Microsoft 365 isn't one product but a basket of plans, and most businesses choose based on what the salesperson offered rather than what they actually need. The gap between the plans is mostly security and device management, not mailbox size. We are a Microsoft Partner in Israel, and we see these mistakes every week.
What each plan actually gives you
Before talking about money, it helps to know what you actually get. Business Basic gives you Exchange email, Teams, SharePoint and OneDrive, with Office apps in the browser and on mobile only. Business Standard adds the Office apps installed on the desktop, plus webinars and meeting scheduling tools. Business Premium takes Standard and adds a layer of security and management: Intune for device management, advanced Entra ID capabilities such as conditional access, and Defender for email and endpoints. Enterprise plans are for organizations that have passed the 300-user ceiling of Business, or that need more detailed compliance and policy tools.
Notice one thing. The difference between the plans is almost always in security and management, not in the number of apps. That is also where businesses get it wrong, because with security it is hard to see what is missing until something happens.
| Plan | What you get | Who it is for |
|---|---|---|
| Business Basic | Email, Teams, SharePoint, OneDrive and Office in the browser | A small team that works in the cloud and does not need Office installed |
| Business Standard | Everything in Basic, plus Office installed on the computer | A business that works with large files and desktop Office |
| Business Premium | Everything in Standard, plus Intune, conditional access and Defender | A business of up to 300 employees that wants control and security |
| Enterprise E3 | Licensing for large organizations, archiving and broad compliance policies | An organization with over 300 employees or compliance requirements |
| Enterprise E5 | Everything in E3, plus advanced protection, identity and analytics | An organization that needs advanced security and threat investigation |
A mailbox is not a license
This is the most common mistake we see. A license is assigned to a person and lets them sign in and use the services. A mailbox is an address. Some mailbox types need no license at all.
- User license. For every employee who signs in, reads mail and uses apps.
- Shared mailbox. An address for a team, such as inquiries or billing, with no personal login and no license.
- Alias. An extra address that lands in the same existing mailbox, at no cost.
- Resource mailbox. A meeting room or equipment booked straight from the calendar.
The impact on the bill is direct. A company with 22 employees can run on 22 licenses plus a few shared mailboxes at no cost, or pay for 27 licenses without anyone noticing. When we take over a new tenant, this is the first thing we count.
What you pay for and never use
Almost every tenant we step into has a layer that is paid for and never touched. Not out of negligence, but because someone bought a big bundle at a discount and nobody came back to check a year later.
- A plan with installed Office, for employees who only work in the browser.
- An Enterprise license at a 40-person company that needed Business Premium.
- Telephony inside Teams, with no numbers and nobody ever set it up.
- A data analytics tool included in the big bundle that nobody ever opened.
- OneDrive sitting unused, because all the files still live on a local server.
- Licenses still active for employees who left six months ago.
The review itself is simple. We look at the actual sign-in activity of every seat over the last 30 days, then decide what to trim and what to swap for a better-fitting plan.
Why Business Premium is usually the answer
For a small or midsize business that holds data that must not leak, Premium is usually the right choice. Not because of the mailbox, but because of what it lets you do with employees' devices and identities.
- Device management. Intune enforces encryption, screen lock and up-to-date versions, and lets you wipe a lost phone remotely.
- Conditional access.
Conditional AccessBlocks sign in from an unapproved device or location, and requires two step verification for everyone. - Email and endpoint protection. Defender checks links and attachments before an employee clicks them.
- Data classification. Documents can be marked internal so they cannot be forwarded outside the company.
The simple way to decide is to ask who touches the data. If you have accounting, payroll, contracts or customer details in mailboxes and files, you need the management layer. If the team only works with public information, you can get by with less and add Premium only for those who need it.
The right plan for you is the one that covers devices, identity and email, not the one that appears first in the comparison table. The per-user price changes often, so we check it against current licensing when preparing your quote rather than quoting a number from memory.
What Microsoft does not back up for you
Microsoft is responsible for the infrastructure and the availability of the service. It is not responsible for your mistakes. A deleted item can be recovered for a limited time, and after that it is gone. A retention policy is not a backup, and it cannot restore a folder to how it looked on a given date.
That is why every one of our clients gets a separate backup for email, SharePoint, OneDrive and Teams files, with long-term retention and the ability to restore an entire mailbox or folder to its state on a specific day. This is what saves you when an employee deletes something by mistake, leaves on bad terms, or ransomware encrypts synced files.
- Email, calendars and contacts for every mailbox, including shared mailboxes.
- SharePoint libraries and all personal OneDrive folders.
- Teams files and channel conversations, which actually live in SharePoint.
- A real restore test once a quarter, because an untested backup is just an assumption.
The recycle bin is not a backup, and it will not help when you need to recover a folder deleted three months ago.
Migrating from another email provider
Most businesses that come to us are moving from Gmail, an on-premises Exchange server or a hosting provider's email. The migration does not have to be dramatic, but it does have to be orderly.
- We map every mailbox, alias, distribution list and resource mailbox that exists today.
- We set up the new environment and verify the domain, without changing mail routing yet.
- We run a pilot migration on 2 or 3 mailboxes and confirm everything arrived in full.
- We sync all mailboxes in the background, including folders, contacts and calendars.
- We switch the mail records at a quiet time, usually over the weekend.
- We keep the previous provider active for a few more weeks, just to be safe.
- We update the computers and phones and make sure signatures, scanners and printers are back in action.
With us guiding the move, email downtime is measured in minutes, not hours, and we stay available throughout the transition. We switch mail routing only after the sync is complete and verified, so there is never a moment when a message slips through the cracks.
Licenses when an employee joins and when one leaves
Licensing is not a one-time purchase, it is an ongoing process. Without a clear procedure the count only grows, because adding a license takes a minute and nobody remembers to remove one.
- New employee: create the user, assign a license based on the role and add them to the right groups.
- Departing employee: block sign-in the same day, not at the end of the month.
- Convert their mailbox to a shared mailbox to preserve the history, then remove the license.
- Transfer their files to the new owner before deleting the account.
- Once a quarter, review every license and compare it against the actual employee list.
AtIT management dashboard that we build for every client, you see licenses, mailboxes and seats by employee on one screen, so the quarterly review takes minutes instead of a full workday.
FAQ
What is the difference between Business Standard and Business Premium?
Standard gives you the desktop Office apps and the cloud services. Premium adds device management with Intune, conditional access, and protection for email and endpoints with Defender. If you handle sensitive data or have people working from home, it is the difference between hoping and being in control.
How much does a license cost per employee?
The price per employee depends on the plan, the number of seats and the commitment type, and Microsoft updates it from time to time. That is why we do not publish a number. Instead, we check the current licensing price while preparing your quote. As a Microsoft Partner in Israel, we have direct access to licensing and support.
Do you need an external backup for Microsoft 365?
Yes. Microsoft guarantees the service will be available, not that you can recover what was deleted. Deleted items can be restored for a limited time only, and after that they are gone. We add a separate backup for email, files and Teams content.
Can you mix different plans in the same company?
Yes, and it is common. Office staff get Business Premium, while employees who only check email get a lighter plan. What matters is that anyone with access to sensitive data gets the full protection layer.
How long does a migration from Gmail take?
Mapping and preparation take a few days, and the sync itself runs in the background depending on mailbox volume. We switch mail routing during a quiet hour, and employees usually only notice their software being reconfigured. We guide every step and are available 24/7 during the migration.
Related to: Managed IT services · IT management dashboard · Licensing and software · Talk to us