You opened the July invoice and the number was bigger than June’s. Same number of employees, same plans, same everything — just more money.
You’re not imagining it, and it’s not a billing error. On July 1, 2026, Microsoft’s new commercial pricing took effect across most Microsoft 365 Business and Enterprise plans. It was announced back in December 2025, which means it probably landed in an inbox seven months ago and got buried under everything else.
Here’s the part nobody sends a follow-up email about: the increase came with real additions to your plan. Most of them are security features. And in our experience helping businesses around Castle Rock and the south Denver metro, a lot of those features are sitting there switched off.
Let’s fix that.
What actually changed on July 1
The two plans most small businesses run on both went up:
- Microsoft 365 Business Basic: $6 to $7 per user, per month
- Microsoft 365 Business Standard: $12.50 to $14 per user, per month
Enterprise plans like E3 and E5 and the Frontline F-series moved too. If you’re on an annual commitment, you likely saw the change at your renewal date rather than on July 1 exactly.
For a 20-person office on Business Standard, that’s about $360 more per year. Not nothing. Not a crisis either — but worth knowing what you bought.
What you’re paying for now
Microsoft didn’t just raise the price. The same update pushed several features down into plans that didn’t have them before.
Time-of-click link protection
This is the big one, and it’s now included in Business Basic and Business Standard.
Previously, a link in an incoming email got scanned once — when the message arrived. Attackers figured that out years ago. They send a clean link, wait for it to clear the filter, then swap the destination to a credential-harvesting page a few hours later. Your filter said the email was safe. By the time your bookkeeper clicks it on Thursday afternoon, it isn’t.
Time-of-click protection re-checks the link at the moment someone clicks it, not just when it lands. If the destination has gone bad in the meantime, the click gets blocked.
This is a genuine upgrade to your phishing defense, and it used to require a paid add-on.
An extra 50 GB of mailbox storage
Mailboxes on Basic, Standard, and Premium are moving from 50 GB to 100 GB. If your team has been getting “your mailbox is almost full” warnings — or worse, quietly failing to receive mail — that problem should resolve itself.
It also means you may no longer need to pay for a separate Exchange Online Plan 2 license just to get mailbox headroom.
Defender for Office 365 Plan 1 capabilities on E3
If you’re on an Enterprise E3 plan, you now get Defender for Office 365 P1 — real anti-phishing policies, attachment sandboxing (Safe Attachments), and Safe Links across Teams and Office apps, not just Outlook.
That’s a line item plenty of businesses were paying for separately.
Copilot Chat with admin controls
Your team almost certainly has people using AI tools already. The update gives you actual governance over Microsoft’s version — who can use it, what data it can reach, and what gets logged.
If you’ve been nervous about employees pasting client information into a random AI chatbot, this gives you a sanctioned option you can actually manage.
Three things to check this week
Here’s the frustrating part. Some of these protections roll out to everyone by default. Others need someone to go turn them on, or they sit there doing nothing while you pay for them.
1. Confirm the built-in protection policy is applied to every user. Microsoft’s preset security policies cover Safe Links, Safe Attachments, and anti-phishing. They’re meant to apply to all users by default — but if your tenant has custom mail flow rules or exclusions someone set up years ago, people can fall outside the policy without anyone noticing.
2. Verify time-of-click protection is actually active in Outlook. The rollout ran from mid-June through early August 2026. It should be live in your tenant. Have someone check rather than assume.
3. Decide your Copilot Chat position before your staff decides it for you. Either enable it with controls in place or explicitly turn it off. Leaving it undefined is the worst of the three options.
None of these require a project. They’re a single conversation with whoever handles your IT — internal or outsourced. If you have an MSP, this is a fair thing to ask them to confirm in writing.
So is it still worth it?
Honestly — yes, if you use what you’re paying for.
The security features that moved into Business Basic and Standard would cost more as standalone add-ons than the price increase itself. Businesses that had been buying phishing protection separately effectively came out ahead.
But that math only works if the features are turned on. A protection policy that’s misconfigured or excluded costs exactly as much as one that’s working, and defends exactly nothing. That’s the scenario worth avoiding.
The businesses that get burned by a price increase aren’t the ones who paid more. They’re the ones who paid more and never found out what they got.
Not sure what’s switched on in your tenant?
Castle Rock Sky works with small and medium businesses across Castle Rock, Parker, and the Denver metro to make sure the Microsoft 365 licenses you’re already buying are doing the job you’re paying them for.
We’ll review your tenant, tell you which protections are active, which are sitting idle, and whether your current plan is still the right fit after the July changes. No obligation, no sales pressure — just a clear picture of what you have.
