Nonprofit Microsoft 365 Licensing After the Grant Changes

When grants covered more of the tenant, many nonprofits let licensing grow by habit. New staff received whatever SKU was available. Volunteers stayed active because the license appeared to cost nothing. Shared accounts were tolerated for speed. Finance, HR, executives, and temporary event volunteers often had the same protection level.

That model breaks when donated capacity changes, discounted SKUs become the default, or the board asks why Microsoft spend increased.

The expensive mistake is downgrading everyone. That usually creates three risks:

• Staff lose desktop Microsoft 365 apps and move work to local storage or personal cloud services.
• Unmanaged devices keep accessing Exchange, SharePoint, OneDrive, and Teams without compliance controls.
• The organization saves a small monthly amount while leaving donor, HR, finance, and executive mailboxes exposed.

Start with workload and risk. Who handles payment, payroll, HR, grant, or donor data? Who approves payments? Who uses unmanaged home devices? Who only needs browser access to a schedule or team site? Which former volunteers or board members still have accounts?

In many nonprofit tenants, the first savings do not come from changing plans. They come from removing stale accounts, unlicensing shared mailboxes that do not need licenses, retiring duplicate tools, and assigning stronger security only where the risk justifies it.

For eligible nonprofits, Microsoft 365 Business Basic is the cost anchor. Microsoft grants up to 300 Business Basic seats at no charge to a validated nonprofit, and those seats cover Exchange email, Teams, SharePoint, OneDrive and the web and mobile Microsoft 365 apps. Business Premium is no longer donated: Microsoft discontinued the Business Premium grant for customers at their next renewal after 1 July 2025, and the Office 365 E1 grant with it. Business Premium, Business Standard and the enterprise suites are sold to validated nonprofits at discounted nonprofit prices instead. Those prices are not on the commercial price list this site quotes from, so the Business Premium nonprofit page quotes them on request. Confirm the grant quantity in Microsoft's nonprofit portal before you finalize a design; Microsoft can revalidate eligibility.

The trap is treating Business Basic as good enough for everyone because it is donated. Business Basic is a strong fit for low-risk, browser-based users. It is not a complete security architecture for staff who handle restricted data from devices you need to manage.

Microsoft 365 Business Premium is usually the nonprofit SKU that earns its price, because it combines productivity, identity, endpoint, and device controls that many organizations otherwise buy separately:

• Microsoft Entra ID P1 for Conditional Access and related identity controls.
• Microsoft Intune Plan 1 for device management and compliance policies.
• Microsoft Defender for Business for endpoint protection.
• Microsoft Purview capabilities such as sensitivity labels and data loss prevention for supported workloads.
• Desktop Microsoft 365 apps for Windows and Mac.

Conditional Access is not a free tenant-wide feature. Users protected by Conditional Access need the appropriate Microsoft Entra ID P1 licensing, which is included in Business Premium or available as an add-on. If users remain on Business Basic without Entra ID P1, use security defaults and strong MFA at minimum, but do not assume that matches a managed Conditional Access design.

If the nonprofit is already paying for endpoint protection, mobile device management, basic identity tooling, or VPN workarounds for unmanaged access, Business Premium may cost less than it appears. The decision should compare the whole stack, not only the Microsoft line item.

Use donated Business Basic for users whose access pattern and data risk fit it. Use Business Premium where identity, endpoint, desktop app, and data protection requirements justify the spend.

Three administrative facts shape the budget as much as the SKU choice does.

1. Grant renewals. A discontinued grant lapses at its renewal date: the licenses expire and do not renew, and Microsoft's guidance is to move those users to another eligible offer before that date, by hand, in the Microsoft 365 admin center. Put the renewal date of every grant subscription in the plan, and decide for each seat whether it moves to donated Business Basic, to a discounted paid SKU, or to nothing.

2. NCE terms. Paid nonprofit seats bought through a Cloud Solution Provider follow the New Commerce Experience: an annual term costs less per month but commits you for the year, and a monthly term costs more and can be reduced month to month. Put permanent staff on annual terms and seasonal, grant-funded or program-funded seats on monthly terms; NCE annual vs monthly has the break-even.

3. Partner access. If a partner administers the tenant, the access should be Granular Delegated Admin Privileges (GDAP): named roles for a set period that your Global Administrator approves and can revoke, not the broad standing access of the older delegated admin model.

A cost-effective Microsoft 365 design should mirror access patterns, not the org chart.

