Microsoft 365 Security: What Each Plan Includes and the CISA Settings That Matter

By The Uptime Report Team · Last reviewed: October 2026

Microsoft 365 security is a shared job: Microsoft runs the datacenters, and you configure identities, devices and data. Business Premium ($22.00 per user per month) adds Conditional Access, Intune and Defender for Business; Basic and Standard rely on security defaults.

What is Microsoft 365 security, and which part is your job?

Microsoft 365 security is the set of identity, email, device and data controls built into Microsoft’s productivity suite, plus the configuration work that stays with the customer. Microsoft’s shared responsibility model gives Microsoft the physical datacenter, network and hosts, and says customers always retain four duties: data, endpoints, accounts and access management, including MFA and Conditional Access policies.

The split matters because the controls that stop most account takeovers sit on the customer side. Microsoft’s security defaults documentation states that “more than 99.9% of those common identity-related attacks are stopped by using multifactor authentication and blocking legacy authentication.” Its legacy authentication guidance adds that more than 97% of credential stuffing attacks and more than 99% of password spray attacks use legacy protocols.

Identity is one entry route among several. In our analysis of ransomware initial access vectors, phishing (MITRE ATT&CK T1566) appeared in 13 of the 22 CISA #StopRansomware advisories that list initial access techniques (59%), and valid accounts (T1078) in 10 (45%). Phishing lands in mailboxes, which is where Exchange Online Protection and Defender for Office 365 apply.

Which security features come with each Microsoft 365 plan?

Every Microsoft 365 business plan includes Entra ID Free with security defaults, built-in anti-malware, anti-spam and spoofing protection for cloud mailboxes, and Basic Mobility and Security for phones. Business Premium, at $22.00 per user per month, is the first base tier to add Entra ID P1, Defender for Office 365 Plan 1, Intune Plan 1 and Defender for Business, per Microsoft Learn and Microsoft’s price pages as of October 2026.

Two cells need a note. Defender for Office 365 Plan 1 joined Microsoft 365 E3 “effective July 1, 2026”, per the service description. Microsoft’s business plan comparison lists “URL time-of-click protection” for Basic and Standard, while the Learn overview lists Defender for Office 365 only for Premium, so treat Basic and Standard as built-in protection only.

Add-on list prices, per user per month on annual terms, as of October 2026:

• Entra ID P1 costs $7.00 and Entra ID P2 costs $10.00 (Microsoft Entra pricing).
• Defender for Office 365 Plan 1 costs $2.00 and Plan 2 costs $5.00 (Microsoft Defender for Office 365).
• Defender for Business costs $3.00, for organizations with up to 300 users (Microsoft Defender for Business).
• Intune Plan 1 costs $8.00 (Microsoft Intune).
• Defender Suite for Business Premium costs $10.00 and adds Entra ID P2, Defender for Identity, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2 and Defender for Cloud Apps (Microsoft, Microsoft Learn).
• Microsoft Defender Suite for enterprise plans costs $12.00 and requires Microsoft 365 E3, or Office 365 E3 plus Enterprise Mobility + Security E3 (Microsoft).

The 300-seat limit is shared across the Business family of plans: Microsoft’s pricing FAQ says 250 Business Premium seats leave room for only 50 more seats of any Business plan, so mixed tenants hit the ceiling sooner than the per-plan pages suggest. Our Microsoft 365 business plans comparison covers the non-security differences between the tiers.

Is Business Premium cheaper than adding security to Business Standard?

Yes, at Microsoft’s list prices. Business Standard at $14.00 plus Entra ID P1 ($7.00), Intune Plan 1 ($8.00), Defender for Business ($3.00) and Defender for Office 365 Plan 1 ($2.00) comes to $34.00 per user per month. Business Premium bundles the same four security components for $22.00, a $12.00 gap that adds up to $3,600.00 a year for a 25-user tenant.

Three things move these numbers: no-Teams versions cost less (Business Premium $18.79, Business Standard $10.79, per Microsoft), Business Premium with Copilot costs $32.00, and monthly billing costs 20% more ($26.40 against $22.00 for Business Premium).

Business Premium also carries items the add-on stack does not, including Purview Information Protection Plan 1 and data loss prevention for email and files, per Microsoft’s plan comparison table. Those two matter for MS.DEFENDER.4.1v2, the CISA policy that requires a DLP rule blocking credit card numbers, ITINs and Social Security numbers.

