Tag: Security

Microsoft Purview Message Encryption in SMB: Setup and Effective Use

Microsoft Purview Message Encryption is a cloud-based email encryption and rights management solution that helps protect sensitive emails in Microsoft 365. This report explains what Purview Message Encryption is, how it works, and provides step-by-step guidance to set it up and use it effectively in a small or medium-sized business (SMB) with Microsoft 365 Business Premium. We also cover policy configuration (mail flow rules and sensitivity labels), licensing considerations (assuming the organisation already has Business Premium), and best practices. All pricing is provided in Australian dollars (AUD) for clarity.

What is Microsoft Purview Message Encryption?

Microsoft Purview Message Encryption (formerly known as Office 365 Message Encryption, OME) is an online email protection service built on Azure Rights Management (Azure RMS)[1]. It combines strong encryption with fine-grained access controls (rights management) to secure email communication. With Purview Message Encryption enabled, users can send encrypted emails to recipients inside and outside the organisation. The encryption is enforced such that only recipients who authenticate with the allowed credentials (e.g. their Microsoft 365 or Gmail account, as specified by the policy) can decrypt and read the message; anyone else who intercepts it sees indecipherable content[2].

Purview Message Encryption enhances the default security of email in Microsoft 365. By default, Microsoft 365 already encrypts data in transit between its data centers and uses TLS encryption for emails in transport. However, Purview Message Encryption goes further by encrypting the message content itself and applying persistent protection. This means the protection stays with the email even after it leaves Microsoft’s servers, and it can enforce restrictions like “Do Not Forward”. For example, you can send an email that cannot be forwarded or printed by the recipient, or an email that only specific people (inside or outside your company) are permitted to open[3]. The encryption persists regardless of where the email goes – it remains encrypted at rest in mailboxes and in transit over the internet[3].

How it works: Purview Message Encryption uses Azure RMS (part of Microsoft Purview Information Protection) to encrypt the email and any attachments, and to apply rights policies. When an authorised recipient attempts to open an encrypted email, Outlook (or the viewer portal) checks their identity against the email’s permissions. If permitted, the service silently decrypts the content for viewing; if not, access is denied[3]. Internally, Office apps like Outlook, Outlook on the web, or mobile Outlook provide a seamless reading experience – users see the content normally if they have access rights. External recipients (for example, a client using Gmail) receive an email notification (often branded with your company’s details) stating that they’ve received an encrypted message. They are prompted to authenticate (using a one-time passcode or by signing in with a Google/Microsoft account) on the encrypted message portal, after which they can read and respond securely through that portal[1]. This approach means you can safely send confidential data to any email address.

Comparison to traditional encryption: Unlike S/MIME encryption (which requires exchanging certificates) or manual password-protected attachments, Purview Message Encryption is centrally managed and user-friendly. The sender doesn’t need the recipient’s public key or a shared secret; instead, the encryption and key management are handled by Azure RMS. The recipient just needs to verify their identity. Purview Message Encryption was introduced as an evolution of the legacy OME and Information Rights Management (IRM) features in Exchange. In fact, Office 365 Message Encryption (OME) was retired in July 2023 and automatically replaced by Purview Message Encryption, which provides a more streamlined experience[4]. Key improvements in the new Purview solution include an “Encrypt-Only” option (allowing encryption without restricting recipient actions, for easier collaboration), the ability for users to manually encrypt emails directly in Outlook (not only via admin rules)[4], and a unified experience for both internal and external recipients (no more downloading of HTML attachments; external users use a web portal)[4].

Example use cases: An SMB might use Purview Message Encryption to protect emails that include personally identifiable information (PII) like customer contact details or tax file numbers, financial data like bank account or credit card numbers, or any confidential business information. For instance: an accounting firm can ensure that all emails containing tax file numbers or financial statements are encrypted; a healthcare clinic can automatically encrypt emails with patient data to comply with privacy laws; or staff could manually choose a “Confidential – Recipients Only” label when sending internal strategy documents to prevent those emails from being forwarded outside the company.

Licensing and Requirements

One of the advantages for SMBs with Microsoft 365 Business Premium is that Purview Message Encryption is already included in your subscription[4]. Business Premium includes Azure Information Protection (AIP) Plan 1[5][5], which provides the rights management and labeling capabilities underpinning Purview Message Encryption. This means you do not need to purchase any additional licenses to use the standard email encryption features.

To clarify how Purview Message Encryption is licensed, the table below compares Business Premium with other Microsoft 365 plans in context:

Plan or LicenseEmail Encryption AvailabilityAdditional Requirements?Price (AUD)*
Microsoft 365 Business PremiumIncluded – Purview Message Encryption via AIP Plan 1[4]No extra license needed. Azure RMS is automatically available.$32.90 user/month (ex. GST)[5]
Microsoft 365 Business Standard / BasicNot included by default in these plans.Requires add-on: Purchase Azure Information Protection Plan 1 for each user to enable Purview Message Encryption[4].$18.70 / $9.00 user/month (ex. GST) + AIP P1 add-on (~$2.80 ex. GST per user/month)[5][6]
Office 365 E3 / Microsoft 365 E3Included – Rights Management (AIP P1) is part of E3[1].No extra license needed for standard encryption features.~$32.80 user/month (ex. GST) for Office 365 E3[7].
Office 365 E5 / Microsoft 365 E5Included – AIP Plan 2 is included, which adds Advanced Message Encryption.No extra license needed; advanced features available (e.g. decrypting/revoking email).~$56.40 user/month (ex. GST) for Office 365 E5[7].

*Prices are per-user, per-month in Australian dollars. Business plans are listed at annual commitment rates excluding GST[5]; enterprise plan prices are approximate. GST in Australia is 10%, so e.g. Business Premium is about $36.19 including GST.

As shown above, Microsoft 365 Business Premium already covers the necessary licensing. If an organisation had Business Standard or Business Basic, they would need to add Azure Information Protection Plan 1 licenses (approximately A$3 per user per month) to get the encryption capability[4][6]. Enterprise E3 plans include it by default, and E5 plans include even more capabilities (more on Advanced Message Encryption below). Each user who sends or reads encrypted emails should be licensed appropriately[4].

Technical requirements: The core requirement to use Purview Message Encryption is that the Azure Rights Management service is activated for your tenant[8]. In most cases, for eligible plans like Business Premium, this service is activated automatically by Microsoft, so no manual step is needed[8]. It’s essentially “on” if you have the right license. However, if your organisation previously used on-premises Active Directory Rights Management Services (AD RMS) or had deliberately turned off Azure RMS, you may need to activate it or migrate to Azure RMS first[4][8]. (This is uncommon for SMBs; it typically applies to larger organisations that had older on-prem infrastructure. In an SMB cloud-only environment, you can assume Azure RMS is enabled by default.)

To double-check, an admin can run a simple PowerShell command in Exchange Online:

  • Get-IRMConfiguration – this should show AzureRMSLicensingEnabled : True if Azure RMS (and thus Purview encryption) is enabled for your tenant[8].

If it’s False, you can enable it by running Set-IRMConfiguration -AzureRMSLicensingEnabled $True[8]. You might also run Test-IRMConfiguration -Sender <user> -Recipient <user> (using any two user emails in your org) to verify that encryption and decryption tests pass and that it finds the default RMS templates (like “Contoso – Confidential” or “Do Not Forward”)[8]. A successful test confirms that your tenant is correctly configured for Purview Message Encryption.

Advanced Message Encryption (AME): It’s worth noting that Microsoft offers an Advanced Message Encryption feature set for organisations with higher compliance needs. AME is included with the top-tier E5 licenses (or as an add-on via the Microsoft 365 E5 Compliance suite for others)[9]. It builds upon the standard encryption features by allowing more control over encrypted emails. For example, admins can define multiple custom branding templates for different purposes, set expiration dates on encrypted emails, or revoke access to an already-sent encrypted email via the admin portal[9][9]. These advanced controls are particularly useful if you need to automatically expire sensitive emails after a period or track and revoke messages for compliance. However, Advanced Message Encryption is not included in Business Premium, and for most SMB scenarios, the standard encryption (already provided) is sufficient. We will focus on the out-of-the-box capabilities available with Business Premium.

Step-by-Step Setup Guide for Purview Message Encryption

Setting up Purview Message Encryption in a Business Premium tenant involves a few one-time configuration steps by an administrator. Below is an overview timeline of the key steps, followed by detailed guidance:

Let’s dive into each of these steps in detail:

Step 1: Activate (or Verify) Azure Rights Management Service

Why: Purview Message Encryption relies on Azure Rights Management (the encryption engine of Azure Information Protection) to do the encryption and decryption. If Azure RMS isn’t active, encryption will not work.

What to do: In a Business Premium tenant, Azure RMS is typically already activated[8]. To double-check, you can go to the Microsoft Purview compliance portal, navigate to Information Protection > Overview. If you see a banner or option to “Activate” Azure Information Protection, go ahead and activate it. (If everything is already active, there may be no such prompt.)

