Microsoft 365 Business Basic vs Standard vs Premium: which has the email security you need?

Microsoft sells three business plans for companies of up to 300 users: Business Basic, Business Standard and Business Premium. All three filter email the same way at the door, but only Premium includes Microsoft's paid email protection and the identity and data controls around it. This guide compares the plans on email security only, using Microsoft's own service descriptions, and answers which one a small business actually needs. Plan contents are as published at the time of writing (November 2026); Microsoft changes them, so confirm on the linked pages before you buy.

What email security comes with every Microsoft 365 business plan?

Every Microsoft 365 business plan includes Microsoft's built-in security features for all cloud mailboxes, long called Exchange Online Protection (EOP). Microsoft's business security overview says all three plans get protection "against malware, spam, and phishing (spoofing) in email", through anti-malware, anti-spam and anti-phishing spoofing policies that are on by default.

In practice that baseline covers a lot. Mail is checked against connection filters and malware scanners. Spam and bulk mail go to the Junk Email folder. Messages that look like high confidence phishing go to quarantine, a holding area that users and admins review in the Microsoft Defender portal. Zero-hour auto purge (ZAP) can pull a message out of an inbox after delivery if Microsoft later decides it was malicious. Our guide to Exchange Online Protection explains each layer in detail.

All three plans also include Microsoft Entra ID Free with security defaults, which turns on multifactor authentication (MFA) for everyone by default, and Basic Mobility and Security for simple mobile device management. MFA matters for email security because most mailbox takeovers start with a stolen password.

How do Business Basic, Standard and Premium compare?

The table below lists only email and account security features. It's built from Microsoft's business security overview, the Defender for Office 365 service description, the Purview service description and Microsoft's 2026 packaging update.

A few notes on the table. "Add-on" for Message Encryption means Microsoft says Azure Information Protection Plan 1 provides the rights when added to Business Basic or Business Standard. The archive row comes from Microsoft's Exchange Online limits and the Purview service description, which lists Business Premium among the licenses for an archive "limited to 1.5 TB". Archive size affects retention and eDiscovery, not filtering. And the time-of-click row is new: Microsoft's packaging page lists "URL time-of-click protection" for Basic and Standard, but not for Premium, which already has Safe Links.

What did the 2026 packaging update change?

Microsoft's 2026 pricing and packaging update changed what the business plans include. Microsoft said the new capabilities would begin rolling out in June 2026, with price changes effective July 1, 2026, and it labels the feature lists "Rolling out summer 2026".

For email security, the change that matters is URL time-of-click protection in Business Basic and Business Standard. Time-of-click protection checks a link when the user clicks it, not only when the message arrives. That closes a common gap: an attacker sends a link to a harmless page, waits until the message is delivered, then switches the page to a phishing form.

Be precise about what this is. Microsoft lists it as its own line item, separate from Defender for Office 365 Plan 1, which the same page lists for Office 365 E3 and Microsoft 365 E3. Microsoft doesn't list Safe Attachments or impersonation protection for Basic or Standard. So treat the update as one Plan 1-style protection, for links, rather than an upgrade to Plan 1. The update also adds 50 GB of mailbox storage to all three business plans. If your tenant was set up before mid-2026, check the Defender portal to see what you actually have; the procedure is below.

What does Business Premium add for email?

Business Premium adds three groups of protection that matter for email.

Defender for Office 365 Plan 1

Microsoft's overview lists what Plan 1 adds in Business Premium:

• Impersonation protection and phishing email thresholds in anti-phishing policies. You name the executives and partner domains that attackers are likely to fake, and Microsoft flags lookalike senders. This is the main defense against business email compromise.
• Safe Attachments, which opens attachments in a sandbox (an isolated test environment) before delivery, plus Safe Attachments for SharePoint, OneDrive and Teams.
• Safe Links, which rewrites and checks links in email, Teams and Office apps at the time of click.

Plan 1 also brings Real-time detections, a search view for investigating threats. Our Defender Plan 1 vs Plan 2 guide covers the full list and what the enterprise tier adds on top.

Identity controls: Entra ID P1

Business Premium includes Microsoft Entra ID P1, which brings Conditional Access. Conditional Access lets you write rules such as "require MFA from outside the office" or "block sign-ins from countries we don't work in". Microsoft says you can use Conditional Access policies "instead of security defaults" when you need finer control. For email, this is how you block legacy sign-in methods and stop a stolen password being used from an unexpected location.

Data protection: DLP, encryption and labels

Microsoft lists three information protection features in Business Premium: sensitivity labels, Purview Data Loss Prevention (DLP) and Purview Message Encryption. DLP inspects outgoing mail for things like card numbers or Social Security numbers and can warn, block or encrypt. Our guides to Microsoft 365 DLP for email and Purview Message Encryption show the setup.

Premium also includes Intune Plan 1 and Microsoft Defender for Business for devices. They don't filter mail, but a phone or laptop with malware can leak a mailbox just as easily as a phishing link.

Is Business Standard secure enough for email?