Are security defaults enough, or do you need Conditional Access?

Security defaults fit tenants without Entra ID P1: for organizations with P1 or P2 licenses, Microsoft says they are “probably not right”. They switch on six controls at no extra cost, including MFA registration for every user and blocking legacy authentication. Conditional Access needs Entra ID P1, handles exclusions, device compliance checks and phishing-resistant MFA rules, and Microsoft requires security defaults to be off before it takes over.

The six controls security defaults turn on, per Microsoft Learn:

• All users must register for multifactor authentication.
• Administrators must perform multifactor authentication.
• Users perform multifactor authentication when Microsoft judges it necessary.
• Legacy authentication protocols are blocked.
• Device code flow is blocked.
• Privileged activities, such as access to the Azure portal, are protected.

After registration, 16 administrator roles, from Global Administrator to Identity Governance Administrator, must complete MFA at every sign-in. Since July 29, 2024, users no longer get a 14-day window to register; Microsoft removed it because “MFA can block over 99.2% of identity-based attacks.” Tenants created on or after October 22, 2019 may already have security defaults on, per the same Microsoft page.

Risk-based Conditional Access and Privileged Identity Management (PIM) need Entra ID P2, per Microsoft Entra licensing. When security defaults go off, Microsoft offers managed Conditional Access policies that keep legacy authentication blocked and MFA required for admins, Azure management and all users.

Method strength is where the plans split. Conditional Access authentication strengths come in three built-in levels, Multifactor authentication, Passwordless MFA and Phishing-resistant MFA, and using them needs Entra ID P1. Under security defaults, Microsoft’s licensing page says “only Microsoft Authenticator can be used for the authentication prompt”, so a Basic or Standard tenant cannot require the FIDO2 keys, Windows Hello for Business or certificate-based authentication that CISA’s MS.AAD.3.1v1 names without adding P1.

What do CISA’s SCuBA baselines require for Microsoft 365?

CISA’s Secure Cloud Business Applications (SCuBA) project publishes secure configuration baselines for Microsoft 365, and Binding Operational Directive 25-01, issued December 17, 2024, made their SHALL policies mandatory for federal civilian executive branch agencies. CISA’s required configurations page lists 50 Microsoft 365 policies. Private companies are not bound, but CISA “strongly recommends all stakeholders implement these policies.”

The 50 mandatory policies split by product, per CISA’s BOD 25-01 required configurations page:

• Entra ID: 20 policies, MS.AAD.1.1v1 to MS.AAD.7.8v1.
• Exchange Online: 10 policies, MS.EXO.1.1v2 to MS.EXO.13.1v1.
• Defender: 8 policies, MS.DEFENDER.1.1v1 to MS.DEFENDER.6.1v1.
• Power Platform: 4 policies, MS.POWERPLATFORM.1.1v1 to 3.1v1.
• SharePoint and OneDrive: 4 policies, MS.SHAREPOINT.1.1v1 to 2.2v1.
• Teams: 4 policies, MS.TEAMS.1.2v2 to 4.1v1.

BOD 25-01 required agencies to implement the mandatory policies by June 20, 2025, and the required configurations page now lists each policy’s due date as the end of each fiscal quarter; the timeline below holds the other dates.

One wording gap matters for auditors. CISA’s required configurations page words MS.EXO.1.1v2 as automatic forwarding to external domains that “SHALL only be enabled on a per-domain basis”, while the v1.8.0 Exchange Online baseline says such forwarding “SHALL be disabled”. Document which reading your tenant follows.

ScubaGear is CISA’s free, open-source (CC0) PowerShell tool that checks a tenant against these baselines and reports in HTML, JSON and CSV; version 2.0.0 was released on October 22, 2026, and the license notes quoted on this page come from the version 1.8.0 baseline documents. The v1.8.0 interactive permissions page asks for a Global Reader account (Power Platform Administrator with a Power Apps for Office 365 license for the Power Platform checks) plus admin consent for Microsoft Graph PowerShell, and describes no delegated multi-tenant mode, so budget one run per client tenant.

