If your firm runs Microsoft 365 Business Premium, you made a sound decision. It is one of the strongest security bundles available to a small organization, and it puts capabilities in your hands that mid-market firms paid a premium for a few years ago. The problem is the assumption that often comes with it: that buying the license is the same as being covered.
It is not. A license is a set of capabilities. Coverage is a program. The distance between the two is where small firms get hurt, and as a managing partner you carry that distance personally, in front of clients, regulators, and your malpractice carrier.
The definitive answer
Business Premium is a strong baseline, not a finished security program. The license ships with tools that must be configured, monitored, and documented to protect you, and it explicitly does not back up your data or respond to incidents on your behalf. Five concrete gaps remain after purchase: configuration and hardening, backup of Microsoft 365 data, security monitoring and response, user training, and documented incident readiness. Closing them is what converts the license into defensible coverage.
What changed
Two things shifted the math for a firm your size.
First, the attacker economy industrialized. Phishing kits, credential-theft tooling, and access-for-sale markets mean a firm of eight people is attacked by the same automated infrastructure as a firm of eight hundred. No one is screening targets by headcount. Your client trust accounts, medical records, sealed filings, and deal data are valuable precisely because they are concentrated and often less defended.
Second, the obligations tightened. State data-breach and data-security laws, the FTC Safeguards Rule for firms that touch financial data, HIPAA for anyone handling protected health information, and client-driven security questionnaires now ask for evidence of controls, not assurances of good intentions. "We have Microsoft 365" is not an answer to "show me your backup, monitoring, and incident response." The question being asked of you has changed, even if your environment has not.
Gap one: configuration and hardening
Business Premium includes Microsoft Entra ID P1, Intune, Conditional Access, and Microsoft Defender for Business. These are real controls. But they arrive as capabilities, not as a hardened configuration. Multi-factor authentication, Conditional Access policies, legacy-authentication blocking, device compliance rules, and least-privilege admin roles all have to be deliberately turned on and tuned to your firm. Out of the box, much of this sits dormant or runs on permissive defaults.
This is the most common gap I see, and the most dangerous, because it is invisible. The portal shows green. The firm assumes the protections it paid for are doing the work. In reality, MFA may have exclusions, global-admin accounts may lack their own protections, and sharing settings may allow data to leave the tenant unnoticed.
What closing it takes in 2026: a documented hardening baseline mapped to a recognized reference such as the Microsoft secure-configuration guidance and CIS benchmarks, applied across identity, devices, email, and data sharing, then re-checked on a schedule because settings drift as Microsoft changes defaults and your firm adds people and apps. This is a project to stand up and a discipline to maintain, not a one-time toggle.
Gap two: backup of Microsoft 365 data
This is the gap that surprises owners most, so I will be plain about it. Microsoft does not back up your data for you. Microsoft operates a shared responsibility model: they keep the platform available and resilient, and you remain responsible for your own content. Their service terms point customers to third-party backup for exactly this reason.
Native features create a dangerous illusion of safety. Retention policies, the recycle bin, and version history are time-limited and are designed for convenience, not disaster recovery. If an employee is compromised and deletes mailboxes, if ransomware encrypts files synced to SharePoint and OneDrive, or if a departing staff member purges records, those native windows can close before you even know there is a problem. Once they close, the data is gone, and "Microsoft had it" is not a recovery plan.
What closing it takes in 2026: an independent, third-party backup of Exchange Online, SharePoint, OneDrive, and Teams, with retention set to match your regulatory and litigation-hold obligations, immutable storage so backups cannot be encrypted or deleted by an attacker, and tested restores. The test matters. An untested backup is a hope, not a control, and the first time you discover it does not restore should not be during an incident.
Gap three: security monitoring and response
Defender for Business is genuinely capable. It detects malware, suspicious sign-ins, and email threats, and it generates alerts. Here is the uncomfortable question: who reads those alerts at 11pm on a Saturday, and who acts on them?
For most small firms, the honest answer is no one. The license produces signal, but signal without a human and a process behind it is just a record of the breach you did not stop. Attackers know that small firms watch their tools during business hours, if at all, so they operate on nights and weekends. The capability exists in your tenant. The capacity to use it does not come in the box.
What closing it takes in 2026: monitoring and response coverage outside business hours, delivered by a dedicated team that knows your environment, with the authority and tooling to contain a threat — isolate a device, disable an account, revoke sessions — not merely to email you about it. The distinction between detection and response is the distinction between an alert and a contained incident. For a firm your size, this is almost always a managed capability rather than a hire, because round-the-clock coverage is not something one or two internal people can sustain.
