Is Microsoft 365 Business Premium Enough for the Essential Eight?

Last reviewed: October 2026

Short answer: Mostly, for Maturity Level One. Microsoft 365 Business Premium includes Intune, Entra ID P1 and Defender, the tools ASD’s small business cloud guides are built on. Some controls need more: Entra ID P2 for privileged access, and Microsoft 365 Apps for enterprise to enforce macro settings at Level Two. Licences alone don’t make you compliant; configuration and evidence do.

This guide is for business owners and internal IT staff who already use Microsoft 365 and want to know where they stand. It goes strategy by strategy, shows what Business Premium gives you, what’s commonly added, and where the real work sits. If you’re new to the framework, start with our plain-English guide to what the Essential Eight is.

The short answer, strategy by strategy

The table maps each of the eight mitigation strategies to the Business Premium features that support it. “Commonly added” lists the licences or tools Australian providers often recommend on top, mainly for Maturity Level Two.

Essential Eight strategy	What Business Premium gives you	What’s commonly added	Notes for Level One / Level Two
Application control	Intune App Control for Business (and AppLocker) policies for Windows devices	Usually nothing extra, just time to build and test an allow-list	The licence is rarely the blocker. Designing, testing and tuning the allow-list is the work, and Level Two extends it to internet-facing servers.
Patch applications	Intune app deployment and update policies; core vulnerability management in Defender for Business	A third-party patching tool for non-Microsoft apps	Both levels expect fortnightly asset discovery and regular vulnerability scanning. Third-party apps are the usual gap.
Configure Microsoft Office macro settings	Intune policies for Microsoft 365 Apps for business	Microsoft 365 Apps for enterprise (in E3/E5 or as an add-on)	Several Australian providers report that enforcing macro settings at Level Two needs Apps for enterprise.
User application hardening	Intune security baselines and Microsoft Edge and Office hardening policies	Hardening for other browsers and PDF software you use	Mostly configuration. Users must not be able to change the security settings.
Restrict administrative privileges	Separate admin accounts, role-based access and Conditional Access (Entra ID P1)	Entra ID P2 for a few administrators (Privileged Identity Management)	ASD’s own small business example uses PIM, which needs P2. Level Two also expects privileged access events to be centrally logged.
Patch operating systems	Intune update rings and the Windows Autopatch features available to Business Premium	Windows Enterprise E3/E5 for the full Autopatch feature set	Business Premium covers the core of this strategy; the effort is in reporting and chasing devices that fall behind.
Multi-factor authentication	Entra multi-factor authentication, Conditional Access, Windows Hello for Business and phishing-resistant methods	FIDO2 security keys for some staff	Level Two expects phishing-resistant MFA for users of online services and systems, and central logging of MFA events.
Regular backups	Retention policies and recycle bins (useful, but not an independent backup)	Microsoft 365 Backup (pay-as-you-go) or a third-party backup service	Under Microsoft’s shared responsibility model your data stays your responsibility. Restores must be tested.

What Business Premium actually includes

Business Premium is Microsoft’s top small business plan, for organisations with up to 300 users. On top of everything in Business Standard, Microsoft’s Australian plan comparison and Microsoft Learn list these security and management features:

• Microsoft 365 Apps for business: desktop Word, Excel, PowerPoint and Outlook, plus web and mobile versions.
• Microsoft Entra ID P1: Conditional Access, multi-factor authentication and group-based access control.
• Microsoft Intune Plan 1: device enrolment, compliance policies, app deployment and Windows update management.
• Microsoft Defender for Business: endpoint protection, endpoint detection and response, and core vulnerability management for Windows, macOS and mobile devices.
• Microsoft Defender for Office 365 Plan 1: protection against phishing and malicious links and attachments in email and Teams.
• Microsoft Purview Information Protection and data loss prevention: sensitivity labels and rules that stop sensitive data leaving by email or file sharing.

Two limits are worth knowing. Defender for Business covers devices, not servers; servers need their own licences. And Business Premium’s Office apps are Apps for business, not Apps for enterprise, which matters for macro controls at Level Two. Sources: Microsoft’s plan comparison, Microsoft Entra licensing and Defender for Business, checked October 2026.

Maturity Level One with Business Premium

ASD’s Small Business Cloud Security Guides are the closest thing to an official Business Premium playbook. They say you’ll need Microsoft 365 Business Premium (or equivalent) to follow their technical examples, and that “a limited number of administrators will also require an Azure Active Directory Premium P2 subscription”. Azure Active Directory is now called Microsoft Entra ID. ASD’s restrict administrative privileges example uses Privileged Identity Management (PIM), which needs P2.

ASD is also clear about what the guides are not. They are an adaptation of the Essential Eight for small businesses and “are not designed to help an organisation reach a particular maturity level”. In other words, following the guides is a strong start, but it isn’t the same as being assessed at Level One.

In practice, Business Premium gives you the tools for most Level One requirements: MFA for online services, blocking macros from the internet, patching through Intune, separate admin accounts and basic application control. What decides whether you actually meet Level One is how those tools are set up, and whether you can prove they’re working.

Where Business Premium falls short for Maturity Level Two

Level Two raises the bar on every strategy. Microsoft Learn notes that Level Two is the mandatory target for non-corporate Commonwealth entities, and some government contracts and cyber insurers ask about it. These are the gaps most often reported for Business Premium.

Privileged access

Level Two expects privileged access to be disabled after 12 months unless revalidated and after 45 days of inactivity, and privileged access events to be centrally logged. Just-in-time admin access through PIM and access reviews need Entra ID P2, which Business Premium doesn’t include. P2 comes with Microsoft 365 E5 or can be bought on its own for the few people who need it (Microsoft Learn).