ScubaGear 2.0.0 also lists changes that, per its release notes, “affect current BOD 25-01 Required Configurations”, although CISA’s required configurations page still showed the 50 policies above on October 26, 2026:

• The Defender baseline is retired: MS.DEFENDER.1.1v1 to 1.5v1, 4.1v2, 5.1v1 and 6.1v1 move to a new Security Suite baseline as MS.SECURITYSUITE.1.1v1 to 1.3v1, 3.1v1 (DLP), 4.1v1 (alerts) and 5.1v1 (unified audit logging), plus new 6.1v1 and 6.2v1 on spam handling.
• New SHALL policies: MS.AAD.3.5v2 (disable SMS, voice and email one-time passcodes), MS.AAD.9.1v1 (block risky AI agents, which needs Entra ID P2 plus Microsoft Agent 365 or Microsoft 365 E7) and four SharePoint policies (MS.SHAREPOINT.1.3v1, 3.1v1, 3.2v1, 3.3v2).
• Version bumps: MS.AAD.3.2v2 now requires MFA for all users regardless of 3.1v1, and MS.EXO.2.2v3 accepts SPF soft fail (~all).

When CISA’s page adopts these changes, the mandatory Microsoft 365 list grows from 50 to 56 policies (8 Defender policies out, 8 Security Suite, 2 Entra ID and 4 SharePoint policies in). The counts on this page use the list as CISA publishes it today.

Which SCuBA policies does a new tenant meet by default?

By our mapping of Microsoft’s documented defaults, six mandatory SCuBA policies are met in a new Business tenant with security defaults on: MS.AAD.1.1v1, MS.AAD.3.2v1, MS.AAD.6.1v1, MS.EXO.5.1v1, MS.EXO.13.1v1 and MS.TEAMS.1.2v2. Enterprise tenants add a seventh, unified audit logging (MS.DEFENDER.6.1v1), which is off by default in Business Basic, Standard and Premium. That leaves 43 or 44 of the 50 to configure or license.

• Legacy authentication blocked and MFA registration required for all users (MS.AAD.1.1v1 and, on a lenient reading, MS.AAD.3.2v1, since security defaults prompt users for MFA only when necessary rather than at every sign-in): both are security defaults controls, on in many tenants created on or after October 22, 2019 (Microsoft Learn, security defaults). Device code flow blocking, also a default, matches MS.AAD.3.9v1, a SHOULD policy.
• Passwords never expire (MS.AAD.6.1v1): “By default, passwords never expire for your organization” (Microsoft Learn, password expiration).
• SMTP AUTH disabled (MS.EXO.5.1v1): “If security defaults is enabled in your organization, SMTP AUTH is already disabled in Exchange Online” (Microsoft Learn, SMTP AUTH).
• Anonymous users cannot start meetings (MS.TEAMS.1.2v2): the Teams setting “Anonymous users and dial-in callers can start a meeting” defaults to Off (Microsoft Learn, Teams policy reference).
• Mailbox auditing (MS.EXO.13.1v1): “Mailbox audit logging is turned on by default in all organizations” (Microsoft Learn, mailbox auditing).
• Unified audit logging (MS.DEFENDER.6.1v1): on by default for Microsoft 365 organizations, but “Auditing isn’t enabled by default for Small and Medium Business (SMB) licenses, including Microsoft 365 Business Basic, Business Standard, and Business Premium” (Microsoft Learn, turn auditing on or off).
• Standard and Strict preset email policies (MS.DEFENDER.1.1v1): Microsoft says that on a first visit “it’s likely that Standard protection and Strict protection are turned off” (Microsoft Learn, preset policies).
• Phishing-resistant MFA (MS.AAD.3.1v1 and 3.6v1): security defaults cannot require it, because the prompt is limited to Microsoft Authenticator (Microsoft Entra licensing).

How many of the 50 can each plan meet?

Mapping CISA’s license notes to Microsoft’s plan tables, 14 of the 50 mandatory policies depend on a feature that Business Basic and Business Standard lack, and 7 depend on Entra ID P2, which Business Premium and Microsoft 365 E3 lack, when you follow CISA’s documented method. None are blocked for Microsoft 365 E5 or for Business Premium with the Defender Suite add-on. This is our count from public documents, not a CISA figure.