For a programmatic verification, use PowerShell: Connect to Exchange Online (with an admin account) and run:

Get-IRMConfiguration | fl AzureRMSLicensingEnabled

If it returns True, then RMS is enabled[8]. If False, enable it by running:

Set-IRMConfiguration -AzureRMSLicensingEnabled $true

Additionally, if your organisation had been using an on-premises AD RMS server in the past and you haven’t yet switched, you must migrate to Azure RMS first[4]. (This likely doesn’t apply to a cloud-based SMB setup.)

Optional – Bring Your Own Key: By default, Microsoft manages the cryptographic keys used for encryption. Some organisations (usually larger or highly regulated ones) prefer to manage their own root key for encryption (a process called BYOK – Bring Your Own Key). This is complex and typically not necessary for an SMB. Microsoft recommends most customers let the service manage keys[8]. If BYOK is desired for compliance reasons, it should be done before broad deployment of encryption. (BYOK setup involves Azure Key Vault and is beyond the scope of this guide, but it’s supported[8].)

Step 2: Verify Configuration with Test Commands

After activation, it’s good practice to verify that encryption is fully functional in your tenant:

  • Run Test-IRMConfiguration -Sender <user@yourorg.com> -Recipient <user@yourorg.com> in Exchange Online PowerShell (substitute any valid sender and recipient in your organisation)[8]. This test attempts to acquire RMS templates, then encrypt and decrypt a sample message internally. You should see output with PASS results for acquiring templates, encryption, decryption, and IRM being enabled[8]. Typically, it will list available templates such as “ – Confidential”, “Do Not Forward”, etc., and conclude with “Overall Result: PASS”.
  • If the test fails with an error like “Failed to acquire RMS templates”, it may indicate Azure RMS wasn’t enabled or there’s a configuration issue. The Microsoft documentation provides additional PowerShell steps to troubleshoot this (for example, connecting to the AIPService module to set the licensing location)[8]. In most cases, with Business Premium, this step will pass on the first try if your licenses are assigned properly.

This verification ensures that your tenant is ready to start encrypting emails.

Step 3: Create Mail Flow Rules to Encrypt Emails (Automatic Encryption)

Mail flow rules (also known as transport rules) allow administrators to automatically apply encryption to emails that meet certain conditions. This is the primary way to enforce encryption consistently without relying solely on users. You can create rules, for example, to:

  • Encrypt all outbound emails sent to recipients outside your organisation (external email).
  • Encrypt messages that contain certain sensitive keywords or data (like “Confidential”, or credit card numbers, etc.).
  • Encrypt emails sent to specific recipients or domains (for instance, always encrypt emails sent to a particular partner organisation or a specific client’s email address).
  • Prevent recipients from forwarding certain emails by using a “Do Not Forward” template.

How to set up a new rule: Use the Exchange Admin Center (EAC) for a GUI approach or PowerShell for scripting. In the new EAC (https://admin.exchange.microsoft.com) go to Mail flow > Rules and click + Add a rule. Give the rule a name (e.g. “Encrypt outgoing financial data”). Then:

  • Conditions: Under “Apply this rule if…”, choose the condition that triggers encryption. Common conditions are:
    • “The recipient is located – Outside the organization” (to target external emails)[10].
    • “The subject or body includes – ” or “The message contains sensitive information – ” (to target specific content).
    • “The recipient domain is – \” (to target specific partner domains).
    • You can combine multiple conditions with Add condition for specificity (e.g. external + contains “Project X”)[10][1].
  • Actions: Under “Do the following…”, select Modify the message security > Apply Office 365 Message Encryption and rights protection[10]. Once you select this, another drop-down appears to choose an RMS template. Here you will see options like Encrypt, Do Not Forward, and any custom templates/labels you have.
    • Choose Encrypt if you just want to encrypt (allowing recipients to forward or reply normally, but the message stays encrypted).
    • Choose Do Not Forward if you want to encrypt and restrict recipients from forwarding or copying the content.
    • (If you had published sensitivity labels that include encryption, their names might also appear here as available templates.)
    • After selecting the template, click Save.
  • You can add additional actions if needed (for example, adding a footer to notify the recipient that the message was encrypted). But typically just applying encryption is enough.
  • Exceptions (optional): You may add exceptions if there are cases you don’t want to encrypt even if conditions match. For example, you might exclude a specific internal sender or a trusted external domain from the rule.
  • Mode: Set the rule to Active (or test in audit mode first if you prefer). Save the rule.

Once enabled, any new email that meets the conditions will be automatically encrypted as it’s sent out. For instance, if you created a rule to encrypt all external mail, whenever a user sends an email to an @gmail.com or any non-company address, Exchange will apply encryption before delivering the message. These rules are enforced on the server side, so they work regardless of whether the user is on Outlook desktop, mobile, or another client.

Important: Mail flow rules cannot encrypt messages incoming from outside senders to you – they only act on messages your users send. If, for example, an external partner sends you an unencrypted email with sensitive info, the Exchange Online transport rule can’t retroactively encrypt that inbound message[10]. It will be delivered as is. (Transport rules in Exchange Online don’t support encryption as an action on incoming mail from outside, by design.) To protect inbound communications, you’d have to rely on the sender encrypting it on their side or use other methods (like asking them to use a secure portal).

You can create multiple mail flow rules for different scenarios as needed. Microsoft’s rules are quite flexible – you can combine conditions (AND/OR logic) and have multiple separate rules to handle various needs[1]. When you have more than one encryption rule, be mindful of their order and if any might overlap; rules can be ordered and if two rules apply encryption, the result is the same (the email is encrypted once). Also, consider adding a rule to strip encryption in certain cases if needed (for example, some organisations add a rule to decrypt emails sent to an internal archiving mailbox or certain internal tools, so that those systems can index or scan the content). Microsoft provides guidance on creating a rule to remove encryption as well[10], but for most SMB scenarios this may not be necessary.

After setting up your encryption mail flow rules, you effectively have automatic encryption policies in place. This is great for compliance: it doesn’t rely on employees remembering to do anything. For example, you could enforce that all emails leaving your company with an attachment get encrypted, or any email mentioning “Payroll” that goes externally is encrypted.

Tip – using Data Loss Prevention (DLP): In Business Premium, you also have Microsoft Purview Data Loss Prevention available. A DLP policy can detect sensitive info (like credit card or TFN numbers) and one of the possible actions is to encrypt the message. This is essentially another way to create content-based encryption rules, with a richer interface for detecting sensitive info types. For instance, a DLP policy could automatically encrypt any email that contains a tax file number or health record. This achieves a similar outcome as mail flow rules. In fact, one recommended approach (for scenarios like HIPAA in healthcare) is to use DLP as a “smart filter” that scans emails and then triggers encryption when a sensitive data pattern is found[11]. The advantage of using Purview DLP policies for this is that you get benefits like detailed incident logging and user notifications. According to a case study, this delivers “zero user effort” (encryption happens even if staff forget), central control (one admin policy covers all mailboxes), and audit-ready logs of every encryption action[11]. In summary, DLP and mail flow rules both can automatically apply encryption – you can choose whichever method fits your admin comfort. (Mail flow rules are simpler to set up for straightforward conditions; DLP is powerful for detecting specific data types.)

Step 4: Set Up Sensitivity Labels for Encryption (Manual User-Driven Encryption)

While mail flow rules handle automatic encryption, you also likely want to empower users to manually encrypt emails when they choose. Business Premium allows you to create sensitivity labels in the Purview Compliance portal, which users can apply to emails or documents. These labels can be configured to include encryption.

For example, you might create a label called “Confidential – All Employees” that, when applied to an email, automatically encrypts it and only allows people within your organisation to open or read it. Or a label “Highly Confidential – No external sharing” that not only encrypts the email but also uses the “Do Not Forward” policy so recipients (even internal ones) cannot forward or copy the content.

How to create a sensitivity label with encryption:

  1. In the Microsoft Purview compliance portal (https://compliance.microsoft.com), go to Information Protection > Labels and click + Create a label.
  2. Give the label a name (e.g. “Confidential – Company Only”) and description for users.
  3. For the label scope, make sure Emails (and files, if desired) is selected, so that this label can apply to email content[3].
  4. In the configuration, you’ll have options for adding encryption. Enable the setting to “Encrypt content” (in older interface this might be a checkbox like “Protect content” or “Control access to content”[3]).
  5. You will be asked to choose how to assign permissions:
    • Assign permissions now: You as the admin specify exactly who can do what with content under this label. For instance, you can state “Only users inside my organisation can view this email; they cannot forward or print it” (which is effectively an internal-only, do-not-forward policy). You could also allow some group full rights and others read-only. This is static; end users applying the label don’t get to change the permissions.
    • Let users assign permissions when they apply the label: This option is useful if you want to give users some flexibility. With this, when a user applies the label in Outlook, they will be prompted to enter who should be able to access the content (they could type in specific email addresses or choose from a directory) and what permissions to give. This is akin to users creating an ad-hoc encryption rule on the fly, within the bounds you allow[3].
    For simplicity in an SMB, the first option (assign now) is commonly used. For example, define that the label encrypts the email and allows “All internal users” to read it (so any external recipients would not be able to decrypt it). Or define a label that allows only certain departments.
  6. If assigning permissions now, configure the specifics:
    • Choose the users or groups who will be granted access when this label is applied (e.g. All members of for all internal).
    • Choose their permissions: e.g. Viewer (read-only), or Editor (read and modify), etc. For email scenarios, typically read-only is used if you want to prevent forwarding, whereas if you just want to allow normal usage, giving view + edit might be fine (edit in context of email means ability to reply/forward I believe).
    • If relevant, you can tick an option “Do not allow forwarding” which automatically restricts forwarding and copying from the email (this is essentially the Do Not Forward template enforced via the label).
    • You can also set content expiration here (e.g., email content expires after 30 days) if using Azure Information Protection P2, but with P1 (Business Premium) this might not be available in sensitivity labels interface. Typically expiration is an advanced feature.
    • You might see an option for offline access or the number of days a user can access the content without re-authenticating – these are fine-tuning options.
  7. Finish the label creation. Then, publish the label by creating a Label Policy (in Information Protection > Label Policies, include the new label and target it to the desired users or whole organisation). This causes the label to appear in end-user apps.

