have has the full design, and the Conditional Access implementation service is $2,950 per project.

Microsoft's guidance for Microsoft 365 for business (Microsoft Learn, January 2026) and for Entra ID (June 2026) agree on the shape: at least two emergency access accounts, cloud-only on the .onmicrosoft.com domain, not tied to any person, excluded from the Conditional Access policies that block sign-in, with a phishing-resistant method registered (a passkey or certificate, which also satisfies Microsoft's mandatory MFA for the Azure portal), credentials in a safe, an alert on every sign-in and a test each quarter.

Then the daily discipline: administrators use an ordinary, licensed account for mail and documents and a separate unlicensed admin account for admin work, named so it does not advertise the role; Global Administrators are kept to the minimum; everyone else gets the narrowest role that does the job.

Baseline security mode is a page in the Microsoft 365 admin center (Settings > Org settings > Security and Privacy) that exposes settings that used to require PowerShell, each with an impact report (Microsoft Learn, April 2026), on every subscription. Run the impact report for each setting, turn on the ones that show zero impact, and schedule the rest:

• Protect admin access to Microsoft admin portals with phishing-resistant authentication (it appears as a Conditional Access policy created by you).
• Block legacy authentication flows and basic authentication prompts in the Office apps.
• Block new password credentials on app registrations, and restrict end-user consent to Microsoft 365 certified and single-tenant apps with low-risk permissions.
• Block ActiveX controls and insecure protocols (HTTP, FTP) for file opens.
• Block legacy browser and client authentication to SharePoint and OneDrive; disallow new custom scripts; disable the SharePoint Store for end users.
• Disable organization-wide Exchange Web Services, after confirming the Office build is 16.0.19725 or later and that Power Query, cross-tenant calendar sharing and certificate-based ActiveSync are not in use, because those break.

Microsoft's deployment order for mail (Microsoft Learn, August 2025) is SPF, then DKIM for every custom domain including parked domains, then DMARC; our setup guide walks the DNS records and the move from p=none to reject.

Then turn on the Standard preset security policy for all recipients in the Defender portal. Business Premium includes Defender for Office 365 Plan 1, so the preset brings impersonation protection and phishing thresholds, Safe Links in mail, Office apps and Teams, and Safe Attachments for mail and for files in SharePoint, OneDrive and Teams. Use Strict for finance and leadership, tag those users as priority accounts, and keep the built-in Report button in Outlook with reports routed to Microsoft and to a reporting mailbox. The Defender for Office 365 implementation service is $2,900 per project.

Business Premium includes Intune Plan 1 (device and app management for Windows, macOS, iOS and Android) and Microsoft Defender for Business, which Microsoft describes as Defender for Endpoint Plan 1 with some Plan 2 features, including endpoint detection and response (Microsoft Learn, September 2025). The sequence:

1. Enroll company Windows devices through Microsoft Entra join and Windows Autopilot; enroll macOS; put personal phones under app protection policies instead of full enrollment (the BYOD pattern).
2. Create one compliance policy per platform: BitLocker or FileVault on, Defender Antivirus on and current, a supported OS version, a device password. Conditional Access policy 4 then requires it.
3. Review the Defender for Business defaults under Endpoints > Configuration management: the next-generation protection and firewall policies apply to every onboarded Windows device (Microsoft Learn, August 2025).
4. Add the Intune endpoint security policies for disk encryption, attack surface reduction rules, controlled folder access and web content filtering.

Our Intune initial setup for Windows is $6,500 per project and the Defender for Endpoint deployment is $3,500 per project; which Defender plan you own is a separate guide.

Microsoft's own words: by default, sharing levels are set to the most permissive level for both SharePoint and OneDrive (Microsoft Learn, August 2025). In the SharePoint admin center under Policies > Sharing, set external sharing for SharePoint and OneDrive to the least permissive level your business allows, the default link type to "Specific people" and the default permission to "View". In the Microsoft 365 admin center under Org settings > Calendar, turn off external calendar sharing or limit it to availability with time only. Then open the alert policies in the Defender portal and confirm the default policies for external sharing, malware and unusual activity notify a mailbox someone reads.

Business Premium includes sensitivity labels for mail, files and Teams meetings, Microsoft Purview Data Loss Prevention for Exchange, SharePoint and OneDrive, Message Encryption and Compliance Manager (Microsoft Learn, August 2025). Create three labels (General as the default, Confidential with encryption for employees only, Highly Confidential for named groups with no forwarding), start DLP in simulation mode for the identifiers you hold, usually U.S. Social Security and credit card numbers, and move to policy tips and then block with override after a month. Add a mail flow rule that applies Message Encryption to any outbound message that matches.

Endpoint DLP and Teams chat DLP are not in Business Premium; the Microsoft Purview Suite for Microsoft 365 Business Premium add-on is $10.00 per user per month on an annual term on the October 2026 price list, for the users who need them. The first five DLP policies and the data-risk controls have their own guides.

