Somewhere in your Microsoft 365 bill is a security product you probably haven't met. Business Premium — the tier many growing companies already pay for — includes device management, advanced email threat protection, identity controls, and data protection tooling that, purchased separately, would cost more than the license itself. Most of it ships disabled. This article is the tour.
Intune: every device, actually managed
Intune is device management — the ability to require encryption, enforce screen locks, push security baselines, and remotely wipe a laptop that walked away. For companies with remote or hybrid staff, this is the difference between "our data is on sixty laptops we hope are fine" and enforceable policy. It also handles mobile devices, so company email on a personal phone can live inside a protected container that IT can remove without touching the family photos.
Defender for Office 365: email security beyond the spam filter
The standard spam filter catches junk. Defender for Office 365 catches attacks: links detonated in a sandbox before delivery, attachments opened in isolation first, and impersonation protection that flags the email pretending to be your CEO. Given that essentially every social-engineering play we described in the protecting-people piece arrives by email, this is not an optional nicety — and many companies buy a third-party product to do what their license already includes.
Conditional Access: the highest-leverage checkbox in security
Conditional Access lets login requirements depend on context: block sign-ins from countries you don't operate in, require MFA on unfamiliar devices, and shut off the legacy protocols that can't do MFA at all — the exact door most account takeovers walk through. A handful of policies here eliminates whole categories of attack; the identity piece explains why this is the modern perimeter. It's included in Business Premium. It is, in our experience, the single most valuable unused feature in the Microsoft stack.
The data controls: sensitivity labels and DLP
Business Premium also carries the starter kit for data governance — sensitivity labels that travel with documents and data-loss-prevention rules that catch a spreadsheet of customer records leaving by email. These take real configuration to do well, but the licensing is already handled, which matters because the data-classification work they enforce is the same work your data protection program and AI policy both require.
Why it all sits dark
Nobody's job was to turn it on. These features arrived via licensing bundles, not projects; enabling them well requires sequencing (Conditional Access misconfigured can lock out the CEO, which you get to do once); and the vendors selling replacement point-products are louder than the license you already own. The result is companies paying twice — once for the dormant capability, once for the third-party product covering the same gap.
The enablement sequence
The order that works: identity first (MFA completion, Conditional Access), email protection second, device enrollment third, data controls last — each phased with a pilot group so nothing breaks loudly. It's a defined project with a defined end, and it's precisely what our Microsoft 365 practice does with the license you're already paying for. Before buying any new security product, spend thirty minutes finding out what's already in the building.