Three caveats narrow the gap, each documented in the baselines or by Microsoft:

• The Defender baseline says a third-party email security product can meet the Defender for Office 365 policies (MS.DEFENDER.1.3v1 and 1.5v1), which cuts Basic and Standard from 14 to 12.
• Security defaults already block legacy authentication and require MFA, even though CISA’s instructions for MS.AAD.1.1v1 and MS.AAD.3.2v1 use Conditional Access; counted that way, Basic and Standard fall from 12 to 10.
• The Entra ID baseline accepts a third-party privileged access management product for MS.AAD.7.4v1 to 7.8v1, which takes Basic and Standard from 10 to 5 and Business Premium and Microsoft 365 E3 from 7 to 2.
• What no alternative removes: MS.AAD.2.1v1 and 2.3v1 (risk-based blocking, Entra ID P2) in every plan below E5 or the Defender Suite, plus MS.AAD.3.1v1, 3.6v1 and MS.DEFENDER.4.1v2 in Basic and Standard.

How does Microsoft 365 Lighthouse’s default baseline map to CISA’s policies?

Microsoft 365 Lighthouse, the free multi-tenant portal for CSP partners, assigns a default baseline to every active tenant as its deployment plan. Mapping the default-baseline tasks Microsoft documents against the 50 mandatory SCuBA policies, the baseline fully covers 2 (MS.AAD.1.1v1 and MS.AAD.3.2v1), partly covers 6 and has no documented task for the other 42. The baseline is weighted to devices, which CISA’s mandatory list does not cover at all.

Lighthouse has “no additional costs” for partners, per the Lighthouse FAQ, but each managed tenant must have GDAP or DAP delegated access, at least one Business, Enterprise, Frontline or Education subscription, no more than 2,500 licensed users and the same geographic region as the partner, per the requirements page. Microsoft does not publish the full task list on Learn; the task names below come from the Lighthouse What’s new log, FAQ and baseline overview.

The 42 mandatory policies with no documented default-baseline task, by product:

• Entra ID, 17: risk-based blocking (MS.AAD.2.1v1, 2.3v1), phishing-resistant MFA for all users (3.1v1), Authenticator context (3.3v2), methods migration (3.4v1), app registration and consent (5.1v1 to 5.3v1), password expiry (6.1v1) and all eight privileged-role policies (7.1v1 to 7.8v1).
• Defender, 3: the DLP rule (MS.DEFENDER.4.1v2), alerts (5.1v1) and unified audit logging (6.1v1).
• Exchange Online, all 10, from external forwarding (MS.EXO.1.1v2) and DMARC p=reject (4.2v1) to SMTP AUTH (5.1v1) and mailbox auditing (13.1v1).
• Power Platform 4, SharePoint and OneDrive 4, and Teams 4.

Two licensing details change what Lighthouse can do in a given tenant. Lighthouse marks tasks the tenant is not licensed for as ineligible, per its baseline documentation, and the admin MFA sub-task creates a Conditional Access policy, so expect it to show Not licensed in tenants without Entra ID P1. Lighthouse alerts also exclude Defender for Office 365 and Defender for Cloud Apps, per the alerts overview. On devices, Microsoft notes that Defender Antivirus is enabled by default on Windows 10 and later, which is the only device protection present before the baseline runs (Lighthouse requirements).

What should an MSP put in the contract and the quote?

Write the contract around policy IDs and licenses, not around “Microsoft 365 security”. Name which of the 50 mandatory SCuBA policies you maintain, which license each promised control needs, how often you re-check with ScubaGear and Secure Score, and which services sit outside the baseline. Then match the client’s contract term to the license term, because annual new commerce seats cannot be cancelled after day seven.

• Scope by policy ID. State that the Lighthouse default baseline covers MS.AAD.1.1v1 and 3.2v1 and that the other 48 are configured by script or by hand, with current ScubaGear reports attached as evidence.
• Name the license behind each control. Conditional Access needs Entra ID P1 ($7.00, or Business Premium at $22.00); risk-based blocking and PIM need Entra ID P2 ($10.00, or the $10.00 Defender Suite for Business Premium).
• Check audit logging at onboarding. Run Get-AdminAuditLogConfig in Exchange Online PowerShell and confirm UnifiedAuditLogIngestionEnabled is True, since Business tenants start with it off (Microsoft Learn). For healthcare clients, 45 CFR 164.312(b) makes audit controls a HIPAA Security Rule standard.
• Price the term. Microsoft lists Business Premium at $22.00 per user per month on an annual commitment and $26.40 on a monthly subscription (Microsoft), and new commerce subscriptions “can only be canceled in the first seven days of their term” (Partner Center).
• Quote backup and alert response as separate lines. None of the 50 policies restores deleted or encrypted data, which is the job of Microsoft 365 backup, and round-the-clock triage of Defender alerts is a managed detection and response service, not a baseline setting.