Retention, Litigation Hold and the recycle bin keep content; none of them restores a SharePoint site after ransomware or rolls a mailbox back to last Tuesday. Microsoft 365 Backup, managed from the Microsoft 365 admin center, backs up Exchange mailboxes, OneDrive accounts and SharePoint sites with restore points every ten minutes (for the most recent two weeks on OneDrive and SharePoint, then weekly to one year; for the whole year on Exchange), and restores up to 1,000 sites or mailboxes at one to three terabytes per hour (Microsoft Learn, June 2025).

It is pay-as-you-go through an Azure subscription at Microsoft's list price of $0.15 per gigabyte of protected content per month, with restores at no charge; the protected size includes the live mailbox or site plus its archive and second-stage recycle bin, so a 50-user tenant with 2 TB protected pays 2,048 × $0.15, about $307 per month on its own Azure bill. Turn it on, then restore one site and one mailbox and write down how long it took; the Microsoft 365 Restore Drill and Recovery Runbook ($2,450 per project) does exactly that. Native backup vs third-party tools covers when you need an independent copy as well.

Microsoft's security operations guide for Business Premium (Microsoft Learn, August 2025) sets the rhythm: daily, the vulnerability management dashboard's exposure score, pending actions in the Action center and new incidents; weekly, Microsoft Secure Score and Secure Score for Devices; monthly, the email and endpoint security reports. Working Secure Score as a backlog is its own guide.

What Business Premium does not include, and what fills the gap on the October 2026 price list (per user per month, annual term):

Buy the add-ons for the people who need them, not for the tenant.

Is MFA on by default in Microsoft 365 Business Premium?

Yes, through security defaults, which Microsoft turns on in tenants created after October 2019. They require MFA registration for everyone and block legacy authentication but cannot be tuned; Business Premium includes Entra ID P1 so you can replace them with Conditional Access.

Can I run security defaults and Conditional Access together?

No. While security defaults are on, Conditional Access policies can be created but not enabled. Recreate the four baseline policies in report-only mode, turn off security defaults, then enable the policies.

Does Business Premium include Intune?

Yes, Intune Plan 1, with mobile device management and mobile application management for Windows, macOS, iOS and Android. Business Basic and Standard get only Basic Mobility and Security.

What does the Defender Suite for Business Premium add?

Entra ID P2, Defender for Identity, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2 and Defender for Cloud Apps, at $10.00 per user per month on an annual term on the October 2026 price list, assignable to the users who need it.

Does Business Premium include backup?

No. Retention and Exchange Online Archiving are included; Microsoft 365 Backup is a separate pay-as-you-go service at Microsoft's list price of $0.15 per gigabyte per month, billed through an Azure subscription.

What is the 300-user limit?

Business Premium, like Business Basic and Standard, can be assigned to at most 300 users in a tenant. Users beyond that need an enterprise plan such as Microsoft 365 E3 ($39.00), and the two can coexist in one tenant.

• Microsoft 365 for business security overview — Microsoft Learn, ms.date 09/30/2025, checked 2026-10-11 (what Business Premium includes, the Defender Suite for Business Premium contents)
• Why choose Microsoft 365 Business Premium? — Microsoft Learn, ms.date 08/14/2025, checked 2026-10-11 (300-user limit)
• Multifactor authentication in Microsoft 365 — Microsoft Learn, ms.date 10/10/2025, and Security defaults in Microsoft Entra ID — Microsoft Learn, ms.date 07/21/2025, checked 2026-10-11
• Microsoft-managed Conditional Access policies — Microsoft Learn, ms.date 05/28/2026, and Require phishing-resistant multifactor authentication for administrators — Microsoft Learn, ms.date 03/24/2026, checked 2026-10-11
• Admin account security in Microsoft 365 for business — Microsoft Learn, ms.date 01/06/2026, and Manage emergency access accounts in Microsoft Entra ID — Microsoft Learn, ms.date 06/04/2026, checked 2026-10-11
• Baseline security mode settings — Microsoft Learn, ms.date 04/17/2026, checked 2026-10-11
• Email and collaboration security in Microsoft 365 for business and Device protection in Microsoft 365 Business Premium — Microsoft Learn, ms.date 08/14/2025, checked 2026-10-11
• Set up information protection in Microsoft 365 Business Premium and Monitor Microsoft 365 Business Premium and Defender for Business — Microsoft Learn, ms.date 08/14/2025, checked 2026-10-11
• Overview of Microsoft 365 Backup and Pricing model for Microsoft 365 Backup — Microsoft Learn, ms.date 06/19/2025 and 06/14/2025, checked 2026-10-11
• Microsoft commercial price list, October 2026: Microsoft 365 Business Premium, Microsoft 365 E3, Microsoft Defender Suite for Microsoft 365 Business Premium, Microsoft Purview Suite for Microsoft 365 Business Premium, Microsoft Defender and Purview Suites for Microsoft 365 Business Premium