Once published (it may take a little time or a restart of Office apps to show up), users will see the sensitivity label in their Outlook (on the ribbon or under the Sensitivity button). They can apply it to an email just like they would mark it Confidential. Behind the scenes, as soon as they send an email with that label, the Exchange service will encrypt the message according to the rules you configured.

End-user experience (manual): If no sensitivity labels are defined, users in Business Premium will still typically have an “Encrypt” button in Outlook on the web or under Outlook’s Options > Permissions menu, giving them at least the default Encrypt-Only and Do Not Forward choices[1]. However, using custom labels allows you to present more user-friendly or scenario-specific options (with your own descriptions) and to integrate encryption with your classification scheme (e.g. a single label might also add a footer/tag like “Confidential” in addition to encryption).

For example, after the above setup, a user writing an email in Outlook can click the Sensitivity drop-down and choose “Confidential – Company Only”. Immediately, Outlook will show a small lock icon or a note indicating that encryption and forwarding restrictions are applied. When that user sends the email, it will be encrypted and only other people within the company tenant will be able to open it. If they accidentally sent it to an external address, that external recipient would get a message stating the email is protected and they are not authorised to view it (since our hypothetical label didn’t grant external access).

Important considerations with labels:

  • Exchange IRM Configuration: To get the full benefits of using sensitivity labels to encrypt emails, you should ensure IRM is enabled in Exchange (which we did in Step 1)[3]. Otherwise, certain clients might not be able to open encrypted mails and search indexing might not work. We covered this, but it’s worth noting that enabling IRM (AzureRMS in Exchange Online) is what allows even mobile Outlook and web to open these labeled emails seamlessly.
  • Multiple encryption methods: If a user applies a sensitivity label that encrypts an email, you do not need a mail flow rule to also encrypt it (and vice versa). They won’t conflict – the mail flow rule will typically detect the mail is already encrypted and skip, or it will apply encryption to an already encrypted mail which is fine (it remains encrypted). However, generally design your strategy to use either automatic rules for certain scenarios and labels for user-driven ones. They solve different problems (one doesn’t rely on the user at all, the other gives user flexibility).
  • User training: It’s a good idea to show your staff how to use the new sensitivity labels in Outlook. For instance, explain that when they have a particularly sensitive email to send, they should apply the Confidential label before sending. The first time, some may be confused by the experience for external recipients (e.g. “The client said they had to click a link to view my email”). Include that in training so they and the recipient know it’s normal due to encryption.

Step 5: Test the Encryption Setup

Before rolling out broadly, test the configuration:

  • Internal test: Have two users (or use your test account) within the company send encrypted emails to each other. They should be able to open them normally in Outlook (perhaps a small banner might indicate the message is encrypted). This ensures internal access isn’t inadvertently blocked by a policy.
  • External test: Send an email from inside to an outside email (e.g., a personal Gmail or Outlook.com account) that should trigger encryption – for example, an email containing a sensitive keyword if you made that rule, or just any email if you encrypted all external mail. Confirm that:
    • The external recipient gets a mail notification that’s branded (by default it will show your organisation name) saying “You’ve received an encrypted message”[11].
    • The external recipient can follow the link or the instructions to authenticate and read the message in the browser. They might use a one-time passcode or sign in with a Google/Microsoft account. Test both if possible.
    • Check that the content of the message is correct when they do see it (formatting, attachments if any).
    • Reply as the external user through the portal and ensure the internal user can read the reply (the reply will also be encrypted).
  • Policy tuning: If the external email did not arrive encrypted when it should have, double-check the conditions of your mail flow rule or DLP policy (maybe the test didn’t meet the condition exactly)[11]. Also verify the sender has the appropriate license (Business Premium assigned, etc.), since each sender needs a license for encryption to apply[11].

Everything working? Great. Now you can confidently roll this out knowing that protected emails actually reach their destination securely.

Step 6: User Awareness and Best Practices for Effective Use

Finally, effective use of Purview Message Encryption in an SMB isn’t just about configuration – it’s about incorporating it into your organisation’s workflows and culture. Here are some best practices and tips to get the most value:

  • Educate your team: Introduce the feature to your users. Let them know that some emails will now be encrypted and what that means. For example, explain that if they see a lock icon or a banner that says “This message is encrypted” in an email, it’s expected. Likewise, if they send an encrypted email to a client, that client may contact them about the extra step to open it – your user should be able to reassure them it’s for security. Microsoft provides user-friendly guides on how to https://support.microsoft.com/office/cb882d70-47c1-4da6-b7da-4bb6ee4893b4 and how to open one, which you can circulate. In Outlook on the web, the user just clicks Encrypt under the compose options; in desktop Outlook, they can select an Options > Permissions setting or use the Sensitivity button if labels are deployed.
  • Start with clear policies: When deciding what to encrypt, start with the most sensitive or regulated information. Don’t over-encrypt everything, or users might get frustrated with extra steps for trivial email. Common starting points are: encrypt all external emails (if your business frequently sends confidential data externally), or encrypt based on keywords (like “Confidential”, project names) or sensitivity types (like any email with a 9-digit number might be a TFN – treat accordingly). Make sure these rules are well-communicated. For instance, if you choose to automatically encrypt all external mail, users should know every email to a customer will have that behaviour (so they’re not caught off guard by a client’s questions).
  • Use branding for familiarity: You have the option to customise the branding of the encrypted message mail and portal – for example, adding your company logo and a friendly message. This is done via the Set-OMEConfiguration cmdlet (for the standard single template) or in the Purview portal for advanced branding. Consider doing this so that when an external recipient gets an encrypted mail, they see your company’s name or logo on the portal. It helps them trust that it’s legitimate and from you. (Branding is an included feature for one template; multiple templates require AME/E5.)
  • Integrate with DLP for compliance (if needed): As discussed, if you have compliance requirements (like HIPAA for health info, or need to protect credit card data under PCI DSS), leverage DLP policies. DLP can not only encrypt but also notify the sender (policy tip) that “This email was automatically encrypted because it contains XYZ”. This educates users over time on what triggers protection, and it provides an audit trail. In Business Premium, DLP for email is available[2][2] and can be a powerful ally in preventing data leaks.
  • Test periodically: Make encryption testing part of your routine, especially after any Exchange or compliance configuration changes. Ensure new employees have the appropriate license and can use encryption if needed.
  • Monitor and adjust: Check the reports in the Purview Compliance portal. There are audit logs and reports that can show label usage and DLP policy matches. For example, you can see how often your encryption rule triggers, or if any emails were blocked or had encryption removed. This can help fine-tune conditions (to reduce false positives, etc.). In an SMB, volume may be low, but it’s good to keep an eye that it’s working as intended.
  • Know the limits: Be aware of a few limitations: The maximum message size for an encrypted email (including attachments) is 25 MB[4]. This is lower than the regular Exchange Online limit for non-encrypted mail. Very large files might need to be shared via SharePoint/OneDrive instead of email if they can’t be sent due to this limit. Also, if you send to many recipients via BCC, note that in some cases those BCC addresses might be dropped before encryption (an edge case with certain routing scenarios)[4] – generally not an issue unless you do mass BCC mailings.
  • Advanced controls (if ever needed): If one day your SMB grows or has needs to revoke or expire emails, consider advanced message encryption capabilities. For instance, if an employee accidentally sent an encrypted email to the wrong external person, you as an admin could revoke access to that message (if you had Advanced Message Encryption via an E5 Compliance add-on)[9]. This isn’t available in Business Premium by default, but it’s something to be aware of as a potential upgrade if such scenarios are critical.

By following these steps and best practices, even a small organisation can leverage enterprise-grade email encryption with Microsoft 365 Business Premium. You’ll be keeping sensitive communications secure and meeting compliance obligations, all using tools that integrate natively with the email clients your users already use every day.

Conclusion: Microsoft Purview Message Encryption provides SMBs a robust yet user-friendly way to secure email communications. With Business Premium, you have all the needed components (Azure Information Protection P1, Exchange Online, etc.) to deploy it without additional cost. By carefully configuring the service – enabling it, creating sensible mail flow rules, and utilizing sensitivity labels – you can ensure that confidential information in emails is accessible only to authorised recipients, helping protect your business and your customers. Best of all, it achieves this in a manner that is largely seamless to end users and external partners once set up. In summary, Purview Message Encryption, when set up and used effectively, can significantly enhance your organisation’s data protection posture for email with minimal disruption and excellent integration into your existing Microsoft 365 environment.