The billing term is a break-even question. A seat billed monthly at $26.40 costs $158.40 if the client leaves after 6 months, against $264.00 committed on the annual term ($22.00 x 12). The two meet at 10 months, and a seat kept all 12 months costs $316.80 monthly. For a client likely to stay under 10 months, monthly seats cost less even at the higher rate.

What are the Microsoft 365 security best practices, in order?

Start with identity, then email, then sharing and logging, and measure the result with free tools. The ten steps below group CISA’s baseline policies and Microsoft’s guidance by area, and each names the setting or SCuBA policy ID to check. Steps that need Conditional Access or Defender for Office 365 say so; the rest work in every Microsoft 365 plan.

1. Fix admin accounts first. Keep two cloud-only emergency access accounts, as Microsoft recommends, and 2 to 8 Global Administrators in total (MS.AAD.7.1v1); give everyone else narrower roles (MS.AAD.7.2v1).
2. Turn on MFA for everyone. Use security defaults on Basic and Standard. On Entra ID P1 plans, create a Conditional Access policy requiring MFA for all users (MS.AAD.3.2v1) and the Phishing-resistant MFA strength for highly privileged roles (MS.AAD.3.6v1).
3. Block legacy authentication. Find legacy clients in the Entra ID sign-in logs, as Microsoft’s guide shows, then block them (MS.AAD.1.1v1). Exchange Online tenants created before 2017 must enable modern authentication first (Microsoft Learn).
4. Close mail submission and forwarding gaps. Disable SMTP AUTH (MS.EXO.5.1v1), the client submission protocol that typically runs on TCP port 587 (Microsoft Learn), unless a device or app still needs it, and restrict automatic forwarding to external domains (MS.EXO.1.1v2).
5. Publish SPF, DKIM and DMARC. Use an SPF record that fails non-approved senders (MS.EXO.2.2v2), enable DKIM (MS.EXO.3.1v1) and set DMARC to p=reject (MS.EXO.4.2v1). Only 30.5% of long-tail domains enforce DMARC, per our DMARC adoption statistics; our email security guide explains the records.
6. Restrict apps and stop password expiry. Allow only admins to register apps and consent to them (MS.AAD.5.1v1, MS.AAD.5.2v1) and set up an admin consent workflow (MS.AAD.5.3v1). Keep passwords set to never expire (MS.AAD.6.1v1), in line with NIST SP 800-63B-4 section 3.1.1.2 and our password statistics.
7. Turn on preset email policies. Enable the Standard and Strict preset security policies (MS.DEFENDER.1.1v1). With Defender for Office 365, put sensitive accounts in Strict (MS.DEFENDER.1.5v1); impersonation protection takes up to 350 users and 50 custom domains per preset policy (Microsoft Learn).
8. Tighten sharing. Limit SharePoint and OneDrive external sharing to Existing guests or Only people in your organization (MS.SHAREPOINT.1.1v1, 1.2v1), and set the default link to Specific people with View only permission (MS.SHAREPOINT.2.1v1, 2.2v1).
9. Turn on and confirm logging. Enable unified audit logging (MS.DEFENDER.6.1v1), which Business tenants start without, and confirm mailbox auditing (MS.EXO.13.1v1). Audit (Standard) keeps 180 days, so send logs to a SIEM if investigations need more history (Microsoft Learn).
10. Measure. Run ScubaGear against the tenant and review Microsoft Secure Score in the Defender portal, where each recommended action is worth 10 points or less. Re-run both after every change window.

What changed in Microsoft 365 security between 2019 and 2026?

Microsoft tightened identity defaults in steps: security defaults for new tenants from October 22, 2019, no MFA registration grace period from July 29, 2024, and mandatory admin-portal MFA from October 2024. CISA’s BOD 25-01 added federal deadlines in 2025, and on July 1, 2026 Microsoft 365 E3 gained Defender for Office 365 Plan 1. The table lists 13 changes and the advice some ranking guides still give from before them.

Which Microsoft 365 security setup fits your tenant?

