Which Microsoft 365 plan does a small business need?

For most Australian small businesses, Microsoft 365 Business Premium, because it is the only Business plan that includes the security and device management tooling. Business Basic suits people who work entirely in a browser; Business Standard adds the desktop Office apps; Premium adds Intune, Entra ID protections and Defender, which is where the Essential Eight controls live.

The plan names are unhelpful and the history is worse, since these products have been renamed repeatedly, which is why half the advice you will find describes plans that no longer carry those names. Ignore the branding and look at what each tier actually adds, because the ladder is genuinely simple once the marketing is stripped off: email and cloud services, then the apps you install on a laptop, then the tools that secure and manage the whole thing.

Business Basic is the entry tier: business email on your own domain, Teams, SharePoint and OneDrive, and the web and mobile versions of Word, Excel and Outlook. No installed desktop apps. It genuinely suits a business whose people work in a browser all day, and it is often right for shared-terminal roles, casual staff and frontline workers who need an identity and a mailbox rather than a full toolkit.

Business Standard adds the desktop applications, and that is essentially the whole difference. If your team builds complex spreadsheets, works offline, uses Outlook as a desktop client, or relies on add-ins for accounting or clinical software, this is the floor rather than an upgrade. It is where a great many small businesses sit, and for a business with no regulatory exposure and modest risk it is a defensible place to be.

Business Premium is where the conversation should usually land, and the reason has nothing to do with productivity. It adds Intune for device management, Entra ID identity protections including conditional access, and Defender for endpoint and email protection. In Essential Eight terms, that is the tooling behind multi-factor authentication done properly, restricting administrative privileges, application hardening and managed patching. Buying Standard and then purchasing security add-ons separately frequently costs more and always produces a messier estate.

So the practical rule is to license by role rather than uniformly. Anyone handling client, patient or financial data, anyone with administrative rights, and anyone working from a laptop outside the office should be on the security tier. Shared terminals, kiosk roles and casual staff can sit lower. Mixing is normal, supported, and the single biggest lever on both cost and risk, because uniform licensing either overspends on people who need nothing or, far more often, leaves the accounts that matter underprotected.

One ongoing habit saves more money than the initial choice does: review the licence count quarterly. Subscriptions are bought when people join and almost never released when they leave, so a business that has hired and lost a dozen people over two years is very often paying for several accounts nobody uses. The same review catches the opposite error, the staff member who moved into a client-facing role a year ago and is still on the tier they had as a casual. Fifteen minutes against the user list, four times a year, reliably pays for itself.

Two adjacent purchases confuse this decision and are worth separating out. Copilot is an add-on, not a plan tier, and is bought per user on top of an eligible base plan; deciding your base licensing and deciding who gets Copilot are different conversations held at different times. And backup is not included at any tier: Microsoft protects the platform, your data remains your responsibility, which is why we back client tenants up daily with Veeam to a separate data centre with thirty days of history.

On price, the structure matters more than the numbers, which move: it is per user per month, cheaper committed annually than month to month, and quoted differently across resellers, which is why the same plan appears at several prices in a single search. Microsoft's Australian pricing page is the authority for current figures. What is worth knowing is that the gap between the middle and top tier is small relative to what a single incident costs, which is the comparison that usually settles it.

The honest caveat: a licence is a capability, not a configuration. Business Premium delivers nothing until conditional access, device enrolment and Defender policies are actually set up, and plenty of businesses pay the higher price while running the security posture of the tier below. Buy the plan you need, then make someone accountable for turning it on. If you want the mix reviewed against your roles and actual risk, call 1800 456 567.