References

[1] Enabling Microsoft Purview Message Encryption – UC Today

[2] Set up information protection capabilities – Microsoft 365 admin

[3] Apply encryption using sensitivity labels | Microsoft Learn

[4] Message Encryption FAQ | Microsoft Learn

[5] Microsoft 365 Business Plans and Pricing | Microsoft 365

[6] Microsoft Azure Information Protection – Telstra

[7] Office 365 Pricing Australia | Crowd IT

[8] Set up Microsoft Purview Message Encryption | Microsoft Learn

[9] Advanced Message Encryption | Microsoft Learn

[10] Define mail flow rules to encrypt email messages

[11] How to Automatically Encrypt HIPAA‑Sensitive Email with Microsoft …

Microsoft Purview Suite for Business Premium: Features & SMB Use Cases

Introduction

Small and medium-sized businesses (SMBs) today face increasingly sophisticated cyber threats and complex data regulations[1][2]. Microsoft 365 Business Premium already provides a secure productivity foundation for SMBs – including Office apps, Teams, device management, and baseline security like Defender for Business[2]. However, until recently, achieving enterprise-grade compliance and data protection meant costly upgrades to enterprise licenses. To bridge this gap, Microsoft introduced the Microsoft Purview Suite as an add-on to Business Premium, bringing advanced compliance, risk, and data governance capabilities “without the enterprise price tag.”[2] This report details the features included in the Purview Suite for Business Premium, how an SMB can effectively use them, and why they provide real value to a typical SMB.

Business Premium Baseline vs. Purview Suite Add-on

Microsoft 365 Business Premium (base subscription) includes some core compliance capabilities, but with limitations. Out-of-the-box, Business Premium provides Microsoft Purview Information Protection (sensitivity labels and classification) and Office 365 Data Loss Prevention (DLP) policies for Exchange, SharePoint, and OneDrive[3]. It also offers basic eDiscovery for content search and simple legal hold, and basic audit logs (90-day retention) in the compliance portal[3]. These features are useful for controlling information in Microsoft 365 apps – for example, an SMB admin can apply a sensitivity label to mark a document as “Confidential” or set a DLP rule to prevent emails with credit card numbers from leaving the organisation[3]. However, advanced compliance features are not included in the base plan – endpoint DLP (monitoring files on devices), auto-labeling of content, advanced auditing, and insider risk tools all require higher-tier licensing[3].

By contrast, the Purview Suite for Business Premium is a comprehensive compliance add-on (approximately $10 per user/month) that unlocks Microsoft’s E5-level compliance and data governance features for Business Premium subscribers[4][5]. In essence, this add-on brings the full Microsoft Purview capabilities – comparable to what large enterprises get with Microsoft 365 E5 Compliance – into the SMB realm. Key additions include: advanced Information Protection & Governance, Insider Risk Management, Communication Compliance, eDiscovery (Premium), Audit (Premium), and more[4]. The table below highlights the difference between Business Premium’s built-in compliance features and those enabled by the Purview Suite:

Table 1. Key Compliance Features: Business Premium vs. Purview Suite

Compliance FeatureBusiness Premium (Base)+ Purview Suite Add-on
Data Loss Prevention (DLP)✔️ DLP for Exchange email, SharePoint, OneDrive[3]. No Teams chat or device-based DLP.✔️ DLP across M365 (incl. Teams chats) and on endpoints (Windows devices)[1][4] – preventing sensitive data leaks via any channel.
Sensitivity Labels & Encryption✔️ Manual classification labels; apply encryption/protection manually.✔️ Auto-classification of sensitive content using AI and templates; enforce encryption with Microsoft Purview Message Encryption; bring your own key via Customer Key for email/data encryption[2][2].
Insider Risk Management❌ Not included.✔️ Insider Risk Management dashboards and policies to detect suspicious activities (e.g. mass file downloads) by users and alert admins[2]. Privacy controls built-in to protect user identities during investigation.
Communication Compliance❌ Not included.✔️ Communication Compliance to monitor and flag internal communications (Teams, email) for harassment, sensitive info sharing, or policy violations[2] – useful for HR and compliance oversight.
Records & Data Lifecycle✔️ Basic retention policies for email and files (manual setup)[2].✔️ Advanced Records Management capabilities: classify files as official records, apply retention or deletion with event-based triggers and disposition reviews[2]. Ensures data is kept or disposed according to policy.
eDiscovery✔️ Content Search & basic eDiscovery (Compliance Center) for collecting data.✔️ eDiscovery (Premium) – full case management, legal hold, Teams conversation threading, relevance analytics, and export tools for legal investigations[2]. Simplifies responding to lawsuits or internal investigations.
Audit Logging✔️ Standard audit logs (90 days of log retention) for user/activity tracking.✔️ Audit (Premium) – extended audit logs retained for 1 year with more detailed events (e.g. document read/access events)[2]. Critical for forensic investigations and compliance audits.
Compliance Manager✔️ Access to Compliance Manager (basic level) with some assessments.✔️ Full Microsoft Purview Compliance Manager suite with detailed regulation templates and improvement actions tracking[4]. Helps manage GDPR, HIPAA, ISO 27001 and other compliance requirements in one portal.

Notes: Business Premium includes Azure Information Protection Plan 1 (for manual labels) but not Plan 2 features like auto-labeling[5]. The Purview Suite effectively activates the Microsoft 365 E5 Compliance suite (Information Protection & Governance, Insider Risk, eDiscovery & Audit) on top of Business Premium[5][5]. These add-ons are available only to customers with Business Premium and are limited to 300 users (matching the SMB seat cap)[5][5].

Key Purview Suite Features and Effective SMB Use Cases

With the Purview Suite enabled, an SMB gains a broad set of tools to protect data, manage risks, and demonstrate compliance. Below, we explain each major feature area in detail and illustrate how it can be used in an SMB environment:

1. Information Protection & Data Loss Prevention (DLP)

What it is: Information Protection in Microsoft Purview allows organisations to classify and label data based on sensitivity. Labels (such as “Public”, “Confidential”, or “Highly Sensitive”) can be applied manually by users or automatically by the system, and can enforce encryption or access restrictions. Data Loss Prevention policies monitor and prevent the sharing of sensitive information across email, cloud storage, Teams chats, and even on endpoints.

How it helps: This is fundamental for compliance with data protection regulations (like GDPR or HIPAA) and for safeguarding intellectual property. For example, using Purview’s auto-labeling, an SMB can configure rules to automatically detect personal identifiers (like NI numbers or credit card data) in documents and emails and tag them as sensitive[2]. Once labeled, the data carries protections wherever it goes – “a ‘security tag’ stays attached to a document whether it’s stored in OneDrive, shared in Teams, or emailed outside the company”[2]. Policies tied to these labels can block oversharing of sensitive files, ensuring that, say, a file tagged “Confidential – Finance” can only be accessed by the finance team and not emailed externally[2][2].

Purview DLP extends these protections. It runs in the background to stop sensitive information from being shared with unauthorised people[2]. In practice, an SMB can enable templates (Microsoft provides many built-in sensitive info types, e.g. UK National Insurance number, credit card, health record, etc.) so that if an employee tries to email out a client’s personal data or copy it to a USB drive, the DLP policy will warn or block the action. This greatly reduces the likelihood of accidental data breaches. Even Microsoft Teams chats are covered – if someone tries to post confidential customer info in a Teams channel, the message can be prevented from sending (with a notice to the user) under a DLP rule.

Additional benefits: The Purview Suite also adds Microsoft Purview Message Encryption and Customer Key features. Message Encryption allows an SMB to send encrypted emails to any recipient (even outside the organisation) such that only the intended recipient can read it[2]. This is useful when sharing sensitive info with external partners or clients. Customer Key gives the business control over the encryption keys used for Microsoft 365 data, an extra layer of control often needed for strict regulatory compliance[2] (e.g. some finance or legal firms might require holding their own keys for data stored in cloud services). For an SMB dealing with confidential client data, these capabilities provide peace of mind that their emails and files are secure both inside and outside Microsoft’s cloud.

SMB use case example: A small medical clinic (50 staff) must comply with HIPAA privacy rules. Using Purview Information Protection, they label all files containing patient health information as “PHI – Highly Sensitive”. The labels auto-apply encryption, so even if a file is stolen or forwarded, it remains encrypted. DLP policies detect any attempt to email or Teams-chat those files outside the clinic’s domain and block it, preventing accidental leaks. The clinic’s admin also uses Customer Key to manage their own encryption keys for added control over patient data security. This way, even a modest-sized business can enforce data handling rules on par with large hospitals, avoiding compliance violations and costly data breaches.

2. Insider Risk Management & Communication Compliance

What it is: Insider Risk Management (IRM) in Purview uses behavioural analytics to identify risky activities by users within the organisation. It aggregates signals from across Microsoft 365 (file downloads, email forwarding, DLP alerts, etc.) to detect patterns that might indicate a potential insider threat – for example, an unhappy employee exfiltrating data before resignation. Communication Compliance is a related feature that specifically scans internal communications (Teams, Outlook email, Yammer) for policy violations such as harassment, sensitive data sharing, or other misconduct.

