Your Microsoft 365 bill went up this year. We’ve written about that twice, because it kept happening.
Here’s the part that doesn’t get mentioned: for most of the businesses we look at, roughly half of what that bill buys has never been switched on.
Not misconfigured. Not underused. Off. Sitting there, paid for every month, doing nothing.
This isn’t a story about buying something new. It’s a story about the security and management tools that came bundled with the license you already renewed, and why almost nobody turns them on.
First: Which Plan Are You Actually On?
This matters more than anything else in this article, so let’s settle it before we go further.
Almost everything below is included in Microsoft 365 Business Premium. It is not included in Business Standard. Same Word, same Excel, same Teams, same Outlook — but Standard stops at the productivity apps, and Premium adds an entire security and device-management layer on top.
Plenty of Castle Rock businesses are on Standard and assume they have the security features. They don’t. So take thirty seconds and check.
Sign in to the Microsoft 365 admin center and look under Billing at your subscriptions. It will tell you plainly which plan you’re paying for, and how many of each you have. Mixed tenants are common — some businesses have a handful of Premium licenses and the rest on Standard, usually because nobody revisited it after the last hire.
If you’re on Standard, the rest of this article is a description of what upgrading actually buys you. That’s a more useful comparison than any sales sheet, because it’s framed around what each feature prevents.
One honest clarification before the list: being on Standard does not mean your email is unprotected. Every Microsoft 365 plan with a cloud mailbox includes built-in protection that filters spam and known malware. Standard isn’t naked. It just stops at the front door, and the features below are everything past it.
The Security Half You Already Paid For
Conditional Access — stop sign-ins that make no sense
What it does: Lets you write simple if-then rules about who can sign in and under what conditions. If someone tries to reach your email from a country you don’t do business in, block it. If a device isn’t managed by your company, require extra verification or deny it outright.
Microsoft describes these as if-then statements, and that’s genuinely all they are. If a user wants to reach company data, then they must meet a condition you set.
Who needs it: Anyone whose staff all work in Colorado. If nobody on your team should ever be signing in from overseas, a rule that says so is one of the highest-value things you can turn on.
Roughly how long: An afternoon to plan, minutes to enable. The planning matters more than the clicking — a badly written rule locks out your own people, which is exactly why this gets postponed forever.
One limitation worth knowing: Conditional Access runs after the password is entered, not before. It’s a policy gate, not a wall around your tenant.
Defender for Business — real endpoint protection, not just antivirus
What it does: This is enterprise-grade endpoint security, scaled down for businesses under 300 users. It goes well past traditional antivirus. It can investigate an alert on its own, and it can interrupt an attack in progress rather than just flagging it after the fact.
Microsoft built it from the same technology it sells to large enterprises, and it covers Windows, Mac, iOS and Android — so the phones and tablets count too.
Who needs it: Every business with laptops that leave the building. Which is every business.
Roughly how long: A few hours to onboard devices. There are default policies designed to be useful from day one, so you’re not starting from a blank page.
Safe Links and Safe Attachments — catch the link that was clean when it arrived
What it does: Standard email filtering checks a message when it’s delivered. The problem is that attackers know this, so they send a link that’s harmless at delivery and weaponize it an hour later, after it’s cleared the filter and is sitting in an inbox.
Safe Links re-checks the destination at the moment someone clicks it. Safe Attachments opens attachments in an isolated environment first to see what they actually do.
Who needs it: Anyone who has watched a convincing invoice email land in the wrong inbox. This is the single feature most likely to stop the phishing attempt that would otherwise work.
Roughly how long: Under an hour. This is the best effort-to-protection ratio on the entire list.
Intune — the “she left and still has email on her phone” fix
What it does: Device management. Require a PIN on any phone that touches company email. Remotely wipe a lost laptop. Remove company data from a departing employee’s personal phone without touching their photos.
Who needs it: Any business where staff read work email on personal phones. That’s most of them, and it’s usually the biggest unmanaged gap we find.
Roughly how long: Start with phones and email access only — a day or so. Full device management is a longer project, but you get most of the benefit early.
Business Premium includes the base Intune plan. Some advanced add-ons like Remote Help are sold separately, so don’t expect every feature you’ll read about online.
Basic data protection and retention
What it does: Lets you set rules about how long email and files are kept, and flag or restrict sensitive information like credit card and Social Security numbers moving where it shouldn’t.
Who needs it: Anyone handling regulated data, and anyone who’s realized their retention policy is currently “we keep everything forever.”
Roughly how long: Varies. A simple retention policy is quick.
Be clear-eyed here: what’s bundled is entry-level. Deeper compliance tooling is a separate paid add-on. It’s a solid floor, not a full compliance program, and anyone who tells you otherwise is selling something.
And a Couple You’d Actually Enjoy
It isn’t all security. Bookings gives clients a page to schedule time with you and syncs to your calendar — it quietly eliminates the four-email back-and-forth about Tuesday. Shifts in Teams handles scheduling for hourly staff.
Neither is life-changing. Both are already paid for, and take about twenty minutes.
So Why Is All of This Switched Off?
Because it isn’t anyone’s job.
These features don’t turn themselves on. They ship disabled, by design — Microsoft can’t know your countries, your devices, or your risk tolerance. Someone has to make decisions and enable them deliberately.
The admin center isn’t built for a business owner with twelve other priorities. It’s built for IT administrators. Everything above is genuinely findable, and none of it is self-explanatory when you’re between a payroll run and a client call.
And there’s a real fear underneath, which we hear constantly: turn on the wrong setting and you lock out your own staff on a Monday morning. That fear is reasonable. It’s also why “we’ll get to it” turns into three years.
None of this is a failure on your part. It’s what happens when powerful tools are bundled into a product bought for email and Word.
What to Do This Week
You don’t need to enable everything. Do this much:
Confirm your plan. Admin center, Billing, subscriptions. Premium or Standard. Everything else depends on the answer.
If you’re on Premium, pick one thing. Safe Links. Best protection for the least effort, and the least likely to disrupt anyone’s day.
If you’re on Standard, price the gap honestly. Compare the upgrade cost against what a single successful phishing attack would cost you in downtime and recovery. For most businesses the math is not close.
If you’d rather not do this between meetings, that’s the work we do. We audit Microsoft 365 tenants for businesses across Castle Rock and the Denver metro, and this is consistently what we find — good tools, fully paid for, never switched on. We’ll tell you which plan you’re on, what’s dormant, and what order to turn it on in so nothing breaks.
Get in touch for a Microsoft 365 review, and let’s find out what you’ve already bought.
