Microsoft 365 licensing for small businesses, explained properly

The three plans that actually matter

Ignore the full Microsoft catalogue for a moment. For a UK business under 300 staff, the decision is between Business Basic, Business Standard and Business Premium, and the differences are cleanly delineated.

Business Basic is a cloud-only plan: hosted Exchange email, Teams, SharePoint, OneDrive and the browser and mobile versions of Word, Excel and PowerPoint. It suits frontline and shift staff who work from a phone, and roles that genuinely live in a browser. It does not include the installed desktop applications, which is the single most common cause of complaints after a downgrade.

Business Standard is Basic plus the desktop Office applications installed locally on up to five PCs or Macs, five tablets and five phones per user. For most office-based staff this is the baseline.

Business Premium is Standard plus a security and management stack that would otherwise be bought as several separate products: Microsoft Entra ID P1 (Conditional Access, self-service password reset with writeback, dynamic groups), Intune (device enrolment, compliance policies, remote wipe), Defender for Office 365 Plan 1 (Safe Links, Safe Attachments, anti-phishing) and Defender for Business (endpoint detection and response). Bought separately, those add-ons usually cost more than the gap between Standard and Premium.

• Business Basic — cloud-only, web and mobile apps, for frontline and browser-based roles
• Business Standard — Basic plus installed desktop Office apps, the default for office staff
• Business Premium — Standard plus Entra ID P1, Intune, Defender for Office 365 P1 and Defender for Business

Why Business Premium is usually the right answer, and when it is not

If you have decided to take security seriously — Conditional Access policies, managed devices, phishing protection, the ability to wipe a lost laptop — Business Premium is almost always cheaper than assembling the same capability from add-ons. It is also the plan that makes Cyber Essentials realistic without buying third-party tooling, because device configuration and access control are both covered.

The catch is that Business Premium is only worth the money if you use it. A business that buys Premium and never configures Conditional Access, never enrols a device in Intune and never turns on Safe Links has paid for Standard with extra steps. This is extremely common. If nobody is going to configure it — internally or through a provider — buy Standard and spend the difference on something you will actually operate.

Mixed licensing is legitimate and underused. A 40-person business might run 25 Business Standard, 10 Business Premium for staff handling finance and admin credentials, and 5 Business Basic for warehouse staff. Microsoft permits this within one tenant. The caveat is that certain tenant-wide security features behave inconsistently when only some users are licensed for them — Conditional Access policies, for example, require the targeted users to hold Entra ID P1, so a policy applied to everyone protects only the licensed subset.

The 300-seat limit and what happens when you hit it

Every Microsoft 365 Business plan is capped at 300 seats per tenant. This is a hard limit, and it arrives faster than expected for a growing business. Above 300 you move to Enterprise plans — E3 or E5 — which have no seat cap but a different pricing structure and a different feature layout.

The transition is not merely a price change. E3 brings unlimited archiving, advanced compliance and information protection features Business Premium lacks, but E3 alone does not include Defender for Endpoint at the same level as Defender for Business. Businesses that move from Business Premium to E3 sometimes discover they have downgraded their endpoint security without realising. Plan the move on capability, not on the assumption that E3 is strictly better.

Where small businesses waste money

Licence waste in small businesses is rarely about choosing the wrong tier. It is about drift — licences assigned and never reclaimed, add-ons bought for one project and never cancelled, duplicate products covering the same capability.

A licence audit is a two-hour job that frequently pays for itself immediately. Export the list of licensed users from the Microsoft 365 admin centre, compare it against your current payroll or HR list, and check the last sign-in date for every account. Anything with no sign-in in 90 days is a candidate for removal — after you have confirmed it is not a service account or a mailbox someone still needs delegated access to.

• Licences still assigned to leavers, sometimes for years
• Standalone Entra ID P1, Intune or Defender subscriptions bought on top of Business Premium, which already includes them
• Third-party MDM alongside an unused Intune entitlement
• Full user licences on shared mailboxes that do not need one
• Monthly billing where the seat count is genuinely stable and annual would be cheaper
• Visio and Project licences from a finished project, never cancelled

How to run a licence review that sticks

A one-off audit fixes the backlog; a process stops it recurring. The mechanism that works in a small business is tying licence removal to the off-boarding checklist rather than to a calendar reminder, because off-boarding is the moment the waste is created.

Set a quarterly review in the calendar regardless. Check three things: users with no sign-in in 90 days, the difference between purchased and assigned licences, and any subscription on the billing page nobody can explain. That last one catches more money than the other two combined.