We audited a Northland client’s Microsoft 365 last year. They were paying a separate monthly bill for a device management tool. They already had a better one – it came with the licence they’d been buying since 2021, and nobody had switched it on.
I see this most weeks.
Why the box stays half unpacked
Business Premium is about a dozen products behind one price.
You get sold it for email. Email works on day one, so the rest sits there. Nobody’s job is to go back six months later and ask what else came with it.
So businesses go out and buy things they’ve already got.
The five I find most often
- Intune (device management). Wipe a stolen laptop remotely. Push settings to every machine at once. A new PC configures itself when the staff member logs in. This is the one people pay twice for.
- Conditional Access. MFA (multi-factor authentication) is the lock on the front door. Conditional Access is the rule about who gets to knock – block sign-ins from outside New Zealand, or from a device you don’t manage. Microsoft switches on a couple of basic policies these days. Almost nobody tunes the rest.
- Defender for Office 365. Sandboxes attachments before they land & re-checks links at the moment someone clicks. Most invoice fraud we see comes through a link that was clean on delivery and weaponised an hour later.
- OneDrive Known Folder Move. Desktop, Documents & Pictures go to the cloud automatically. Staff don’t have to remember anything. It isn’t proper backup, but it stops the everyday disasters.
- Bookings & Planner. Already paid for. I still see businesses running separate subscriptions for both.
Where the money gets wasted
Business Premium also includes Defender for Business – EDR (endpoint detection & response) on every machine.
Bolting a third-party antivirus on top of that is money down the drain. You’re paying twice for the same job.
Defender finds plenty. The catch is that the alerts land in a console nobody opens at 2am.
So the add-on worth paying for isn’t another product – it’s a SOC (security operations centre). A team watching those alerts around the clock and acting on them. Ours went through 351 million security events last year to surface 30 real incidents. Those 30 are the ones that would have ruined somebody’s month.
Cut the duplicate antivirus, put the money into someone actually watching. That trade is worth making.
Secure Score
Microsoft gives every tenant a Secure Score – a live measure of how locked down your Microsoft 365 is. MFA coverage, admin protection, mail rules, device policy.
We hold every managed client above 70%. Most tenants we see for the first time sit well below it, and almost none of the gap costs anything to close. It’s configuration that came with the licence.
Same ground SMB1001 Gold covers – 27 controls, checked by an outside body rather than self-declared. We went through it ourselves before asking a client to.
Three questions for whoever manages your tenant
“What’s my Secure Score, and what were the last three things you changed to move it?” Someone managing it properly answers both halves in a minute.
“What am I paying for separately that’s already in my licence?” Ask for the list.
“Which licence are we on?” Basic, Standard & Premium are very different animals. Basic is fine for someone who only ever picks up email on their phone. Standard is where people get caught – it reads like the sensible middle option, and it’s missing Intune, Conditional Access & Defender for Office 365. Every one of the features that actually matters. Plenty of businesses have sat on Standard for years without knowing it.
Next step
Take the free 2-minute Cyber Readiness Check – it walks you through the gaps most Northland businesses have.
Or if you’d rather someone just looked at your tenant and told you what’s paid for and switched off, see what managed IT support covers or give us a ring on 09 222 7770.
Nice and simple.