Pick by user count first, then by the identity features you must enforce. Business plans stop at 300 users, Conditional Access starts at Entra ID P1, and risk-based blocking and Privileged Identity Management start at Entra ID P2. The table gives the threshold, the action and the list price for each common situation as of October 2026; the flowchart shows the first five rows.

How we compiled this

We compiled this from 52 primary documents accessed in October 2026: Microsoft price pages, Microsoft Learn (including Lighthouse), Partner Center, CISA’s BOD 25-01 directive and required configurations list, the SCuBA baselines at ScubaGear v1.8.0 and the v2.0.0 release notes, NIST SP 800-63B-4 and 45 CFR 164.312. We did not test a tenant or run ScubaGear. The plan and Lighthouse counts are our own mapping of those documents; prices are US list prices.

Frequently asked questions

Is Microsoft 365 secure?

Microsoft 365 is as secure as its configuration. Under Microsoft’s shared responsibility model, Microsoft secures datacenters, network and hosts, while customers own data, endpoints, accounts and access management. Microsoft says MFA plus blocking legacy authentication stops more than 99.9% of common identity attacks, and both are customer settings. No plan or setting guarantees protection from compromise.

Does Microsoft 365 Business Standard include Conditional Access?

No. Business Standard ($14.00 per user per month, October 2026) includes Entra ID Free, which offers security defaults but not Conditional Access. Conditional Access needs Entra ID P1, sold at $7.00 per user per month or included in Business Premium ($22.00) and Microsoft 365 E3 ($39.00), per Microsoft Entra licensing and Microsoft’s price pages.

Does Microsoft 365 Business Premium protect servers?

Not on its own. Defender for Business, included in Business Premium, needs an extra license per server: Microsoft Defender for Business servers, an add-on to Business Premium and standalone Defender for Business, priced at $3 per server instance per the Defender for Business FAQ. Above 60 servers, Microsoft points to Defender for Endpoint Server or Defender for Servers Plan 1 or 2 instead.

Can I mix Business Premium and Business Standard in one tenant?

Yes. Microsoft’s pricing FAQ applies the 300-license limit across the family of business plans, so 250 Business Premium seats leave room for 50 more of any Business plan. Microsoft’s Conditional Access documentation says the feature requires Entra ID P1 licenses, so budget P1 at $7.00 a month for any Business Standard user a policy will target.

Is Microsoft 365 HIPAA compliant?

No product is HIPAA compliant on its own. Microsoft says HHS approves no HIPAA certification standard, offers its Business Associate Agreement by default through the Data Protection Addendum, and states that using its services does not on its own achieve compliance (Microsoft Learn). Settings still count: 45 CFR 164.312(b) requires audit controls for systems holding electronic protected health information.

Is Microsoft Defender included in Microsoft 365?

Partly. Every plan gets built-in anti-malware and anti-spam filtering for mailboxes. Business Premium adds Defender for Business and Defender for Office 365 Plan 1. Microsoft 365 E3 carries Defender for Endpoint Plan 1 and, since July 1, 2026, Defender for Office 365 Plan 1. E5 includes Plan 2 of both plus Defender for Identity and Defender for Cloud Apps, per Microsoft.

How long does Microsoft 365 keep audit logs?

Audit (Standard) keeps records for 180 days for logs generated on or after October 17, 2023; older logs were kept 90 days. Audit (Premium), included with E5 or E5 compliance add-ons, keeps Entra ID, Exchange, OneDrive and SharePoint records for one year by default, and a separate add-on extends retention to 10 years (Microsoft Learn).

What is Microsoft Secure Score?

Microsoft Secure Score is a measurement of a tenant’s security posture in the Microsoft Defender portal, where a higher number means more recommended actions taken. Each recommended action is worth 10 points or less, most are scored as all or nothing, and the score updates in real time with a daily data sync, per Microsoft Learn.

