Does Microsoft 365 Business Premium Include Intune, Defender and Conditional Access?
Yes. Microsoft 365 Business Premium includes Intune, Defender for Business, Defender for Office 365 Plan 1, and Entra ID P1 - the licence that enables Conditional Access. All of them are included in the subscription at A$32.90 per user per month, not as add-ons. The important qualifier: included is not the same as active. Every one of these tools requires configuration before it protects anything. Most Business Premium environments have all four sitting dormant while the business assumes it is covered.
What Business Premium includes
Security tools included in Microsoft 365 Business Premium
| Tool | What it is | Requires configuration? |
|---|---|---|
| Microsoft Intune | Device management - enforces compliance policies, deploys apps and settings, manages mobile devices | Yes - devices must be enrolled |
| Microsoft Defender for Business | Endpoint detection and response (EDR) for Windows, macOS, iOS, Android - real-time protection, behavioural analysis, automated remediation | Yes - must be deployed to devices |
| Defender for Office 365 Plan 1 | Email security - safe links, safe attachments, anti-phishing with impersonation detection | Yes - policies must be configured |
| Entra ID P1 | Identity platform that enables Conditional Access, risk-based sign-in policies, and MFA enforcement | Yes - Conditional Access policies must be created |
| Azure Information Protection P1 | Sensitivity labels for classifying and protecting documents and email | Yes - labels must be configured and published |
| Intune-based Windows Autopilot | Zero-touch device provisioning for new Windows devices | Yes - requires Autopilot profile configuration |
Microsoft Intune
Intune is the device management platform in Business Premium. It allows you to enrol Windows, macOS, iOS, and Android devices and apply configuration policies: enforce disk encryption, require a PIN, deploy applications, push security settings, and block non-compliant devices from accessing company data.
To use Intune, devices must be enrolled. For Windows devices, enrollment typically happens through Azure AD Join (the device is joined to your Entra ID tenant rather than an on-premises domain). iOS and Android devices can be enrolled through the Intune Company Portal app.
Until devices are enrolled in Intune, the device management capabilities in Business Premium do nothing. Many organisations pay for Business Premium and never enrol a single device.
Microsoft Defender for Business
Defender for Business is Microsoft's SMB-focused endpoint security product. It provides endpoint detection and response (EDR): real-time antivirus and antimalware protection, behavioural threat analysis that detects suspicious activity patterns, automated investigation when threats are detected, and a centralised security dashboard.
Defender for Business must be deployed to each device. On Windows devices, it typically deploys automatically when the device is enrolled in Intune, through an onboarding policy. On macOS, iOS, and Android, deployment requires additional configuration.
Defender for Business is available as a standalone product at approximately A$4.20 per device per month. Business Premium includes it as part of the subscription - one of the reasons Business Premium represents good value for security-conscious organisations.
Defender for Office 365 Plan 1
Defender for Office 365 Plan 1 adds three materially important controls to email security beyond the baseline protection in lower-tier plans:
- Safe attachments: email attachments are opened in a sandboxed environment before delivery. If the attachment executes malicious behaviour, it is blocked and the email is quarantined.
- Safe links: URLs in emails and Office documents are rewritten and checked at click time. If a link resolves to a known malicious site - or if a site has become malicious since the email was received - the click is blocked.
- Anti-phishing with impersonation protection: policies that detect when an email is impersonating a known person in your organisation (CEO, finance manager) or a trusted external domain. Significantly reduces business email compromise risk.
These protections are not active by default. Safe attachment and safe link policies must be created and applied to users. The Defender for Office 365 configuration wizard in the Microsoft Defender portal guides you through this setup.
Conditional Access
Conditional Access is not a product - it is a capability within Entra ID P1. A Conditional Access policy evaluates every sign-in request against a set of conditions and decides whether to allow it, require MFA, require a compliant device, or block it.
Example policies enabled by Conditional Access in Business Premium:
- Require MFA for all users on every sign-in
- Require a compliant device (enrolled in Intune, disk encrypted, OS up to date) before granting access to Microsoft 365
- Block sign-ins from countries your organisation does not operate in
- Require phishing-resistant MFA for Global Administrator accounts
- Block legacy authentication protocols that cannot enforce MFA
Conditional Access policies must be created - they do not exist by default. Microsoft provides templates for common policies through the Entra ID admin centre, which reduces the configuration burden. However, incorrectly configured Conditional Access policies can lock users out of their accounts, so changes should be tested carefully before full deployment.
The gap between 'Business Premium licences assigned' and 'Business Premium security tools active' is significant. A fully configured Business Premium environment - Intune enrolled, Defender deployed, Conditional Access policies active - is a strong security posture for an Australian SMB. A Business Premium environment where none of these tools have been configured is essentially Business Standard with an extra monthly charge.
What is not included
Business Premium does not include everything. Notable omissions relevant to growing businesses:
- Entra ID P2: required for Privileged Identity Management (PIM) and risk-based Conditional Access using Identity Protection. Requires E5 or a separate P2 add-on.
- Defender for Cloud Apps (CASB): monitoring and control of third-party SaaS applications connected to Microsoft 365. Available in E5.
- Defender for Identity: monitoring for identity-based attacks on on-premises Active Directory. Relevant for hybrid environments.
- Extended audit log retention: Business Premium retains audit logs for 90 days. Longer retention requires Purview Audit Premium or E5.
- Advanced eDiscovery and legal holds: basic eDiscovery is available, but advanced search and hold capabilities require E3 or above.
Sources & accuracy
Last reviewed: 5 October 2026 · Microsoft product capabilities, licensing and configuration options change regularly. Verify current details at learn.microsoft.com.
Next step
Cloud Security Baseline
The Cloud Security Baseline configures the security tools included in your Microsoft 365 Business Premium subscription - Intune device enrollment, Defender for Business deployment, Conditional Access policies, and Defender for Office 365 - and gives you a documented security configuration aligned to the ASD Essential Eight.
Learn more