Gap four: user training
Your people remain the most targeted part of your firm. Business email compromise, where an attacker impersonates a partner or a client to redirect a payment or extract data, does not rely on breaking your technology. It relies on a plausible message and a busy human. No license setting prevents a paralegal from wiring funds on a convincing instruction.
Training is not a poster in the kitchen or a video everyone clicks through once at onboarding. It is a recurring program that builds and measures judgment.
What closing it takes in 2026: regular, role-aware security awareness training, periodic simulated phishing to measure who clicks and to coach rather than punish, and clear, rehearsed procedures for the high-risk moments — verifying a change in payment instructions through a second channel, confirming an unusual request from a partner by phone. The goal is a workforce that treats verification as normal, not paranoid. This also produces the training records regulators and carriers increasingly ask to see.
Gap five: documented incident readiness
The first four gaps reduce the chance of an incident and limit its damage. The fifth one determines what happens in the hours after something gets through, and it is the one most directly tied to your regulatory and professional exposure.
When an incident occurs, the clock starts. State breach-notification laws, HIPAA, the FTC Safeguards Rule, and client contracts impose obligations with timelines. If your firm is improvising at that moment — unsure who to call, what your obligations are, or what actually happened — you compound a technical problem into a legal and reputational one. Equally, when a client or auditor asks how you would respond, "we'd figure it out" is not an answer that survives scrutiny.
What closing it takes in 2026: a written incident response plan that names roles, decision-makers, and external contacts including counsel and, where relevant, your cyber insurer; defined notification triggers and timelines for your jurisdictions and client commitments; logging and retention sufficient to reconstruct what happened; and at least one tabletop exercise so the plan has been walked through before it is needed. Documentation is not bureaucracy here. It is the evidence that you ran a reasonable program, which is frequently the standard you will be judged against.
A decision framework for the managing partner
You do not need to become a security expert. You need to ask five questions and require evidence, not reassurance, in response.
- Configuration: Can someone show me our hardening baseline and when it was last verified against current Microsoft and CIS guidance?
- Backup: Do we have an independent, immutable backup of Microsoft 365, and when did we last successfully test a restore?
- Monitoring: Who watches our security alerts outside business hours, and what are they authorized to do when one fires?
- Training: When did our people last receive training and a simulated phishing test, and what were the results?
- Incident readiness: Do we have a written incident response plan with named roles and notification timelines, and have we rehearsed it?
If any answer is vague, that gap is open. The reassuring part is that closing these gaps does not mean replacing the license you already bought. It means building the program around it — configuration, backup, monitoring and response, training, and documented readiness — layered on the foundation Business Premium provides. That is the difference between owning a capability and being covered, and in 2026 it is the difference your clients, regulators, and carrier will ask you to prove.
Why Business Premium is still the right foundation
It would be easy to read the five gaps and conclude that the license is the problem. It is not. The point is the opposite: Business Premium gives a firm your size a foundation that was, until recently, out of reach without enterprise budgets and a dedicated security team. The work described here is built on that foundation, not in place of it. Understanding what you already own is the first step in not paying twice for it.
Inside the bundle you have an identity layer (Microsoft Entra ID P1) capable of Conditional Access, risk-based sign-in controls, and self-service password management. You have a device-management layer (Intune) that can enforce encryption, screen locks, and compliance rules across laptops and phones, and can wipe a lost device remotely. You have an endpoint protection layer (Defender for Business) that detects and can isolate compromised machines. You have email and collaboration protections (Defender for Office 365 capabilities, including Safe Links and Safe Attachments) and data-handling controls such as sensitivity labels and data loss prevention. Bought separately and assembled by a firm of eight, these would be expensive and difficult to integrate. Bundled, they are coherent and licensed per user.
So the honest framing is not "Business Premium is insufficient." It is "Business Premium is a strong set of components that no one has assembled, switched on, watched, or documented for you." The components are good. The assembly is the job.
How the five gaps compound
The gaps are not independent line items. They reinforce each other, and that is why a partial program often gives a worse sense of security than no program at all. A firm that has done one or two things well frequently believes it has done everything, and that belief is itself a risk.