How it helps: Together, these tools enable an SMB to spot internal problems early and take action before they escalate. For instance, Microsoft Purview IRM can automatically flag when “an employee [is] downloading large volumes of files before leaving the company”[2] or if someone suddenly starts accessing files they never normally use. The system can generate an alert or case for a designated reviewer (e.g. the IT admin or an HR manager) to investigate. This is extremely valuable for SMBs who often have small IT/security teams – rather than manually combing logs, the tool surfaces suspicious behavior for them. Privacy controls ensure that these investigations don’t unnecessarily expose employees’ personal data; for example, usernames can be pseudonymised until a certain risk threshold is met[2], maintaining trust while enabling oversight.

With Communication Compliance, even without a dedicated compliance officer, an SMB can automatically monitor workplace communications for issues. Suppose a company has a policy against sharing customer credit card numbers in chat – a compliance policy can detect if anyone types a 16-digit number in Teams and flag it. Or, for HR purposes, it can detect profanity or harassment signals in messages, helping the business ensure a respectful workplace. These capabilities help SMBs meet obligations to prevent hostile work environments and protect confidential information in communications. If an issue arises (say, an allegation of harassment or a leak of confidential info via chat), the company already has a system in place to capture and review relevant communications, which is crucial evidence for internal investigations or legal proceedings.

SMB use case example: The owner of a 100-person design agency is concerned about employees taking client designs with them if they leave to a competitor. With Insider Risk Management, the owner sets up a policy to watch for massive file downloads or multiple deletions. Shortly after an engineer gives two weeks’ notice, Purview generates an alert: the employee downloaded an unusually high number of files and saved them to a personal cloud drive. The alert prompts the owner to intervene early, preventing potential IP theft[2]. In another scenario, Communication Compliance flags a series of messages in which a manager used inappropriate language toward a staff member. The HR team is alerted and can address the issue before it worsens, demonstrating the company’s proactive stance against harassment. These examples show how even without a large security staff, SMBs can effectively mitigate insider risks and uphold policies using Purview’s analytics.

3. Records & Data Lifecycle Management (Data Governance)

What it is: Records Management and Data Lifecycle features in Purview help organisations intelligently retain or delete information in accordance with laws and internal policies. This includes retention labels/policies (to keep data for a set period or indefinitely) and disposition rules (to review and approve deletion of important records). In essence, it is about governing the life cycle of data – from creation to disposal – to meet regulatory and business requirements.

How it helps: Many SMBs struggle with data governance – deciding what data to keep, for how long, and ensuring old or irrelevant data is properly disposed of. Purview’s capabilities give SMBs a framework to automate these decisions. For example, an SMB in a legal or financial field might be required to retain certain documents for 7 years. With Purview, they can apply a retention label (say “Finance – 7yr Retention”) to relevant folders or SharePoint sites. All content with that label will be retained for the specified period, overriding user deletions. Conversely, they might have a policy to delete emails that are older than 3 years to reduce liability. A policy can be set to auto-delete or archive such items, ensuring the company isn’t inadvertently hoarding data longer than allowed.

Purview’s Records Management goes further by letting you declare specific documents as “records” – meaning they are locked from editing or deletion. This is useful for preserving final contract documents or official meeting minutes that must remain unaltered for compliance. Disposition review workflows can be enabled so that when the retention period expires, a manager is notified to approve the deletion or extension of the record. All these actions are logged, providing an audit trail that the SMB can show regulators or auditors to prove compliance with data retention laws[2].

This level of automation and oversight is of real value to SMBs. It reduces the manual burden on staff to clean up files or ensure everyone is following policy. It also lowers risk – data that should be deleted isn’t accidentally kept forever (which could be a liability in a breach), and data that must be retained won’t be prematurely lost. For regulated SMBs (e.g., an accounting firm adhering to IRS or HMRC rules, or a government contractor following data retention regulations), these tools help avoid hefty fines by systematically enforcing the rules. Even for less regulated businesses, having good data hygiene saves storage costs and streamlines operations.

SMB use case example: A small investment advisory firm needs to comply with financial regulations that client records be kept for at least 6 years. They use Purview’s data lifecycle management to auto-tag all client correspondence and reports with a 6-year retention label[2]. This ensures even if an employee tries to delete an old email or document, it stays preserved until the retention period lapses. The system then flags it for disposition, and a compliance officer reviews and approves its deletion. At the same time, they have a policy to purge emails that are not client-related after 2 years, which Purview executes automatically. In their annual compliance audit, the firm can show auditors reports from Compliance Manager and Records Management demonstrating that all required data is retained and old data properly disposed of – giving a level of assurance (and proof) that would be hard to achieve manually in a small organisation.

4. eDiscovery (Premium) and Audit (Premium)

What it is: Microsoft Purview eDiscovery (Premium) is an advanced tool for legal discovery and internal investigations. It allows you to create cases, search across mailboxes, Teams, SharePoint, etc., apply legal hold to preserve data, and then review, tag, and export content responsive to a case. Microsoft Purview Audit (Premium) extends the standard audit logging by capturing more detailed user activity events and retaining audit logs for up to a year.

How it helps: These features ensure an SMB is “investigation-ready”[2]. In the event of a legal dispute, regulatory inquiry, or a serious internal incident, the company can respond quickly and thoroughly. With eDiscovery Premium, an SMB’s IT admin or legal delegate can centrally search all relevant data (emails, documents, chat history) related to a matter, without needing to involve expensive external consultants. They can place a legal hold on a former employee’s mailbox and OneDrive as soon as litigation is anticipated, stopping any deletion of content[2]. They can then review the collected data using built-in filters and analytics (for example, find all emails in a certain date range that contain a specific client name) and export the results for their lawyers. This is the same eDiscovery capability that large enterprises use; with the Purview add-on, a 50-person company gets it right inside their Microsoft 365 portal.

For internal investigations, eDiscovery is just as useful. Suppose there’s an internal fraud suspicion or an HR investigation – the tool allows a small HR or IT team to gather all necessary communications and files quietly and preserve evidence, rather than relying on ad-hoc forwarding of emails. Audit (Premium), on the other hand, is like a detailed activity log that can be critical in forensic analysis. Standard Microsoft 365 auditing might tell you that “User A deleted file X” but only retains such an event for 90 days. With Audit Premium enabled, audit records are kept for 365 days and include many more events (like when someone reads a file or replies to a message)[2]. For an SMB, this means if they discover a problem or receive an legal notice months after an incident, they can still retrieve the log data to understand what happened. It also means having evidence to demonstrate compliance or to trace the chain of events in a security incident.

SMB use case example: A 25-person architecture firm receives a client allegation that a staff member deleted important project files. With Audit (Premium), the firm’s IT admin can pull up a log showing exactly which files were deleted, when, and by whom, even if the event happened 8 months ago[2]. The audit reveals the files were actually deleted by a different user by mistake, helping resolve the dispute. In another scenario, a small retail company faces a wrongful dismissal lawsuit and must present employee communications as evidence. With eDiscovery Premium, the company quickly initiates a case, puts the ex-employee’s emails and Teams chats on hold, and searches across their data for any mentions related to the case. They export the relevant messages and documents to provide to their legal counsel[2]. Without Purview, an SMB might have to hire external eDiscovery services or might risk not finding all the needed information in time. By using the Purview suite, they not only save cost and effort, but also ensure no critical data slips through the cracks during an investigation[2].

5. Compliance Manager and Additional Tools

What it is: Microsoft Purview Compliance Manager is a dashboard and toolset that maps Microsoft 365’s controls to various regulatory requirements. It provides assessments for standards like GDPR, ISO 27001, PCI-DSS, etc., letting organisations track their compliance status and receive guidance on improving. Each action in Compliance Manager is a recommended control (for example, “Enable DLP for GDPR Article 32”) that can be checked off once implemented, contributing to an overall compliance score.

How it helps: For SMBs without dedicated compliance specialists, Compliance Manager serves as a virtual checklist and consultant. It translates complex regulations into a set of actionable tasks. An SMB can select relevant regulatory templates (e.g. GDPR if they handle EU personal data, or perhaps UK Cyber Essentials, or CCPA for California customers) and the tool will list out what they should do in Microsoft 365 to meet those requirements[4]. Many actions are technical (like configuring labels, DLP, MFA, etc.), which align well with the Purview and security features at their disposal. The Compliance Manager will also show what controls Microsoft covers (for cloud infrastructure) and what the customer needs to cover. Over time, the SMB can improve their compliance score in the dashboard, which quantifies their progress. This is very useful evidence for audits or even to show clients that the company takes compliance seriously.

Consider an SMB consulting firm aiming for ISO 27001 certification. Compliance Manager can provide the framework of controls needed and track that the firm has, say, set up an incident response plan, enabled required security features, done staff training, etc. It essentially centralises compliance project management. Additionally, since Compliance Manager is part of Purview, it integrates with the other features – as the SMB implements a DLP policy or creates a retention label, those can automatically satisfy certain compliance controls in the assessments.

Other supporting tools included in Purview Suite (and worth noting) are Microsoft Purview Data Map and Content Explorer which give insights into where sensitive data lives in your organisation, and Sensitivity Label analytics (through Purview reports) that show how labels and DLP are being used. While more auxiliary, these help an SMB discover their data landscape – for example, finding files containing personal data that they weren’t aware of, so that appropriate labels/policies can be applied.

