If you're running a sub-300-seat business in Australia, the Microsoft 365 Business Standard versus Business Premium choice is the single most important licensing decision you'll make this year. The price difference is only AUD $14/user/month. The security difference is the gap between meeting reasonable-steps obligations under the Privacy Act and not.
Business Standard — what's in it
- Desktop Office (Word, Excel, PowerPoint, OneNote, Outlook)
- Web and mobile Office
- Teams, OneDrive, SharePoint, Exchange Online
- Bookings, Forms, Lists, Planner, Stream, Whiteboard
- 300-user cap
What's NOT in Business Standard
- No Microsoft Intune — you can't manage devices
- No Microsoft Defender — no EDR, no anti-phishing beyond Exchange Online Protection
- No Conditional Access — Entra ID is on the free tier; you can enforce MFA but you can't make it conditional
- No advanced threat protection in Outlook (Safe Links, Safe Attachments)
- No information protection — no sensitivity labels, no DLP, no Purview
Business Premium — what the AUD $14 buys you
- Microsoft Intune — full mobile device management and mobile application management
- Microsoft Defender for Business — small business EDR, with continuous endpoint monitoring and automated investigation
- Defender for Office 365 P1 — Safe Links, Safe Attachments, anti-phishing
- Microsoft Entra ID P1 — Conditional Access, self-service password reset, group-based licensing
- Microsoft Purview baseline — sensitivity labels, basic DLP, retention policies
- Azure Information Protection P1 — encryption and rights management
Why this is a Privacy Act decision, not a budget decision
The Australian Privacy Act expects organisations to take 'reasonable steps' to protect personal information. The Office of the Australian Information Commissioner has consistently treated baseline cyber controls — MFA, encryption, access controls, endpoint protection — as part of reasonable steps. With Business Standard, you can't enforce Conditional Access, you don't have endpoint EDR, and you can't apply sensitivity labels. With Business Premium, you can.
The Privacy Act 2026 reforms tighten this further. The 'fair and reasonable' test on collection and use, the new individual rights, and the increased OAIC enforcement capability all assume a baseline of technical controls. Australian SMBs running Business Standard with personal information are increasingly the OAIC's enforcement target — not because they're being singled out, but because the control gap is visible from outside.
When Business Standard is genuinely fine
Two scenarios: (1) your business does not handle personal information of any kind — vanishingly rare in 2026; (2) you have a separate stack already in place — third-party MDM, third-party EDR, third-party identity controls — and consolidating onto Business Premium would actually cost more in transition than it saves. For everyone else, the AUD $14 premium is the cheapest cyber insurance you'll buy.
How to upgrade safely
Switching from Business Standard to Business Premium is a licence change, not a tenant migration — Microsoft updates the assigned SKU and the entitlements unlock. But assigning the licence does not turn anything on. You need to deploy Conditional Access policies, enrol devices into Intune, onboard endpoints to Defender, and configure sensitivity labels. Frontrow runs the Business-Standard-to-Premium uplift as a 4-week project; the licence change without the deployment leaves you paying more for the same security posture you had before.
Try it
See where your current setup stands
Run the Essential Eight readiness check against your current SMB tenant — most Business Standard tenants score ML0 across most strategies.
Score each of the 8 strategies
Where are you on the Essential Eight — honestly?
Eight strategies. Four levels each. Pick the statement closest to your reality today. We'll map it to the Microsoft 365 tooling that closes the gap.
What's your target Maturity Level?
Maturity Level 2 — most orgs' pragmatic target
- 01
Application control
Only approved applications can execute on workstations and servers.
- 02
Patch applications
Internet-facing apps, browsers, Office, PDF readers patched promptly.
- 03
Microsoft Office macros
Macros disabled unless from trusted locations and signed by a trusted publisher.
- 04
User application hardening
Web browsers and productivity apps hardened against the most common attacks.
- 05
Restrict administrative privileges
Admin accounts limited, separated and reviewed — the crown jewels of the tenant.
- 06
Patch operating systems
Operating system patches applied on a schedule that matches the risk.
- 07
Multi-factor authentication
MFA everywhere that matters — privileged accounts, remote access, important data.
- 08
Regular backups
Backups of important data, configuration and software — and restores you have actually tested.