Consider how a single incident moves through them. Weak configuration (gap one) leaves an MFA exclusion on a global-admin account. An attacker phishes a credential because the staff member was never trained to verify a login prompt (gap four) and walks into that unprotected account. No one is watching outside business hours (gap three), so the intruder spends the weekend creating mailbox forwarding rules, exfiltrating files from SharePoint, and deleting evidence of their movement. By Monday, the native recycle bin and version history may already be working against you, and without independent backup (gap two) the deleted material is unrecoverable. Then the firm reaches the moment it least wants to improvise (gap five): clients to notify, a carrier to call, regulators with clocks already running, and no plan that names who does what.
Each open gap lengthens the chain and raises the cost of the link before it. Configuration reduces how often the chain starts. Training reduces how often a human completes it. Monitoring shortens how long an attacker operates undetected. Backup determines whether the damage is recoverable. Incident readiness determines whether a technical event becomes a legal and reputational one. Close one and leave four, and you have moved a single point of failure, not removed it.
How the program maps to your obligations
For a regulated firm, the most useful way to think about these gaps is not as IT projects but as evidence you will eventually be asked to produce. The control and the documentation of the control are different things, and increasingly it is the documentation that is examined.
What does the FTC Safeguards Rule expect?
If your firm handles financial data in a way that brings you under the Safeguards Rule, the obligations are explicit about program, not just product. The Rule expects a written information security program, a qualified individual responsible for it, a documented risk assessment, access controls, encryption, multi-factor authentication, and a written incident response plan, among other elements. Notice that several of these map directly onto the gaps above: MFA and access controls sit in configuration, the response plan sits in incident readiness, and the written program is the documentation that ties them together. A license alone satisfies none of these requirements; a configured and documented program built on the license can satisfy several.
How does HIPAA change the picture?
For firms handling protected health information, the HIPAA Security Rule requires a risk analysis, administrative, physical, and technical safeguards, and documentation retained over time. The Rule is technology-neutral, which means owning Microsoft 365 neither satisfies nor violates it. What matters is whether you have assessed your risks, implemented reasonable safeguards, and can show your work. The hardening baseline, the training records, the monitoring arrangement, and the incident response plan are the artifacts that demonstrate the safeguards exist and operate.
What about state breach-notification laws?
Every U.S. state has a breach-notification law, and they vary in their definitions, timelines, and triggers. A firm operating across state lines may answer to several at once, each with its own notion of what counts as a reportable breach and how quickly affected people and regulators must be told. This is precisely why incident readiness includes defined notification triggers for your jurisdictions: in the hours after an incident, you do not want to be researching fifty statutes. You want a plan that already names which obligations apply to you and what clock each one starts.
Why do client security questionnaires matter so much now?
For many mid-market firms, the most immediate pressure comes not from a regulator but from a client. Corporate clients, insurers, and their auditors now send security questionnaires before they will share sensitive data, and those questionnaires ask the same questions this briefing does: Do you back up your data independently? Do you monitor outside business hours? Do you train staff? Do you have an incident response plan? A vague answer can cost you the engagement. A firm that can answer each question with evidence is not just more secure; it is more competitive in a procurement process that increasingly treats security as a qualification to bid.
How should you sequence the work?
Closing five gaps at once is neither necessary nor realistic. The sensible order is driven by which gaps reduce the most risk for the least disruption, and which produce evidence you may need soonest.
- Backup first, because it is the floor. Independent, immutable, tested backup is the control that determines whether any incident is recoverable. It is also among the fastest to stand up and the least disruptive to your people. Until it exists, every other risk carries a worst-case outcome of permanent loss.
- Configuration and identity hardening next. This closes the most common entry path and is largely invisible to users when done well. Enforcing MFA without exclusions, blocking legacy authentication, tightening admin roles, and applying a documented baseline removes a large share of the opportunistic attacks that automated infrastructure attempts daily.
- Monitoring and response. Once the tenant is hardened, putting a human and a process behind the alerts it generates converts detection into containment. This is where round-the-clock coverage earns its place, because the configuration work has reduced noise enough that the remaining signals are worth acting on.
- Training as a continuous program. This runs in parallel and never finishes. Begin it early, because it changes behavior slowly and the records accumulate value over time.
- Incident readiness to tie it together. With the technical controls in place, document the plan, define the notification triggers, and rehearse it. The tabletop exercise often exposes the last gaps in the first four items, which is part of its value.
This sequence is a default, not a rule. A firm facing an imminent client audit may pull incident-readiness documentation forward. A firm with a recent close call may prioritize monitoring. The point is that the work is a roadmap with an order, not a single purchase, and a competent partner will help you sequence it against your actual risk and obligations rather than selling all of it on day one.