Sources

1. Microsoft, Microsoft 365 Business Premium plan and pricing page. Accessed October 2026.
2. Microsoft, Microsoft 365 Business Premium with Copilot. Accessed October 2026.
3. Microsoft, Microsoft 365 Business Standard plan and pricing page. Accessed October 2026.
4. Microsoft, Microsoft 365 Business Basic plan and pricing page. Accessed October 2026.
5. Microsoft, Microsoft 365 plans and pricing (FAQ on the 300-seat limit). Accessed October 2026.
6. Microsoft, Compare all Microsoft 365 business plans. Accessed October 2026.
7. Microsoft, Microsoft 365 Enterprise plans and pricing (E3, E5). Accessed October 2026.
8. Microsoft, Microsoft Entra pricing. Accessed October 2026.
9. Microsoft, Microsoft Defender for Office 365 plans and pricing. Accessed October 2026.
10. Microsoft, Microsoft Defender for Business. Accessed October 2026.
11. Microsoft, Microsoft Intune plans and pricing. Accessed October 2026.
12. Microsoft, Microsoft Defender Suite for Microsoft 365 Business Premium. Accessed October 2026.
13. Microsoft Learn, Microsoft 365 for business security overview. Accessed October 2026.
14. Microsoft Learn, Security defaults in Microsoft Entra ID. Accessed October 2026.
15. Microsoft Learn, Block legacy authentication with Conditional Access. Accessed October 2026.
16. Microsoft Learn, Microsoft Entra licensing. Accessed October 2026.
17. Microsoft Learn, Conditional Access overview. Accessed October 2026.
18. Microsoft Learn, Conditional Access authentication strengths. Accessed October 2026.
19. Microsoft Learn, Microsoft Defender for Office 365 service description. Accessed October 2026.
20. Microsoft Learn, Plan for mandatory Microsoft Entra multifactor authentication. Accessed October 2026.
21. Microsoft Learn, Learn about auditing solutions in Microsoft Purview. Accessed October 2026.
22. Microsoft Learn, Manage audit log retention policies. Accessed October 2026.
23. Microsoft Learn, Turn auditing on or off. Accessed October 2026.
24. Microsoft Learn, Manage mailbox auditing. Accessed October 2026.
25. Microsoft Learn, Set the password expiration policy for your organization. Accessed October 2026.
26. Microsoft Learn, Preset security policies in Defender for Office 365. Accessed October 2026.
27. Microsoft Learn, Microsoft Secure Score. Accessed October 2026.
28. Microsoft Learn, Microsoft Defender for Business frequently asked questions. Accessed October 2026.
29. Microsoft Learn, What is Advanced Threat Analytics?. Accessed October 2026.
30. Microsoft Learn, New name for Azure Active Directory. Accessed October 2026.
31. Microsoft Learn, Microsoft Purview portal. Accessed October 2026.
32. Microsoft Learn, Enable or disable SMTP AUTH in Exchange Online. Accessed October 2026.
33. Microsoft Learn, Shared responsibility in the cloud. Accessed October 2026.
34. Microsoft Learn, HIPAA and HITECH compliance offering. Accessed October 2026.
35. Microsoft Learn, Requirements for Microsoft 365 Lighthouse. Accessed October 2026.
36. Microsoft Learn, Microsoft 365 Lighthouse FAQ. Accessed October 2026.
37. Microsoft Learn, Overview of Microsoft 365 Lighthouse baselines. Accessed October 2026.
38. Microsoft Learn, What’s new in Microsoft 365 Lighthouse. Accessed October 2026.
39. Microsoft Learn, Overview of alerts in Microsoft 365 Lighthouse. Accessed October 2026.
40. Microsoft Partner Center, New commerce license-based overview. Accessed October 2026.
41. CISA, BOD 25-01: Implementing Secure Practices for Cloud Services. Accessed October 2026.
42. CISA, BOD 25-01 Required Configurations. Accessed October 2026.
43. CISA, Secure Cloud Business Applications (SCuBA) Project. Accessed October 2026.
44. CISA, ScubaGear repository and v1.8.0 release (GitHub). Accessed October 2026.
45. CISA, ScubaGear v1.8.0 interactive permissions. Accessed October 2026.
46. CISA, ScubaGear v2.0.0 release notes (October 22, 2026). Accessed October 2026.
47. Microsoft Learn, Teams settings and policies reference. Accessed October 2026.
48. CISA, M365 Secure Configuration Baseline for Microsoft Entra ID (v1.8.0). Accessed October 2026.
49. CISA, M365 Secure Configuration Baseline for Exchange Online (v1.8.0). Accessed October 2026.
50. CISA, M365 Secure Configuration Baseline for Defender (v1.8.0). Accessed October 2026.
51. NIST, SP 800-63B-4 Digital Identity Guidelines: Authentication and Authenticator Management. Accessed October 2026.
52. eCFR, 45 CFR 164.312 Technical safeguards. Accessed October 2026.