Small law firms across New York run on email, documents and calendars. Most already use Microsoft 365 for that. A common question is whether the Business Premium plan is worth considering, and what it actually adds. This page walks through the security features Microsoft includes in Business Premium, in plain terms, so you can have a better conversation with your IT provider.

A note before we start

Law firms often have questions about client confidentiality and technology. FIX256 is an IT company, not a law firm. This page does not interpret any rule of professional conduct or ethics opinion, and it is not legal advice. For questions about what your obligations require, talk to your own ethics counsel or check the guidance from your bar association. What follows describes what the Microsoft tools do. No software, on its own, makes a firm compliant with anything.

What Business Premium is

Microsoft describes Microsoft 365 Business Premium as a productivity and security solution for small and medium-sized businesses with up to 300 users. It includes the familiar apps (Outlook, Word, Excel, PowerPoint, Teams and SharePoint) plus five security services that Microsoft says are built in, not sold as add-ons:

  • Microsoft Entra ID Plan 1, for identity and sign-in protection
  • Microsoft Intune Plan 1, for device and app management
  • Microsoft Defender for Office 365 Plan 1, for phishing protection
  • Microsoft Defender for Business, for device protection
  • Microsoft Purview features, for labeling, message encryption and data loss prevention

What it adds over Business Standard

All Microsoft 365 for business plans include Entra ID Free with security defaults. Microsoft turns security defaults on for new tenants, which requires multifactor authentication, but older tenants, or tenants where someone switched them off, may not have it on. They also include built-in protection against malware, spam and spoofing for cloud mailboxes, plus a limited device management feature called Basic Mobility and Security.

Business Premium goes further on each of those, as described below. For many small firms, the jump from Standard to Premium is less about new apps and more about control over who signs in, from what device, and what happens to documents after they leave the office.

Protecting sign-ins with Conditional Access

Business Premium includes Microsoft Entra ID P1, which includes Conditional Access. Conditional Access lets you set rules for sign-ins instead of relying only on the default settings. Examples of the kinds of rules firms often consider:

  • Require multifactor authentication for everyone, every time, or under certain conditions.
  • Allow access to firm email and files only from devices the firm manages.
  • Block sign-ins from locations where nobody at the firm works.

Microsoft notes that if your organization needs more complex security settings, Conditional Access policies can be used instead of security defaults. Rules like these need careful testing, because a mistake can lock out a partner on the morning of a filing. Microsoft also recommends keeping emergency admin accounts for exactly that situation.

Managing laptops and phones with Intune

Business Premium includes Microsoft Intune Plan 1. Microsoft describes it as an upgrade over Basic Mobility and Security, with support for both full device management and app-only management. App management is the option many firms use for personal phones: the firm manages its data inside apps like Outlook without taking over the whole phone. Intune also supports more device types, including Macs.

With firm-owned laptops managed in Intune, you can push settings like required disk encryption and updates, and Microsoft says you can remotely wipe a lost or stolen device.

Email protection with Defender for Office 365

Business Premium includes Microsoft Defender for Office 365 Plan 1. According to Microsoft, this adds:

  • Impersonation protection in anti-phishing policies, which matters when attackers pretend to be a partner or a client
  • Safe Attachments policies, including Safe Attachments for SharePoint, OneDrive and Teams
  • Safe Links policies

Microsoft recommends going beyond the defaults, for example by turning on its Standard or Strict preset security policies.

Device protection with Defender for Business

Business Premium includes Microsoft Defender for Business, an endpoint security product designed for organizations up to 300 users. Microsoft says it includes next-generation protection, attack surface reduction, endpoint detection and response, and automated investigation and remediation, and that it works on Windows, Mac, iOS and Android. Protecting Windows or Linux servers with it requires extra licenses.

Labeling and protecting documents and email with Purview

Business Premium includes several Microsoft Purview information protection features:

  • Sensitivity labels for email, files and Teams meetings. Labels appear in Outlook, Word, Excel and PowerPoint, and firms can create custom labels.
  • Data loss prevention (DLP) policies, which can identify and help stop sensitive items from being shared with people who should not have them.
  • Message Encryption, which can be applied by the sender or automatically by rules, such as encrypting messages that meet certain criteria.

How a firm sets up labels and rules is a business decision. Some firms start with a small set of labels and add more over time.

