The Microsoft 365 invoice is usually one of the biggest IT cost lines in a company, and nobody reviews it seriously. The licences were bought several years ago when the company was a different size, some employees have since left, some changed roles, and the plan stayed the same. The finance director sees only the total, and whoever is responsible for IT sees only that “everything works.”
In our experience, when we review a new customer’s Microsoft 365 tenant we almost always find at least a few licences being paid for needlessly: inactive accounts, a plan that is too expensive for someone who only needs email, or the opposite, a company paying for a cheap plan and separately for third-party security tools that Business Premium already includes.
In this article we explain how the plans differ, who really needs which one and how to organise licensing so that it fits the company, not the other way around. We do not quote prices here. They change, while the principles stay.
How the Business plans differ
Business plans are for companies with up to 300 users. There are three, and the difference between them is not just “more features.”
- Business Basic: cloud services only. Exchange email, Teams, OneDrive, SharePoint and Office apps in the browser. There are no desktop Word or Excel installations.
- Business Standard: everything in Basic, plus the full Office apps for desktop and mobile. This is the most common plan for office staff.
- Business Premium: everything in Standard, plus a security and management layer: Intune device management, Defender for Business, Entra ID P1 with Conditional Access and Microsoft Purview information protection.
The practical difference: if an employee only reads email and joins Teams meetings, Basic is enough. If they work in Excel or Word every day, they need Standard. And if you want company computers and phones managed centrally, access to email to depend on device health and location, and the ability to wipe data remotely from a lost phone, that is Premium. Many companies cover security requirements by buying separate products, even though Premium already includes them.
When you need Enterprise plans
E3 and E5 are for companies that go beyond the 300-user limit, or those that need features Business plans do not have.
E3 gives you what Business Standard has, plus larger mailboxes, unlimited archive, Windows Enterprise, Intune and broader Microsoft Purview capabilities. E5 adds the full Defender suite (identity, email, endpoint and cloud protection), Entra ID P2 with privileged access management, Teams Phone and Power BI Pro.
A common mistake is a smaller company buying E3 “for security” when Business Premium would give it a similar level of security, and in some respects more. Another mistake is E5 for everyone, when the E5 features are really needed only by IT and finance.
Who actually needs what
Instead of buying one plan for everyone, group employees by the kind of work they do. It is a simple table worth filling in with department heads.
| Employee type | What they need | Suitable plan |
|---|---|---|
| Production, warehouse, customer service | Email, Teams, shift schedules | Business Basic or F3 |
| Office employee | Email, Office apps, files | Business Standard |
| Employee with sensitive data or remote work | The same plus device management and security | Business Premium |
| Finance, management, IT administrators | Advanced protection, privileged access | E5 or Premium with add-ons |
| Shared mailboxes, conference rooms | Just a mailbox | Free shared mailbox, no licence needed |
The last row matters: info@, invoices@, sales@ and similar mailboxes can be shared mailboxes and need no licence as long as they stay under 50 GB and are accessed through a licensed user. In our experience this is one of the most common sources of overpayment, with shared mailboxes created as full users.
Unused licences and former employees’ accounts
The Microsoft 365 admin centre has a report on active users over the last 30, 90 and 180 days. It is worth opening at least once a quarter. An account that has not signed in to email, Teams or OneDrive for 90 days is almost always either a former employee or a technical account that does not need a licence.
Former employees are a separate problem. The right process is this: the account is blocked, the mailbox is converted to a shared mailbox (so a manager or colleague can see the history), OneDrive files are handed to the manager, and the licence is removed and assigned to a new employee. The wrong process is leaving the account active with a licence “so the emails don’t disappear,” and doing so for months. Besides the needless cost, it is also a security gap: a former employee can still sign in.
This process should be an agreement between HR and IT, not an accident. If we administer your Microsoft 365, the offboarding procedure is a standard part of the Microsoft 365 administration service and is carried out the same day.
Mixed licensing is normal, not an exception
There is a belief that all users in a company must have the same plan. They do not. One tenant can combine Business Basic, Standard, Premium and even Enterprise plans, along with individual add-ons. The only limit is that you cannot have more than 300 seats of Business plans.
A practical example from a manufacturing company: 40 office employees on Business Standard, 12 managers and finance staff on Business Premium, and 120 production workers on the F3 plan for shift schedules and internal communication in Teams. Instead of one plan for everyone, the company pays for what each group uses.
Add-ons are also valuable: Entra ID P1 or Defender for Office 365 can be added to a Standard plan for only the users who need them, instead of moving everyone to Premium. There is a limit, though. Once several add-ons pile up, Premium often becomes the simpler and cheaper option. That has to be calculated case by case.
The annual review: what to check
Licences are bought on annual contracts, so the natural review point is two months before renewal. At that time you can still reduce quantities and change plans without extra commitments. During the review we check:
- Accounts inactive for 90 days and their licences.
- Full users that are really shared mailboxes or conference rooms.
- Users on Standard or Premium who have not opened the Office apps in a quarter.
- Third-party security and device management tools whose functions Premium already includes.
- Employees whose roles have changed and who need more or less than their plan provides.
- The security state of the tenant. Overpaying for licences while not turning on what you pay for is the most common combination.
The last point is a separate topic, but it is worth mentioning: a Business Premium tenant without Conditional Access and Intune policies turned on is a Standard tenant at a Premium price. We write about this in the Microsoft 365 security service description.
Where to start
Getting licensing in order does not need a big project. A few steps you can finish within a week are enough.
- Download the report of active users and assigned licences from the admin centre and compare it with the HR list. The mismatches will be obvious.
- Split employees into 3 to 4 groups by the kind of work they do and assign each a plan based on need, not habit.
- Convert shared mailboxes and rooms to shared objects without licences.
- Agree an offboarding procedure with HR: who blocks the account, when and how, and who frees up the licence.
- Put the review in your calendar for two months before the contract renews.
If you want us to do this work, a Microsoft 365 licence review is the first step of working together: we count what you have, what you use and what can be changed, and then take over the licences and their management as an ongoing service.