Overall, Compliance Manager and related insights tools ensure that an SMB not only has the capabilities to protect and govern data, but also the visibility and guidance to use those capabilities effectively in pursuit of compliance.

Practical Use Cases for SMBs and Purview Solutions

SMBs in various industries can benefit from Purview Suite features in concrete ways. The table below summarizes some practical scenarios and how the Purview tools address them, providing value beyond what the base Business Premium offers:

Table 2. Common SMB Challenges vs. Purview Suite Solutions

SMB Challenge or ScenarioPurview Feature(s) UtilizedBenefit to the Business
Protecting personal data under regulations (e.g. GDPR, HIPAA) – The company handles customers’ personal information and must prevent leaks or improper access.Sensitivity Labels and Encryption; DLP Policies (including auto-detection of PII)[2][2]; Customer Key for encryption control[2].Ensures data privacy and compliance: Automatically classifies and protects personal data so it’s only accessible by authorised people. Prevents accidental sharing of sensitive info (e.g. blocking emails with credit card numbers)[2]. Helps avoid regulatory fines by enforcing GDPR/HIPAA rules through technology rather than relying on employee diligence.
Insider data theft or unauthorised access – A staff member might intentionally or unintentionally take sensitive files (intellectual property, client lists) out of the company.Insider Risk Management analytics and alerts[2]; Audit (Premium) logs of file activities[2]; Endpoint DLP blocking files copied to USB or personal cloud[1].Mitigates internal risks: Detects risky behavior early (e.g. bulk file downloads before an employee resigns) and notifies management[2]. Blocks common exfiltration routes (like copying files to flash drives). Detailed audit trails help investigate and prove if data was accessed or exported, acting as a deterrent and forensic tool.
Inappropriate or non-compliant communications – Need to ensure employees follow conduct policies and no confidential data is shared in chat.Communication Compliance policies scanning Teams and Exchange chats[2]; DLP for Teams chat content.Enforces compliant communication: Flags harassment, sensitive data sharing, or other violations in messages so management can intervene early[2]. Supports a respectful workplace culture and protects the company by addressing issues (like insider trading discussions or client data sent over chat) proactively.
Legal inquiry or investigation response – The business receives a legal hold notice or needs to gather records for a lawsuit/internal audit.eDiscovery (Premium) case management, legal hold, content search[2]; Audit (Premium) for historical user actions[2].Streamlined investigations: Allows the SMB to quickly find all relevant emails, documents, and chats across M365 and preserve them in-place[2]. Saves time and cost compared to outsourcing eDiscovery. Comprehensive log data (1 year) means critical evidence from months ago is available[2], increasing the chance of a successful response to legal or compliance inquiries.
Data retention and lifecycle requirements – The business must keep certain records for X years and clean out data that’s no longer needed.Retention & Records Management policies with automatic deletion or retention[2]; Disposition review workflow.Automated data governance: Ensures the company consistently complies with retention laws (e.g. deleting customer data after 7 years) without manual effort. Reduces storage bloat and risk by purging old data on schedule. Provides proof of compliant data handling if audited, via reports and audit trails[2].

As shown above, the Purview Suite’s features align closely with real-world challenges SMBs face in protecting data and meeting compliance obligations. In each scenario, having these tools in place can mean the difference between a minor issue and a major incident (or penalty). They bring a level of control and insight that smaller organisations typically lack, thereby significantly reducing risk.

Licensing and Cost Considerations

For SMBs evaluating the Purview Suite, cost and licensing are important factors. The Purview Suite for Business Premium is an add-on license that requires each user to also have a Business Premium subscription. Microsoft prices this compliance suite at roughly $10 USD per user/month (in addition to the $22 for Business Premium)[4][6]. There is also a combined Defender + Purview Suite bundle for $15 user/month that includes both the security and compliance add-ons, which is a further discount if an organisation needs both sets of capabilities[4][4]. All these add-ons are capped at 300 users, the same limit as Business Premium itself[5]. (Notably, Microsoft requires a minimum of 25 seats for these add-ons[2], so very small clients might need to purchase for 25 users even if, say, only 10 users are on Business Premium.)

Compared to other Microsoft 365 licensing options, the Purview Suite add-on is cost-effective for what it delivers. To get equivalent compliance features without this add-on, an SMB would typically have to upgrade to Microsoft 365 E5 or buy a bundle like “E5 Compliance” for each user. Microsoft 365 E5 (which includes the full Purview feature set along with advanced security and other tools) is priced at about $57 per user/month – nearly double the cost of Business Premium + Purview Suite (~$32). In other words, Business Premium + Purview (~$32) gives you the compliance power of E5 Compliance, at ~40% lower cost than a full E5 license[2]. Moreover, it avoids the need to transition to an Enterprise agreement; you can stay on the Business Premium (SMB) platform. Table 3 provides a quick comparison:

Table 3. Pricing and Plan Comparison

Plan / LicenseKey Compliance FeaturesCost (USD)
Microsoft 365 Business Premium (Base)Basic compliance included (manual labels, Exchange/SharePoint DLP, basic eDiscovery, 90-day audit)[3]. Suitable starting point for security & productivity.~$22 user/month[6]
+ Purview Suite Add-on
(Business Premium with advanced compliance)		All Microsoft Purview features (Information Protection & auto-labeling, DLP across all channels, Insider Risk, Communication Compliance, Records Mgmt, eDiscovery & Audit Premium)[4][4]. Requires Business Premium as a prerequisite.+ ~$10 user/month[4]
(Total ~$32/user/month)
Microsoft 365 E5 (Enterprise)Includes advanced compliance (equivalent to Purview Suite) and advanced security, analytics, etc. No 300-seat limit (enterprise scale).~$57 user/month

Pricing note: The above costs are indicative list prices as of 2025. Volume discounts or regional pricing may vary. The Purview Suite and Defender Suite add-ons were introduced in September 2025[5], so they are relatively new offers – positioned to give Business Premium customers a cheaper route to E5 capabilities.[4] Microsoft cites savings of ~47% compared to buying equivalent compliance features standalone, and up to ~68% savings when opting for the combined Defender+Purview bundle[1][2].

In summary, from a licensing standpoint, the Purview Suite add-on is highly compelling for SMBs who need these capabilities. It avoids the jump to expensive enterprise plans, and one can choose the compliance add-on, the security add-on, or both, depending on the business’s priorities (data protection vs. threat protection, or both)[4]. It’s also flexible – if an organisation outgrows the 300-user limit, they can transition to enterprise plans over time (Microsoft allows some grace for exceeding 300 users mid-term, but recommends moving to E3/E5 as you scale beyond SMB limits)[5][5]. For most typical SMBs under 300 employees, however, Business Premium plus Purview Suite will cover their needs at a fraction of the enterprise cost.

Why Purview Suite is Valuable to a Typical SMB

Traditional thinking might be that advanced compliance and risk management tools are only for big enterprises with dedicated compliance departments. Microsoft Purview Suite for Business Premium challenges that notion by tailoring enterprise-grade capabilities to SMB needs and constraints[2]. Here are key reasons a typical SMB should consider this add-on and the tangible value it provides:

  • Stronger Data Protection & Regulatory Compliance: Every business, large or small, is responsible for protecting sensitive data. Regulations like GDPR do not exempt small companies – in fact, SMBs can face devastating fines or reputational damage from a data breach. Purview Suite gives an SMB the ability to know exactly where their sensitive data is and control how it’s used. Features like auto-labeling and DLP act as an automated safety net against human error, which is a leading cause of data leaks. By ensuring that personal data isn’t mishandled, and by retaining the proper records, an SMB can confidently demonstrate compliance to regulators and customers[2][2]. This level of data governance can be a competitive advantage, as clients increasingly want assurance that their data is safe.
  • Internal Risk Reduction and Proactive Oversight: Small businesses often operate on trust, but risky insider behavior or simple staff mistakes can and do happen. Without tools like insider risk detection or communication monitoring, a lot can go unnoticed until it’s too late. The Purview Suite essentially gives an SMB an early warning system for internal risks – something that was previously out of reach without a security operations team. Stopping an insider-caused breach or catching a compliance issue early can save a company from financial loss and legal troubles. Even the presence of these controls can act as a deterrent (employees knowing that unusual downloads are flagged, for example, may be dissuaded from taking data). Ultimately, it helps foster a culture of accountability and security within the organisation.
  • Efficiency in Legal and Compliance Workflow: When an SMB without eDiscovery tools faces a lawsuit or audit, they often have to scramble – manually searching Outlook mailboxes, asking employees to forward emails, etc., which is inefficient and unreliable. With Purview eDiscovery, SMBs can respond to legal requests with the same rigor as a large enterprise, but without hiring extra personnel or consultants[2]. Everything needed (search, hold, export) is in one place, reducing turnaround time and ensuring nothing important is overlooked[2]. The Audit log improvements likewise mean an SMB can investigate incidents in-depth on their own. This self-service ability in compliance matters can translate to significant cost savings (avoiding external legal discovery costs) and better outcomes (since the company can find exonerating or relevant evidence quickly).
  • Integrated Solution (Less Complexity): SMB IT teams wear many hats. Introducing multiple point solutions for DLP, for archiving, for monitoring, etc., could increase complexity and management overhead. The Purview Suite, however, is integrated into the Microsoft 365 platform that the business already uses. The compliance center is unified – one login to manage labels, DLP, risk, eDiscovery, etc. – and the tools work together (for example, a single label can both encrypt a file and apply a retention period). This integration is invaluable for lean teams. It means no separate servers or third-party services to maintain, and it leverages the cloud intelligence Microsoft provides (like continually updated sensitive info detection, AI for classification). In short, Purview allows a small organisation to achieve a robust compliance posture without adding a lot of operational burden[4].
  • Enterprise-Level Assurance for Clients and Partners: Having Purview Suite features in place can be a selling point or requirement in some industries. For instance, a small law firm could win more corporate clients if it can demonstrate that it uses the same caliber of data protection tools as those clients do. In some cases, cyber insurance providers, customers, or partners may ask what data security measures an SMB has – being able to cite DLP, encryption, insider risk controls, etc., can positively impact those evaluations. Essentially, it lets an SMB say: “We operate with the same compliance standards as a Fortune 500, using Microsoft’s top-tier solutions”[2]. That builds trust and could open doors to opportunities that might otherwise be risky for a small company.
  • Future-Proofing (AI and Beyond): Looking ahead, SMBs adopting new technology like AI-driven cloud services also need to guard against new risks (for example, employees feeding confidential data into AI chatbots). Microsoft Purview is evolving to address these scenarios too – for example, integration with Defender for Cloud Apps can reveal if users are uploading sensitive data to unapproved AI apps[2]. By establishing a strong data governance foundation with Purview now, SMBs set themselves up to safely leverage tools like Microsoft 365 Copilot (the AI assistant that uses your organisation’s data). Well-defined labels and DLP policies mean Copilot will only access information that is allowed and won’t expose confidential data in its responses[1][1]. In short, Purview helps ensure that as the business grows and adopts new tools, its data remains well-managed and protected.