What Business Premium does not do on its own

Buying licenses does not switch most of this on. Conditional Access, Intune, labels and DLP all need to be planned and configured. Business Premium is also not a backup product, a document management system, or a replacement for staff training on phishing. And it does not, by itself, satisfy any professional rule or client requirement. Those questions belong with your ethics counsel and your clients.

Microsoft also sells add-ons, such as Defender and Purview suites for Business Premium, for firms that want more. Many small firms start without them.

Getting started without disrupting the firm

  1. Take stock. Who has accounts, what devices they use, and where client documents live today.
  2. Lock down sign-ins. Make sure every account, including admin accounts, uses multifactor authentication.
  3. Pilot first. Test Conditional Access and device rules on a few people before rolling them out.
  4. Enroll devices. Bring firm laptops into Intune, then set up app protection for personal phones.
  5. Tune email protection. Apply Microsoft's recommended preset policies.
  6. Add labels and DLP. Start simple and expand once staff are comfortable.

Talk it through with FIX256

FIX256 helps small offices across New York, including law firms, with general IT and security. If you want to talk through whether Business Premium fits your firm, book a free 20-minute call: https://calendar.app.google/jJf25UeTNo1npcAT9

FAQ

What is Microsoft 365 Business Premium? It is Microsoft's productivity and security plan for small and medium-sized businesses with up to 300 users. It includes the Microsoft 365 apps plus Entra ID P1, Intune Plan 1, Defender for Office 365 Plan 1, Defender for Business and Purview features.

Does Business Premium make our firm compliant with ethics rules? No software does that on its own. Business Premium provides security tools. What your obligations require is a question for your ethics counsel or your bar association's guidance.

Does Business Premium include Conditional Access? Yes. Business Premium includes Microsoft Entra ID P1, which includes Conditional Access.

Can we protect firm email on personal phones without managing the whole phone? Intune Plan 1, included in Business Premium, supports app management, where the firm manages its data inside apps rather than the full device. Microsoft lists this as an option for personal devices.

Can we encrypt email to clients? Business Premium includes Microsoft Purview Message Encryption. Senders can encrypt messages manually, and admins can set rules to encrypt messages automatically based on criteria.

Is there a user limit? Microsoft describes Business Premium as designed for businesses with up to 300 users.

Do we have to switch everything on at once? No. Many firms roll features out in stages, starting with sign-in protection and device enrollment.

Microsoft, Microsoft 365, Outlook, Word, Excel, PowerPoint, Teams, SharePoint, OneDrive, Windows, Entra, Intune, Defender and Purview are trademarks of the Microsoft group of companies. FIX256 is an independent IT provider, and this page is not sponsored or endorsed by Microsoft.

Sources

  1. Microsoft Learn, Why choose Microsoft 365 Business Premium? (up to 300 users; manage Windows, Mac, iOS and Android devices): https://learn.microsoft.com/en-us/microsoft-365/business-premium/m365bp-overview
  2. Microsoft Learn, Microsoft 365 for business security overview (plan comparison table; Entra ID P1 with Conditional Access; Defender for Office 365 Plan 1 features; Intune Plan 1 vs Basic Mobility and Security; MDM and MAM; Defender Suite add-on): https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-security-overview?view=o365-worldwide
  3. Microsoft Security, Microsoft 365 Business Premium product page and FAQ (five built-in security services "not sold as add-ons"; included apps; remote wipe; Defender and Purview Suites): https://www.microsoft.com/en-us/security/business/microsoft365-business-premium
  4. Microsoft Learn, Microsoft Entra licensing (Entra ID P1 and Conditional Access included in Business Premium): https://learn.microsoft.com/en-us/entra/fundamentals/licensing
  5. Microsoft Learn, What is Microsoft Defender for Business? (up to 300 users; feature list; cross-platform; servers need extra licenses): https://learn.microsoft.com/en-us/defender-business/mdb-overview
  6. Microsoft Learn, Set up information protection capabilities in Business Premium (sensitivity labels for email, files and Teams meetings; DLP; Message Encryption manual and rule based): https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365bp-information-protection?view=o365-worldwide
  7. Microsoft Learn, Configure security defaults for Microsoft Entra ID (security defaults "might be enabled" for tenants created on or after October 22, 2019, rolled out to new tenants, can be disabled; two cloud-only emergency access accounts recommended): https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

All sources fetched directly on 2026-11-01.