Microsoft 365 licence tiers and security features.
Which security features are available at which licence tier. Reference guide for understanding what your current subscription includes and what requires an upgrade.
Not all CIS controls are available on all licences.
The CIS Microsoft 365 Benchmark includes controls that require specific licence tiers to implement. An organisation running Microsoft 365 Business Basic will not have access to Conditional Access, Microsoft Defender for Office 365 Plan 2, or Purview DLP features. These are real compliance gaps that cannot be resolved by configuration alone — they require a licence upgrade.
The Datatechs assessment report identifies which failing controls are configuration gaps (fixable without additional spend) and which require a licence upgrade to address. This guide provides a reference for the most security-relevant features by tier.
Key security features by licence.
Foundation security
- Multi-factor authentication (MFA)
- Security defaults
- Exchange Online Protection (EOP)
- Basic audit logging
- SharePoint/Teams security baseline
Enhanced security
- Conditional Access (Entra ID P1)
- Microsoft Defender for Business (BP) / Endpoint Plan 1 (E3)
- Microsoft Intune device management
- Microsoft Purview compliance portal
- Advanced audit logging (90 day)
Advanced security
- Microsoft Defender for Office 365 Plan 2
- Entra ID P2 (Identity Protection)
- Microsoft Purview DLP and sensitivity labels
- Microsoft Sentinel integration
- Advanced audit logging (365 day)
Want to know which controls your licence supports?
The Datatechs CIS M365 assessment report tells you which failing controls are configuration gaps and which require a licence upgrade to resolve.