Microsoft 365 for Small Business: Which Plan, and How to Set It Up Right

Updated October 22, 2026

Microsoft 365 is the default for most Virginia small businesses: email, Word and Excel, Teams, and file storage in one subscription. Buying it is easy. Picking the right plan and configuring it well is where most businesses leave security and money on the table.

The three business plans

Microsoft’s small-business plans cover up to 300 users. The differences come down to whether you get the desktop Office apps and how much security and device management is included.

Prices are approximate, change periodically, and run higher on month-to-month billing. Check Microsoft’s current pricing before you buy.

Which plan should you choose?

Business Basic works for staff who only need email and web-based Office, such as field workers, drivers, or part-timers.

Business Standard is the most common choice for office staff who live in Excel and Outlook. Its gap is security: it includes basic protections, but not device management or Conditional Access.

Business Premium is what we’d recommend for any business that handles customer financial, health, or legal data, or that has cyber insurance asking hard questions. It adds:

• Intune, so you can require passwords and encryption on laptops and phones, and wipe company data from a lost device.
• Defender for Business, endpoint detection and response for Windows and Mac.
• Defender for Office 365, which scans links and attachments in email more thoroughly.
• Conditional Access, which lets you set rules like “only allow logins from company devices” or “block logins from outside the US.”

You can mix plans. A common setup is Premium for office staff and Basic for field staff.

The setup most businesses get wrong

Signing up takes ten minutes. These are the settings that often get skipped:

1. MFA for every account. New tenants get Microsoft’s “security defaults,” which require MFA. Older tenants may not have them on. Either turn on security defaults or, with Premium, use Conditional Access policies. See how to set up MFA.
2. Separate admin accounts. The person who manages Microsoft 365 should do it from a separate admin login, not their everyday mailbox.
3. Block legacy authentication. Older email protocols can’t do MFA, and attackers use them to get around it. Security defaults and Conditional Access can block them.
4. SPF, DKIM, and DMARC for your domain. These records prove your email is really from you and protect your domain from being spoofed. Microsoft doesn’t turn on DKIM for custom domains automatically. See our email authentication guide.
5. External forwarding alerts. A classic attacker move is a hidden rule forwarding a victim’s email to an outside address. Block automatic external forwarding unless you need it.
6. Back up Microsoft 365. Microsoft keeps your service running, but its retention isn’t designed as a backup. A third-party Microsoft 365 backup costs a few dollars per user per month. See backup and disaster recovery.
7. Use SharePoint and Teams for shared files. Shared files living in one person’s OneDrive become a problem the day that person leaves.

Licensing tips that save money

• Annual commitments cost less than monthly billing, but you can’t reduce seats mid-term. Keep a few people on monthly if your headcount fluctuates.
• Remove licenses when people leave. Convert a departed employee’s mailbox to a shared mailbox (free under 50 GB) instead of paying for a license indefinitely. See our offboarding checklist.
• Nonprofits qualify for Microsoft’s nonprofit pricing. The offers changed in 2025, so check Microsoft’s current nonprofit terms. See our guide for Virginia nonprofits.

Microsoft 365 vs. Google Workspace

Google Workspace is a good product and costs about the same. Choose Google if your team already works in Gmail and Google Docs and rarely trades complex Excel or Word files with outside parties. Choose Microsoft if you depend on desktop Excel, your clients and vendors send Office files, or you want Intune and Defender bundled in one plan. Industry software also matters: many accounting, legal, and medical applications assume Outlook.

Switching later is possible but disruptive, so it’s worth getting this choice right the first time.