Bottom Line: For a typical SMB, the Microsoft Purview Suite add-on brings tangible, real-world benefits that go well beyond tick-box compliance. It helps protect the business’s crown jewels (its data), reduces the likelihood of costly incidents (breaches, lawsuits, fines), and does so in a way that is manageable for small IT teams and affordable for small-business budgets[2][2]. In an environment where SMBs are expected to meet many of the same data protection standards as large enterprises, Purview provides an equaliser – enabling “the same level of compliance and data protection as large enterprises but simplified for smaller teams and tighter budgets.”[2] By considering this add-on to their Microsoft 365 Business Premium subscription, SMBs can significantly elevate their compliance and risk management stance, turning what could be a vulnerability into a strength for the organisation.

References

[1] Elevate SMB Security, Compliance & Copilot Readiness: Microsoft …

[2] Introducing new security and compliance add-ons for Microsoft 365 …

[3] Purview Microsoft 365 Business Premium Licensing question

[4] Microsoft 365 Business Premium: Defender & Purview add-ons

[5] Microsoft 365 Business Premium: New security and compliance add-ons

[6] Microsoft 365 Business Premium

Inactive users report

Screenshot 2025-09-30 143337

Just completed a new script in my Office repo:

https://github.com/directorcia/Office365/blob/master/m365-inactiveusers-get.ps1

and the documentation is here:

https://github.com/directorcia/Office365/wiki/Microsoft-365-Inactive-Users-Check-Script

The m365-inactiveusers-get.ps1 script is a comprehensive PowerShell tool designed to analyze user activity within Microsoft 365 tenants. It identifies inactive users, tracks license assignments, monitors external/guest user access, and generates detailed reports to help administrators maintain security and optimize license usage.

Microsoft Entra ID P2 Access Reviews: A Critical Evaluation for SMB Customers in Australia

Another article generated by Copilot Research agent using Claude.

——————————————————–

Executive Summary

Microsoft Entra ID P2 Access Reviews are sophisticated identity governance tools designed primarily for enterprise scenarios. While they offer robust capabilities for managing user access at scale, their practical value for Australian SMBs is limited and often doesn’t justify the additional AU$13.50 per user per month cost beyond Microsoft 365 Business Premium. [1] [2]

Most SMBs can achieve adequate security and governance through simpler, more cost-effective methods unless they face specific regulatory compliance requirements or manage highly sensitive data. The complexity and cost of implementation typically outweigh the benefits for businesses with fewer than 100 users.

 

What Are Entra ID P2 Access Reviews?

Core Functionality

Access Reviews in Microsoft Entra ID enable organisations to efficiently manage group memberships, access to enterprise applications, and role assignments through regular certification processes. [1] The feature allows businesses to:

  • Schedule regular reviews of who has access to specific resources
  • Delegate review responsibilities to appropriate stakeholders (managers, resource owners, or users themselves)
  • Automate access removal based on review outcomes
  • Generate compliance reports for audit purposes
  • Implement time-limited access with automatic expiration
Key Components

Access Reviews operate through several integrated components:

  1. Review Scope: Define which users and resources to review [3]
  2. Reviewers: Designated individuals who approve or deny access
  3. Review Frequency: Weekly, monthly, quarterly, or annual cycles
  4. Automated Actions: Remove access for denied users automatically
  5. Smart Recommendations: AI-driven suggestions based on user activity patterns

 

Step-by-Step Setup Guide for Small Businesses

Prerequisites

Before implementing Access Reviews, SMBs must ensure:

  • Licensing: Microsoft Entra ID P2 or Entra ID Governance licenses [4] [5]
  • Administrative Access: Identity Governance Administrator role minimum
  • Application Integration: Resources must be integrated with Entra ID
Implementation Process

Detailed Setup Steps:

  1. Sign in to Microsoft Entra admin centre as an Identity Governance Administrator [3]


  2. Navigate to ID Governance > Access Reviews

    • Select “New access review” to begin configuration

  3. Define Review Scope [3]

    • Choose between Teams + Groups or Applications
    • Select specific resources or all Microsoft 365 groups with guest users
    • Determine user scope (everyone, guests only, or inactive users)

  4. Configure Reviewers [3]

    • Group owners (recommended for SMBs)
    • Selected users or groups
    • Users review their own access
    • Managers of users
    • Set fallback reviewers for orphaned accounts

  5. Set Recurrence [3]

    • Duration: How long reviewers have to complete (typically 14-30 days)
    • Start date and frequency
    • End date or number of occurrences

  6. Configure Settings

    • Auto-apply results to resources
    • Email notifications and reminders
    • Justification requirements
    • Decision helpers and recommendations

 

Benefits for SMBs: An Honest Assessment

Genuine Benefits

Where Access Reviews genuinely add value for SMBs: [6]

  1. Regulatory Compliance: Industries with strict compliance requirements (healthcare, finance, legal) benefit from automated documentation
  2. External Collaboration: Businesses with numerous external partners or contractors gain better control
  3. Distributed Management: Companies with multiple locations or departments can delegate access decisions
  4. Risk Reduction: Automated removal of stale access reduces security exposure
Reality Check: Limitations for SMBs

Critical considerations that diminish value for small businesses:

  1. Cost vs Benefit:

    • AU$13.50 per user per month adds AU$162 annually per user [2]
    • For 20 users: AU$3,240/year additional cost
    • For 50 users: AU$8,100/year additional cost

  2. Complexity Overhead: [4]

    • Requires understanding of multiple stakeholder roles
    • Complex initial setup and ongoing maintenance
    • Training requirements for reviewers

  3. Limited Applicability:

    • Most SMBs have simple, stable access patterns
    • Manual quarterly reviews often sufficient for small teams
    • Limited integration with SMB-focused applications

  4. Licensing Confusion:

    • Microsoft 365 Business Premium includes only Entra ID P1 [7] [8]
    • Access Reviews require P2, creating additional licensing complexity
    • Reviewers also need P2 licenses, not just administrators [5]

 

Entitlement Management: Overkill for Most SMBs?

What Is Entitlement Management?

Entitlement management enables organisations to manage identity and access lifecycle at scale through access packages – bundles of resources users need for specific roles or projects. [9]

The SMB Verdict on Entitlement Management

Entitlement management is almost certainly overkill for SMBs under 100 users. Here’s why: [9]


  1. Designed for Scale: The feature addresses problems that emerge at enterprise scale – hundreds or thousands of users across multiple departments


  2. Overhead vs Value:

    • Requires significant upfront design and configuration
    • Ongoing maintenance of access packages
    • Complex approval chains unnecessary in flat SMB structures

  3. Simpler Alternatives Work:

    • Direct group assignments sufficient for most SMBs
    • SharePoint/Teams permissions handle project-based access
    • Manual onboarding/offboarding manageable at small scale

  4. Real-World SMB Scenarios:

    • 10-20 employees: Owner knows everyone; manual management works fine
    • 20-50 employees: Simple group-based access with quarterly manual reviews
    • 50-100 employees: Consider basic automation but full entitlement management rarely justified

 

Pricing Analysis for Australian SMBs

Cost Breakdown

Microsoft 365 Business Premium (approximately AU$39.60/user/month) includes: [10]

  • Entra ID P1 (formerly Azure AD Premium P1)
  • Conditional Access
  • Multi-factor authentication
  • Self-service password reset
  • Basic identity protection

To get Access Reviews, you need Entra ID P2 at AU$13.50/user/month additional, which includes: [2]

  • Everything in P1
  • Access Reviews
  • Privileged Identity Management (PIM)
  • Identity Protection with risk-based policies
  • Entitlement management
Total Cost Comparison (Annual, excluding GST)
UsersBusiness Premium OnlyBusiness Premium + P2Additional Cost
10AU$4,752AU$6,372AU$1,620
20AU$9,504AU$12,744AU$3,240
50AU$23,760AU$31,860AU$8,100
100AU$47,520AU$63,720AU$16,200

Note: Prices shown do not include GST. Add 10% for GST-inclusive pricing.

