The Essential Security Stack for a Ten-Person Business, Ranked

Fix it now

The three controls that remove the most risk for a business this size cost nothing: multi-factor authentication through Microsoft Entra security defaults, patching to a fixed deadline, and ordinary work in a standard rather than an administrator account. Money starts mattering at backup, and again at the managed endpoint, mail and device layer that Business Premium carries in one seat.

1. Buy nothing until security defaults are on. They enforce MFA registration for every user, MFA for administrators and a block on legacy authentication, at no licence cost.
2. Skip an identity upgrade until you need rules rather than a switch. Varying the requirement by device state or location is conditional access, which needs Microsoft Entra ID P1.
3. Buy a backup only once you know where the copy lands. Microsoft states that Microsoft 365 Backup keeps its copies inside the Microsoft 365 data trust boundary, so it is not an off-platform copy.
4. Buy Business Premium for the endpoint, mail and device layers under one console: Defender for Business at up to five client devices per user, Defender for Office 365 Plan 1, Intune and conditional access.
5. Skip Business Premium if nobody will enrol a device or write a policy. Unconfigured, it is a more expensive Business Standard with the same protection.
6. Buy the Defender for Business servers add-on for each server. Client licences do not reach Windows Server or Linux, and the add-on caps at 60 per subscription.

If the free controls are already switched on and the plan choice is obvious, stop here. Below is why the order looks like this, what each paid layer actually contains, and where the free route genuinely suffices.

Why it happens

Rank by what each control removes rather than by product category and the list comes out in an awkward order for anyone selling software: the top of it is free. A business of ten is not usually defeated by novel malware. It is defeated by a password that worked from somewhere it should not have, by a browser that was three months behind on a fix that already existed, by an email that persuaded somebody to change a bank account, and by ransomware landing on data that had no separate copy. A better scanner addresses one of those four.

Identity comes first because it is the one control that fails open. Microsoft Entra security defaults require every user to register for multi-factor authentication, require administrators to use it, block legacy authentication protocols and block device code flow, and Microsoft provides them on the free identity tier at no extra cost. There is no licence to buy and no policy to design. If nobody in your organisation has been asked for a second factor, that is a configuration gap rather than a purchasing one.

Microsoft has also stopped treating administrator MFA as optional. Sign-in to the Azure portal, the Microsoft Entra admin center, the Intune admin center and the Microsoft 365 admin center now requires it, and since 1 October 2025 the same applies to Azure CLI, Azure PowerShell, the Azure mobile app and infrastructure-as-code tooling. Whatever you decide about the rest of this list, that part is already being enforced against your administrators.

Patching sits second because attackers overwhelmingly use vulnerabilities that already have fixes, and because a defensible deadline exists to aim at. The Cyber Essentials requirements set the bar at 14 days from release for anything rated critical or high risk, and that is a reasonable internal target whether or not you certify. Third comes the account model: give people standard accounts and keep administrative rights in a separate credential that is not used for mail or browsing.

Backup is the first item on the list that reliably costs money, and it is the one most often mis-bought. A retention policy is not a backup. A recycle bin is not a backup. A synchronised folder is not a backup, because it synchronises the encryption faithfully. Read carefully where a product puts the copy: Microsoft’s own Microsoft 365 Backup states that data never leaves the Microsoft 365 data trust boundary and honours your existing data residency. That is a genuinely useful product for fast restores of SharePoint, OneDrive and Exchange content, and it is not a copy held somewhere a compromise of the tenant cannot reach.

Only then does a paid security tier start earning its place, and what it buys is management rather than protection. Windows already has a scanner. What Business Premium adds is a console in front of it, a policy that applies to every machine whether or not somebody remembered, mail inspection beyond the baseline, and sign-in rules that can look at the device rather than only the password.

Full reference

The order, and what each position costs you

Identity: the free tier does more than most people assume

Security defaults are a switch, not a policy engine. They apply to everybody, they cannot be tuned, and that is the point: they are designed for an organisation with no capacity to design conditional access rules. Turn them on, register administrators first, and prefer an authenticator app or a security key over text messages. Make sure the emergency administrator account is covered by a documented process rather than by an exception nobody reviews.

What the free tier does not give you is conditional access, which is where a rule can vary by device state, location, application or risk. That needs Microsoft Entra ID P1, and Microsoft documents that Business Premium customers can use conditional access as well. Risk-based policies that react to a suspicious sign-in need Entra ID P2, which neither tier includes. If your requirement is ‘everyone uses MFA’, buy nothing. If it is ‘only a compliant device can reach the finance data’, that is the upgrade.

Backup: check where the copy lands before you buy

The useful question is not which product but which failure it survives. Microsoft 365 Backup restores SharePoint sites, OneDrive accounts and Exchange mailboxes quickly, with configurable recovery windows and restore points measured in minutes, and Microsoft is explicit that the copies stay inside the Microsoft 365 data trust boundary. That covers accidental deletion, a bad bulk change and most ransomware that arrives through a synchronised folder. It does not cover the case where the tenant itself is the thing you have lost control of, which is the case a separate off-platform copy exists for.

Whichever you buy, the number that matters is not the price. Test one restore each quarter and write down how long it took. That figure is how long the business would be stopped, and it is worth knowing before the day you need it.

What the paid tier actually contains

Where to start, by situation

• No budget at all: security defaults, a patching deadline, standard accounts and a rule that bank detail changes are verified by phone on a number you already held. Four controls, no invoice.
• One purchase only: backup, and specifically a copy the tenant cannot delete. It is the control that turns a disaster into an inconvenience.
• Somebody has just become accountable for the machines: move to the plan that includes management and endpoint protection, and enrol the devices while there are still only ten of them.
• You have servers: they are not covered by client endpoint licences. Add the servers add-on per instance, and remember it is capped at 60 per subscription.
• You handle client data under contract: read the contract first, because it may specify controls and change this order for you specifically.
• You have already been compromised: incident response and rebuild first, then work down this list from the top rather than buying a product to feel better.

Questions people ask about this