Group users into practical personas:

1. Core staff: employees with email, Teams, SharePoint, OneDrive, and regular document work.
2. High-risk staff: finance, HR, executives, development leaders, grant writers, legal, and anyone with payroll, donor, or restricted program data.
3. Field or program workers: staff using shared devices, mobile devices, or browser-first workflows.
4. Volunteers, board members, and seasonal users: intermittent access, low data ownership, high offboarding risk.
5. Shared mailboxes and service accounts: often over-licensed and under-governed.
6. Administrators: privileged users that should be separate from daily work accounts.

For many nonprofits using Microsoft 365 Business plans, a workable pattern looks like this:

• Business Premium for permanent staff who use organization-managed devices, need desktop apps, or access sensitive data.
• Business Basic for volunteers, board members, seasonal users, and browser-only program users with limited data access.
• Business Standard only where desktop apps are required and identity, endpoint, and device management are intentionally covered another way.
• Unlicensed shared mailboxes unless they require features such as storage over 50 GB, archive, litigation hold, or another licensed compliance requirement.
• Separate admin accounts with strong controls and no daily email use. License them appropriately for the controls applied to them.

A 75-user nonprofit might use 30 Business Premium licenses for leadership, finance, HR, development, operations, and managed-laptop users; 35 Business Basic licenses for volunteers, board members, and browser-only program access; 5 Business Standard licenses for justified desktop-app-only needs; and 5 unlicensed shared mailboxes. That is usually safer and cheaper than giving every user the same paid SKU.

For nonprofits approaching Microsoft 365 Business plan seat limits, the discussion changes. Enterprise plans such as Microsoft 365 E3 or E5 may be required for scale, compliance, security, or operational reasons. Do not move everyone to enterprise licensing just because it is simpler. First identify which users need enterprise-only capabilities.

Nonprofits are targeted because they hold useful data, have trusted reputations, and often run lean IT. A common attack path is simple: steal a password, bypass weak MFA, access email, search for invoices or donor files, create forwarding rules, and impersonate a trusted person.

Treat these controls as baseline architecture:

• MFA for every account. Use phishing-resistant MFA for admins, finance, and other high-risk users where possible.
• Conditional Access for users licensed with Microsoft Entra ID P1, including policies for device compliance, location, app access, and session controls.
• Security defaults at minimum for accounts that are not covered by Conditional Access licensing.
• Block legacy authentication.
• Require compliant or managed devices for sensitive SharePoint sites, OneDrive content, and finance or HR workflows.
• Separate privileged admin accounts from daily work accounts.
• Disable or tightly control automatic external forwarding.
• Review guest users, anonymous links, and external sharing in Teams, SharePoint, and OneDrive.
• Use retention and eDiscovery settings for finance, HR, grant, and governance records where licensing supports the requirement.
• Deploy endpoint protection on organization-owned devices, such as Microsoft Defender for Business when using Business Premium.

Be precise about licensing. Risk-based Conditional Access policies, such as policies driven by sign-in risk or user risk, require Microsoft Entra ID P2. Business Premium includes Entra ID P1, not P2. If risk-based identity protection is required, model the P2 add-on or an enterprise plan for the affected users.

The right question is not, “Can this user survive on Business Basic?” The right question is, “If this account or device is compromised, what data, payments, people, and workflows are exposed?”

Cost optimization is not only downgrading. In nonprofit tenants, avoidable waste usually appears in five places.

First, stale users. Former staff, inactive volunteers, old board members, and test accounts keep licenses assigned for months or years. Review sign-in activity, group membership, and ownership before renewal.

Second, licensed shared mailboxes. Shared mailboxes usually do not need licenses when accessed by licensed users with delegated permissions. They do need licenses for certain scenarios, such as storage over 50 GB, archive, litigation hold, or specific compliance requirements. Avoid direct login to shared mailboxes; use delegated access and auditability instead.

Third, duplicate security tools. If Business Premium is deployed correctly, Microsoft Defender for Business and Microsoft Intune may replace standalone endpoint and device-management subscriptions for many nonprofits. The savings may appear outside the Microsoft invoice.

Fourth, desktop app assumptions. Some users need desktop Excel, Word, Outlook, or PowerPoint. Others need only Teams, browser-based Microsoft 365 apps, and SharePoint access. Assign desktop-app licenses based on workflow, not habit.

Fifth, overbroad premium licensing. Giving Business Premium, E3, or E5 to every volunteer because it is administratively easy is rarely the cheapest safe model. Use groups, access reviews, access packages, and offboarding rules to keep a mixed-license model manageable.

Optimize the whole stack: Microsoft licensing, identity controls, endpoint management, retention requirements, backup needs, and support overhead.

