Licensing a New 25-Person Office From Scratch: The Full Shopping List

Fix it now

Buy in this order: Windows on the endpoints, then Microsoft 365 for identity, mail and apps, then anything on-premises with its CALs, then backup. At 25 people you sit comfortably inside the 300-seat Business family cap, so Enterprise plans are not the answer, and the decision that costs money later is Standard against Premium rather than which apps you get.

1. Specify Windows 11 Pro when the hardware is ordered. Home cannot be Microsoft Entra joined and cannot have BitLocker enabled, and a Pro upgrade applied by hand to twenty machines costs more than specifying it once.
2. Buy one Microsoft 365 seat per person, and mix the plans. Business Basic has no desktop apps; Standard adds them; Premium adds the management and security layer.
3. Buy Business Premium for anyone whose device you need to manage. It includes Microsoft Defender for Business, Defender for Office 365 Plan 1, Microsoft Entra ID P1 and full Intune capabilities.
4. Buy no seat for shared and role mailboxes. A shared mailbox stores up to 50 GB without a licence; only past that, or for litigation hold, does it need an Exchange Online Plan 2 licence.
5. Skip the server unless something specific needs one. If you do buy one, price the core licences and the CALs on the same page – 8 core licences per processor, 16 per server, plus one CAL per user or device.
6. Budget a separate backup for Microsoft 365 data and for any server you run. Nothing in the subscription is a backup of your content.

Do not buy Enterprise plans at this size. The Business family cap is 300 seats in total across Business Basic, Business Standard and Business Premium, and 25 people are nowhere near it.

If the answer is twenty-five Business Premium seats on Windows 11 Pro machines with a backup behind them, that is a complete and correct estate and you can stop here. Below is the full list line by line, the server test, and what to buy first if the money arrives in stages.

Why it happens

Fitting out a new office is the one moment when licences can be bought in the right order, before anything is deployed and before a decision is expensive to reverse. Each line constrains the ones after it. The Windows edition decides whether the endpoint can be joined and managed at all. The identity platform decides where mail, files and sign-in live, which decides whether you need a server. The server decision generates CALs. Buy from the bottom up and each choice quietly removes options above it.

The Windows edition line is the one with a deadline attached, because it is decided by the hardware quotation rather than by you. Windows Home editions do not support Microsoft Entra join – they can use Microsoft Entra registration instead, which is a weaker relationship – and BitLocker enablement is supported on Pro, Enterprise, Pro Education and Education but not on Home, although device encryption is available on all Windows versions where the hardware meets Modern Standby or HSTI requirements. Intune does list Windows 11 Home as a supported platform, so ‘Home cannot be managed’ overstates it; the accurate statement is that Home cannot be Entra joined, cannot have BitLocker enabled and managed, and does not support every policy.

The second decision that matters is Business Standard against Business Premium, and it is not about applications. Both include the desktop client apps. Premium adds the management and security layer: Microsoft Defender for Business, Defender for Office 365 Plan 1, Microsoft Entra ID P1 and full Intune capabilities for iOS, Android, Mac and other cross-platform device management. Assembling those separately later costs more and lands badly on machines already in daily use.

Full reference

The list, line by line

Choosing between the Business plans

Business Basic gives web and mobile apps plus mail, Teams and cloud storage, and no desktop applications. Business Standard adds the installed desktop apps. Business Premium adds the layer that turns a set of accounts into a managed estate: device enrolment and policy through Intune, conditional access through Microsoft Entra ID P1, endpoint protection with a console through Defender for Business, and filtering of links and attachments through Defender for Office 365 Plan 1.

You are allowed to mix, and at this size you probably should. Buying every seat at the same level because it is simpler is the commonest way an office of twenty-five overspends; buying every seat at the cheapest level is the commonest way it ends up unmanageable. Decide per role, not per organisation.

Microsoft caps the Business family at 300 seats in total across Business Basic, Business Standard and Business Premium, and reserves the right to enforce it. At 25 people this is not a constraint, and it is a positive reason not to buy Enterprise plans that carry capability you will not configure.

The server test, and what it costs if you pass it

For most new offices of this size the answer is no server. The genuine reasons are a line-of-business application that needs a local database, very large working files moved constantly over the local network, or equipment that will only talk to a machine on the same LAN. Habit, familiarity and ‘we have always had one’ are not reasons.

If you do need one, price it whole. Windows Server is licensed by physical core with a minimum of 8 core licences per physical processor and 16 per server, sold in 2-packs and 16-packs, so even a small server carries a floor before it runs a workload. Standard gives two operating system environments; Datacenter gives any number. Then add a Windows Server CAL for every user or device that accesses it, an External Connector licence if people outside the organisation will reach it, RDS CALs if anybody will use a published desktop, plus antivirus, backup and the time of whoever patches it. Set that total against the cloud services it would replace.

The lines people forget

• CALs. They are a paper entitlement with no technical enforcement, which is exactly why they go missing and exactly why a review looks at them first.
• RDS CALs, if anybody will use a session host. Remote Desktop supports two concurrent connections without RDS CALs, and Microsoft is explicit that they are for administration.
• A domain name and DNS held in the company’s name rather than an employee’s personal account.
• A break-glass administrator account nobody uses daily, with its credentials stored somewhere that survives a laptop being lost.
• Backup for Microsoft 365. Retention policies and the recycle bin are not backup, and the subscription lifecycle ends in deletion if it lapses.

What to buy first if the money arrives in stages

1. Windows 11 Pro on the machines and a Microsoft 365 seat for every person. Nothing works until people have identities and mail.
2. Multi-factor authentication for everyone, and device enrolment. With Business Premium this costs time rather than money.
3. Backup. Data is not backed up simply because it is in the cloud.
4. The server and its CALs, if you concluded you need one. This line is the most easily deferred and the most easily over-bought.

The things that cost nothing and matter more than the order

Turn on multi-factor authentication for every account and especially for administrators. Give people standard user accounts rather than local administrator rights. Keep a separate break-glass admin account. Switch BitLocker on, which is a Pro capability and part of why you specified Pro. None of that appears on an invoice, all of it removes real risk, and all of it is far easier to do on machines nobody has logged into yet.

Questions people ask about this