You already own most of the controls
Business Premium and E5 include far more than most tenants switch on. Before anyone sells you another product, we turn on what you are paying for and write down the result.
Identity
Conditional Access built as a documented set rather than a pile of rules, phishing‑resistant MFA, privileged roles time‑bound, legacy authentication closed, break‑glass accounts tested.
Devices
Intune enrolment and compliance baselines, BitLocker and Defender policy, Autopilot for new starters, update rings that patch without surprising anyone mid‑meeting.
Data
Purview sensitivity labels and retention mapped to obligations you can name, DLP for the data you genuinely hold, and sharing links tightened before Copilot goes anywhere near them.
Evidence
A quarterly review pack: Secure Score movement, what changed and why, open risks with owners, and the exports that answer insurer and Cyber Essentials questionnaires directly.
Nine controls, same order, every tenant
| Control | Where it lives | Included in |
|---|---|---|
| Phishing‑resistant MFA for all users | Entra ID | Business Premium |
| Legacy authentication blocked | Entra ID | Business Premium |
| Just‑in‑time admin roles | Entra ID Governance | E5 / add‑on |
| Device compliance & encryption | Intune | Business Premium |
| Safe Links, Safe Attachments | Defender for Office 365 | Business Premium |
| Endpoint detection & response | Defender for Endpoint | Business Premium |
| Sensitivity labels & retention | Purview | E5 / add‑on |
| Immutable tenant backup | Third party | Managed tenant |
| Quarterly review pack | Robo‑Ni | Managed tenant |