Do not make the renewal decision from the billing screen. Export, at minimum:

• Active users by SKU, department, role and last sign-in date, and users with no sign-in in the last 30, 60 and 90 days.
• Users with admin roles, privileged access or payment authority.
• Whether every user covered by Conditional Access, Intune, Defender or Purview features holds the license those features require.
• Shared mailboxes with licenses, direct sign-in enabled, forwarding, delegates or archive requirements, and mailboxes with external forwarding or suspicious inbox rules.
• Teams and SharePoint sites with external sharing on, guest accounts, stale invitations, and board and volunteer access.
• Devices reaching Microsoft 365 (managed, compliant, personal or unknown), and every generic, scanner or service account excluded from MFA or Conditional Access.

The output is an action list, not a report: disable these users, convert these mailboxes, remove these licenses, move these users to Business Premium, keep these on Business Basic, scope this policy to the licensed group. A review of a 160-user tenant that was about to upgrade everyone typically ends closer to this: 35 high-risk users who need Business Premium, 50 web-only users who stay on donated Business Basic, 40 users who need desktop apps but not the full control set, 20 stale accounts to disable and 15 shared mailboxes to unlicense. That segmentation is what stops a grant change from becoming a blanket budget increase.

A nonprofit does not need a six-month licensing study. It needs a focused audit and a decision model finance, operations, and IT can defend.

Week 1: inventory the tenant. Export users, assigned licenses, sign-in activity, MFA methods, admin roles, shared mailboxes, guest users, devices, groups, and mailbox forwarding rules. Identify inactive accounts and accounts with no recent sign-in activity. Review Global Administrator, Exchange Administrator, SharePoint Administrator, Teams Administrator, and billing roles.

Week 2: map users to personas. Do not ask department heads which licenses they want. Ask which data users access, whether they need desktop apps, whether they use managed devices, whether they are permanent or temporary, and whether they are staff, volunteers, board members, or guests.

Week 3: define the licensing architecture. Assign Business Premium where device control, Conditional Access, endpoint protection, desktop apps, and sensitive data access justify it. Use donated Business Basic for low-risk web users. Use Business Standard only for justified desktop-app needs when security and device controls are handled separately. Remove licenses from shared mailboxes where possible. Identify any users who truly require enterprise SKUs or add-ons such as Entra ID P2, Microsoft Defender for Office 365, or advanced compliance licensing.

Week 4: implement controls and governance. Build license groups, offboarding rules, MFA and Conditional Access baselines, shared mailbox standards, admin account standards, and a monthly license review. Document exceptions with an owner and review date.

The result worth having is not just a lower bill. It is a tenant where the CFO understands why one user costs more than another, leadership can explain the risk posture to the board, and IT can manage change without rebuilding licensing every renewal.

Is Microsoft 365 Business Premium still donated to nonprofits?

No. Microsoft discontinued the Business Premium grant for customers at their next renewal after 1 July 2025; licenses on the grant expire at that renewal and do not renew. Validated nonprofits buy Business Premium at nonprofit staff pricing, $5.50 per user per month or $66.00 per year on an annual commitment (Microsoft nonprofit price list, October 2026), on the Business Premium nonprofit page.

How many Business Basic licenses does Microsoft grant?

Up to 300 Microsoft 365 Business Basic seats at no charge for a validated nonprofit, according to Microsoft's nonprofit program pages. Confirm the current quantity in the nonprofit portal, because Microsoft can revalidate eligibility.

Do volunteers need a license?

Only if they need a mailbox or sign in to Teams, SharePoint or OneDrive as members; a volunteer who only needs a schedule or a shared folder can be a guest of one team or site. For the rest, donated Business Basic with an owner and an expiry date is the usual fit.

Do shared mailboxes need a license?

Not when they are under 50 GB, used through delegated access by licensed users, and need no archive or litigation hold. Block direct sign-in to them.

Does Conditional Access work on donated Business Basic?

Not legitimately. Conditional Access requires Microsoft Entra ID P1 for every user a policy covers, and Business Basic does not include it. Use security defaults for Business Basic users, and Business Premium, which includes Entra ID P1, or the Entra ID P1 nonprofit add-on for the users who need Conditional Access.

• Microsoft for Nonprofits: updates — Microsoft Learn, checked 2026-10-11 (Business Premium grant discontinued and licenses expire at the next renewal; up to 300 granted Business Basic licenses; discounted nonprofit pricing on paid plans)
• Microsoft 365 Business Premium and Office 365 E1 grant discontinuation — Microsoft Partner Center, checked 2026-10-11 (discontinued at the next renewal after 1 July 2025; move users to another eligible offer in the Microsoft 365 admin center)