Co-managed or fully managed: which fits your firm?
Firms with an internal IT person or a small team often ask whether they need outside help at all, or whether bringing it in means displacing the people they already trust. The answer is usually neither extreme.
A fully managed arrangement makes sense when a firm has no internal IT capacity and wants the entire program owned externally: configuration, backup, monitoring, training administration, and incident response, all run by a dedicated team that knows your environment. A co-managed arrangement makes sense when you have capable internal people who handle day-to-day support and user issues but cannot realistically provide round-the-clock security monitoring, maintain a hardening baseline against shifting Microsoft defaults, or stand up a tested backup and an incident response plan on their own. In a co-managed model, the internal person keeps the relationship and the institutional knowledge, and the security program gets the specialized capacity and coverage it requires.
The deciding factor is rarely headcount alone. It is sustainability. Security monitoring that depends on one or two people being awake, available, and current is not coverage; it is a single point of failure with a pulse. The question to ask is not "can my internal person do this?" but "can my firm sustain this every night, every weekend, and through staff turnover and vacations?" Where the honest answer is no, that function belongs with a team built to provide it continuously.
What does good evidence actually look like?
Throughout this briefing the recurring instruction has been to require evidence rather than reassurance. It is worth being concrete about what that evidence is, so you can recognize it when you see it and notice when it is missing.
- For configuration: a written hardening baseline document, a record of the date it was last reviewed against current Microsoft and CIS guidance, and a list of any deliberate exceptions with the reason each exists.
- For backup: confirmation of what is backed up (Exchange Online, SharePoint, OneDrive, Teams), the retention period, confirmation that storage is immutable, and a dated record of the most recent successful test restore.
- For monitoring: a description of who provides coverage and during which hours, what they are authorized to do without waiting for you, and a sample of how a past alert was handled from detection to resolution.
- For training: completion records by person and role, the date and results of the last simulated phishing exercise, and the coaching that followed for those who clicked.
- For incident readiness: the written plan itself, the named roles and external contacts, the notification triggers for your jurisdictions, and the date of the most recent tabletop exercise.
If a control exists but cannot be evidenced, you are in a weak position with a regulator, an auditor, or a court, because the standard you are usually judged against is whether you ran a reasonable program, and a program you cannot document is difficult to prove you ran. Evidence is not paperwork for its own sake. It is the form your diligence takes when someone asks you to demonstrate it.
Frequently asked questions
Does upgrading to a higher Microsoft tier close these gaps?
No. A higher tier such as the enterprise E-series adds capabilities, but every gap described here remains. More licensing still does not back up your data, still does not watch alerts at night, still does not train your people, and still does not write or rehearse your incident response plan. Upgrading buys more components to assemble, not an assembled program.
We have never had a security incident. Why invest now?
The absence of a known incident is not the same as the absence of an incident, and it is not evidence that your controls are working. Without monitoring, you may simply not see what is happening in your tenant. More to the point, the obligations described here apply regardless of your incident history: a client questionnaire, a regulator, or your insurer can ask for evidence of your program tomorrow, and "we have never had a problem" is not a control they will accept.
Is Microsoft's native retention enough if we set it to the maximum?
No. Native retention, the recycle bin, and version history are recovery conveniences within the platform, not an independent backup. They can be affected by the same account compromise or administrative action that causes the loss, and they do not provide the immutability and long retention that regulatory and litigation-hold obligations often require. An independent, separately controlled backup exists precisely so that a problem inside the tenant cannot reach it.
How long does it take to close the five gaps?
Backup and identity hardening can typically be stood up quickly, often within the first weeks, because they are well-defined projects. Monitoring and response begins once the tenant is hardened. Training and incident readiness are continuous rather than finite: a plan is written and then rehearsed periodically, and training recurs on a schedule. The realistic frame is that the foundational controls go in over a defined initial period, and the program is then maintained indefinitely, because configuration drifts, people change, and obligations evolve.
Will closing these gaps disrupt how our people work?
Most of the work is invisible to users when it is done well. Backup runs in the background. Configuration hardening is largely transparent, with the most noticeable change being consistent multi-factor authentication. Monitoring happens outside your view. The elements your people will feel are training and the verification habits it builds, and those are deliberate: a workforce that confirms unusual payment instructions through a second channel is the point, not a side effect.