Business Standard is secure enough for a business that turns on its free protections and accepts a few gaps. You get Microsoft's full baseline filtering, MFA through security defaults, and, from Microsoft's 2026 update, time-of-click link checks. What you don't get is attachment sandboxing, impersonation protection, Conditional Access or DLP.

Two gaps matter most for small businesses. The first is impersonation: without Plan 1, Microsoft has no list of your executives or suppliers to protect, so a message from a lookalike domain pretending to be your CEO is judged on general signals only. The second is attachments: without Safe Attachments, a new piece of malware that no scanner recognizes yet can reach the inbox. You can narrow both gaps without upgrading, for example by blocking risky file types (see dangerous email attachment types) and tagging external mail.

Which Microsoft 365 business plan do I need?

Use these common cases as a starting point:

1. You need email and web apps only, with fewer than 300 users and low risk: Business Basic. Turn on the Standard preset security policy and keep security defaults on.
2. You need desktop Office apps but handle no payments or sensitive data by email: Business Standard, with the same settings. Add an attachment-type block and external sender tags.
3. You pay suppliers, approve invoices or move money based on email: Business Premium, or Business Standard plus the Defender for Office 365 Plan 1 add-on. Impersonation protection is the feature you're buying.
4. You handle health, financial or legal data: Business Premium. DLP and Message Encryption are included, and Conditional Access helps you show who can reach the mailbox. Ask your counsel what your regulator expects.
5. You have more than 300 users: you can't stay on business plans. Compare Microsoft 365 E3 and E5 for email security.

If you're choosing between platforms rather than plans, see Google Workspace vs Microsoft 365 email security.

Can you add Defender for Office 365 to Business Basic or Standard?

Yes. Microsoft says Defender for Office 365 "is also available as an add-on subscription to many Microsoft 365 subscriptions with cloud mailboxes" (Microsoft Learn). This is a common choice when a business wants impersonation protection and Safe Attachments but doesn't need Intune or Conditional Access yet.

Count licenses carefully. Microsoft's licensing terms say licenses are needed for "any user that accesses a mailbox that benefits from Defender for Office 365 protections" and for "shared mailboxes that benefit from Defender for Office 365 protections". Microsoft also notes that Defender features are enabled at the tenant level by default, so if you license only some users, scope your policies to them.

Business Premium customers can go one step further with the Microsoft Defender Suite for Business Premium add-on. Microsoft says it includes Defender for Office 365 Plan 2 and Entra ID P2, among other products.

How do you check which plan and protections your tenant has?

1. In the Microsoft 365 admin center, go to Billing > Your products (in Simplified view, Subscriptions). You need the Global or Billing admin role. The list shows each subscription and add-on.
2. If you prefer PowerShell, connect with Connect-MgGraph -Scopes Organization.Read.All, then run Get-MgSubscribedSku | Select SkuPartNumber, ConsumedUnits. Microsoft's licensing PowerShell guide explains the output; match part numbers to product names with Microsoft's "Product names and service plan identifiers" reference.
3. In the Microsoft Defender portal (security.microsoft.com), open Email & collaboration. If you see Real-time detections, you have Plan 1; Explorer means Plan 2. Neither means built-in protection only.
4. Go to Email & collaboration > Policies & rules > Threat policies > Preset security policies and assign the Standard or Strict preset to your users. Our preset security policies guide walks through it.
5. Check your quarantine notifications. In Microsoft's default anti-spam policy, high confidence spam goes to the Junk Email folder. The Standard and Strict presets quarantine it instead and apply a quarantine policy that sends users notifications (Microsoft Learn).

What gaps remain on every business plan?

Some gaps don't close with any of the three plans, because they come from how a mailbox platform works:

• Default settings are lenient. In Microsoft's default anti-spam policy, phishing goes to the Junk Email folder and quarantined spam is kept for 15 days; the Standard and Strict presets quarantine phishing and keep it for 30 days. Many tenants never change the defaults.
• Licensing is per user. Shared mailboxes and role addresses can count toward Defender licensing, as above.
• No outage holding of your own. If your mailboxes are unreachable, inbound mail depends on each sender's retry behavior. See what happens to email when your server is down.
• One platform at a time. If you also run domains on Google Workspace or cPanel, each has its own filter and quarantine.

An MX-level filtering service in front of Microsoft 365 adds an independent layer, user quarantine digests and outage spooling, with per-domain rather than per-user pricing. It doesn't replace Defender's post-delivery and Teams protection. Our Microsoft 365 platform page explains how iBlockSpam fits alongside your plan, and do I need a spam filter with Microsoft 365? covers when it's worth it.

Next steps

• Check Billing > Your products and the Defender portal to confirm which plan and protections you have today.
• Assign the Standard or Strict preset security policy, whatever plan you're on.
• If you're on Basic or Standard and pay invoices by email, price the Defender for Office 365 Plan 1 add-on against Business Premium.
• Run the free Email Health Check to confirm your MX, SPF and DMARC records, and read how a gateway works with your tenant on the Microsoft 365 platform page.