Office macro enforcement

Level Two adds controls such as blocking macros from making Win32 API calls, with settings users can’t change. Australian providers including Think Technology report that enforcing macro settings at Level Two needs Microsoft 365 Apps for enterprise, which is in Microsoft 365 E3 and E5 rather than Business Premium.

Central logging and detection

Level Two expects MFA events, privileged access events and application control events to be centrally logged, protected from tampering and analysed in a timely manner (Essential Eight Maturity Model). Business Premium records plenty of activity, but collecting, keeping and reviewing those logs takes a SIEM or a monitoring service. That’s where central logging and 24/7 threat monitoring come in.

Add-ons or E3/E5?

You can close most gaps two ways: add targeted licences (Entra ID P2 for administrators, Apps for enterprise for the users who need it) to Business Premium, or move some or all users to Microsoft 365 E3 or E5. Which is cheaper depends on your user count and which controls you’re missing. Microsoft’s prices and bundles change often, so check current pricing with us or Microsoft before you decide.

Licences aren’t the hard part: configuration and evidence

A Business Premium tenant left on default settings doesn’t meet any maturity level. Modern 42 makes the same point in its Essential Eight licensing guide: the licence tier decides which tools are available, and configuration decides whether they actually do anything. To count, each control has to be:

• Configured: policies applied to every user and device, not just a pilot group.
• Tested: application control and macro rules checked so they don’t break the software your staff rely on.
• Monitored: someone watching for devices that fall out of compliance, failed patches and unusual sign-ins.
• Evidenced: reports and screenshots an assessor or insurer can check.

This is where many small businesses get stuck. The tools are already paid for, but nobody has had time to configure them properly. If you’d like help, our Microsoft 365 support team configures these controls, and our managed IT services keep them monitored 24/7.

The framework is evolving

The current Essential Eight Maturity Model is the November 2023 release (ASD). In June 2026 iTnews reported that ASD plans to deprecate the Essential Eight in about 12 months and retire it within two years, replacing it with a new “Essentials” series. Until then the November 2023 model is the one assessors use, and the controls themselves (patching, MFA, admin control, backups) remain good practice whatever replaces it.

What to do next

1. Check your licences. Confirm who has Business Premium and who is on Basic or Standard.
2. Run an Essential Eight assessment. Find out where you actually stand on each strategy. Our Essential Eight assessment starts from $2,590 ex GST.
3. Fix Level One gaps. Most can be closed with the Business Premium tools you already pay for.
4. Decide on Level Two add-ons. Only if your clients, insurer or contracts need it.
5. Monitor and re-assess. Controls drift as staff, devices and software change.

We support businesses across South East Queensland from our Toowoomba head office and our Gold Coast office in Bundall. See our managed IT in Toowoomba and managed IT on the Gold Coast, or read what managed IT costs in Queensland.

Frequently asked questions

Does Business Premium meet Essential Eight Maturity Level One?

It includes most of the tools needed for Level One, and ASD’s small business cloud guides are written for Business Premium or equivalent. You still have to configure, test and maintain each control, and a few administrators need Entra ID P2 for privileged access management.

Is Business Premium enough for Maturity Level Two?

Usually not on its own. Several Australian providers report gaps in privileged access management (Entra ID P2) and Office macro enforcement (Apps for enterprise), plus stronger logging. Add-ons or E3/E5 licences close most of those gaps.

Do we need Microsoft 365 E5 for the Essential Eight?

Not for Level One. E5 bundles several Level Two and Three tools, but targeted add-ons on Business Premium or E3 can cost less. Decide after an assessment shows which controls you’re missing.

Does Microsoft 365 back up our data?

Microsoft keeps the service available and offers retention, but that isn’t the same as an independent backup you can restore from on demand. Microsoft sells Microsoft 365 Backup separately, and many businesses add it or a third-party backup to meet the regular backups strategy.

Can Intune handle application control?

Yes. Intune can deploy App Control for Business and AppLocker policies to Windows devices, but building and tuning an allow-list takes testing so legitimate software isn’t blocked.

Is the Essential Eight still current?

Yes. The November 2023 maturity model is current as at October 2026. ASD has said it plans to replace the Essential Eight with a new series over about two years, so expect the details to change; the core controls are well-established security practice.

Can Loginet assess and configure this for us?

Yes. Loginet runs Essential Eight assessments from $2,590 ex GST and configures Microsoft 365 security, with CEH-certified engineers and 24/7 monitoring. Call (07) 4599 7909.

Sources

• ASD, Small Business Cloud Security Guides: Introduction
• ASD, Technical example: Restrict administrative privileges
• ASD, Essential Eight Maturity Model (November 2023)
• Microsoft Learn, Essential Eight overview
• Microsoft, Compare all Microsoft 365 business plans (Australia)
• Microsoft Learn, Microsoft Entra licensing
• Microsoft Learn, Microsoft Defender for Business
• Microsoft Learn, Manage approved apps with Intune App Control for Business
• Microsoft Learn, Windows Autopatch overview
• Microsoft Learn, Microsoft 365 Backup overview
• Microsoft Learn, Shared responsibility in the cloud
• Think Technology, Business Premium and Essential Eight macros
• Modern 42, Essential Eight and Microsoft licensing
• iTnews, ASD to retire Essential Eight cyber security framework within next two years (24 June 2026)

Sources checked October 2026.

Book an Essential Eight assessment

Find out where your Microsoft 365 setup stands and what it would take to reach Level One or Level Two. Book an Essential Eight assessment or call (07) 4599 7909.