 

Practical Recommendations for SMBs

When Access Reviews Make Sense

Alternative Approaches for Most SMBs

Instead of Access Reviews, consider these more practical approaches: [8]

  1. Quarterly Manual Reviews:

    • Export user lists from Microsoft 365 admin centre
    • Review with department heads
    • Document decisions in SharePoint/Excel
    • Cost: Staff time only

  2. Leverage Business Premium Features:

    • Use Conditional Access for location/device-based controls
    • Implement MFA for all users
    • Configure automatic account disabling for inactive users
    • Monitor sign-in logs regularly

  3. Simple Governance Process:

    • Standardise onboarding/offboarding checklists
    • Use Microsoft Forms for access requests
    • Power Automate for basic approval workflows
    • Regular security awareness training

  4. Focus on Fundamentals:

    • Strong password policies
    • Least privilege principle
    • Regular security updates
    • Data loss prevention policies
    • Email security (already included in Business Premium)

 

The Bottom Line for Australian SMBs

Key Takeaways

Access Reviews and entitlement management are powerful enterprise features that rarely justify their cost and complexity for SMBs under 100 users. The additional AU$13.50 per user per month represents a 34% increase over Microsoft 365 Business Premium pricing, which already includes substantial security features.

Final Verdict

For the vast majority of Australian SMBs, Entra ID P2 Access Reviews represent an expensive solution to problems they don’t actually have. The features are well-designed and powerful, but they address enterprise-scale challenges around distributed governance, compliance automation, and managing thousands of access relationships.

Small businesses are better served by:

  • Maximising the value from Microsoft 365 Business Premium’s included features
  • Implementing simple, documented manual review processes
  • Focusing security investments on user training and basic controls
  • Considering P2 only when specific compliance requirements demand it

The money saved by avoiding unnecessary P2 licensing could be better invested in security awareness training, backup solutions, or managed security services that provide more tangible benefits for small business risk profiles.

References

[1] What are access reviews? – Microsoft Entra – Microsoft Entra ID Governance | Microsoft Learn

[2] Microsoft Entra Plans and Pricing | Microsoft Security

[3] Create an access review of groups and applications – Microsoft Entra ID Governance | Microsoft Learn

[4] Preparing for an access review of users’ access to an application – Microsoft Entra ID Governance | Microsoft Learn

[5] Who needs P2 license for Access Reviews? Creator? Reviewer? Reviewees? – Microsoft Q&A

[6] Plan a Microsoft Entra access reviews deployment – Microsoft Entra ID Governance | Microsoft Learn

[7] Microsoft 365 Business Premium Licensing question – Microsoft Q&A

[8] Securing Microsoft 365 Copilot in a Small Business Environment

[9] What is entitlement management? – Microsoft Entra ID Governance | Microsoft Learn

[10] Modern-Work-Plan-Comparison-SMB

Unlock Anthropic AI in Microsoft Copilot: Step-by-Step Setup & Crucial Warnings!

In this video, I walk you through how to enable Anthropic’s powerful AI models—like Claude—inside Microsoft Copilot. I’ll show you exactly where to find the settings, how to activate new AI providers, and what features you unlock in Researcher and Copilot Studio. Plus, I share an important compliance warning you need to know before turning this on, so you can make informed decisions for your organization. If you want to supercharge your Copilot experience and stay ahead with the latest AI integrations, this guide is for you!

Video link = https://www.youtube.com/watch?v=Gxa9OrI6VJs

Updated Global Secure Access Clients

Something I have been waiting on for a while with Entra ID Global Secure Access (GSA) has been the availability of the Internet traffic profile on iOS.

image

When I check the latest version of Defender on my iDevices I found that this has now been enabled, provided better protection and advanced filtering like I have on other devices.

image

When I also updated my Windows devices I found that there is a nice new admin console available as well.

Microsoft Entra ID Global Secure Access helps small businesses protect their data and simplify IT by combining secure sign-in, app access, and network protection in one solution. It uses a modern “Zero Trust” approach, which means every user and device is verified before getting access, reducing the risk of cyberattacks. Instead of juggling multiple tools or complex VPNs, you get a single, easy-to-manage system that works for office, remote, and mobile workers. It improves employee experience with one login for all apps, supports flexible work without slowing things down, and scales as your business grows—all while saving costs by replacing multiple security products with one integrated service.

Configuring robust anti-malware policies in Exchange Online Protection (EOP), with enhancements from Microsoft Defender for Office 365 (MDO)

Executive Summary

This guide will provide a comprehensive, production-safe approach using both the Microsoft 365 Defender portal and Exchange Online PowerShell. We will start with a baseline of security and then layer on advanced protections. The core strategy involves keeping the default EOP anti-malware policy as a foundational safety net while creating a higher-priority, custom policy for sensitive users, such as executives and finance teams. This ensures critical assets have the most aggressive, up-to-date protection without disrupting the entire organisation. We’ll also cover essential features like the Common Attachment Filter, Safe Attachments, Safe Links, and the Zero-hour Auto Purge (ZAP) engine to defend against a wide array of evolving threats, from zero-day malware to sophisticated phishing attacks.

1. Prerequisites & Licensing Checks

Before you begin, it’s crucial to understand your licensing model.

  • Exchange Online Protection (EOP): This is the baseline email security included with all Microsoft 365 subscriptions (e.g., Business Basic, Standard, E3). It provides fundamental anti-malware and anti-spam protection.
  • Microsoft Defender for Office 365 (MDO): This is an add-on or an included feature in higher-tier plans (e.g., Microsoft 365 Business Premium, E5). MDO Plan 1 adds Safe Attachments and Safe Links, while MDO Plan 2 adds advanced hunting, investigation, and automation features (e.g., Threat Explorer, Automated Investigation and Response). This guide assumes you may have an MDO licence and will detail the optional add-ons.

2. Policy Inventory & Strategic Approach

Best Practice: Do not modify the Default anti-malware policy. This ensures a consistent baseline of protection across all users who aren’t covered by a custom policy. Instead, create new, more restrictive policies for targeted, high-risk groups. Policies are processed by priority (0 being the highest), so a new custom policy with priority 0 will apply to its users, and the default policy will catch everyone else.

GUI Method: Inventory Existing Policies

  1. Navigate to the Microsoft Defender portal at https://security.microsoft.com.
  2. Go to Email & collaboration → Policies & rules → Threat policies.
  3. Under the Policies section, click on Anti-malware. You will see the default policy and any custom ones you have created.

PowerShell Method: Inventory Existing Policies

First, connect to Exchange Online.

PowerShell

# Connect to Exchange Online PowerShell
Connect-ExchangeOnline -UserPrincipalName <your-admin-email> -ShowProgress:$true

Then, view the current policies.

PowerShell

# Get all malware filter policies and their associated rules
Get-MalwareFilterPolicy
Get-MalwareFilterRule

3. Recommended Anti-malware Settings

This section details the recommended settings for your new custom anti-malware policy.

GUI Method: Creating a New Policy

  1. In the Microsoft Defender portal, go to the Anti-malware page from the previous step.
  2. Click Create a policy.
  3. Give the policy a descriptive Name (e.g., High-Risk Users - Anti-malware Policy) and a Description. Click Next.
  4. On the Users and domains page, choose the users, groups, or domains you want to protect. For our example, select Groups and search for ExecutiveTeam. Click Next.
  5. On the Protection settings page, configure the following:
    • Protection settings
      • Enable zero-hour auto purge for malware: This is a service-side feature that, when enabled, automatically removes previously delivered malicious messages from user mailboxes. It’s a key part of EOP and is highly recommended.
      • Quarantine policy: Use the default AdminOnlyAccessPolicy. The rationale is simple: end-users should not be able to release malware. This prevents them from accidentally or maliciously releasing a dangerous file.
    • Common attachments filter
      • Check Enable common attachments filter. This is a powerful, extension-based block list that is a fantastic first line of defence. The list of file types has been expanded by Microsoft, but you should periodically review it.
      • Click Customize file types and ensure a robust list of high-risk file types is selected. The list should include: exe, dll, js, jse, vbs, vbe, ps1, com, cmd, bat, jar, scr, reg, lnk, msi, msix, iso, img, 7z, zipx. You can also add other file types that are not needed in your environment, such as wsf, wsh, url.
    • Notifications
      • Admin notifications: Check Notify an admin about undelivered messages from internal senders and Notify an admin about undelivered messages from external senders. Use your security mailbox for this (e.g., security@contoso.com).
      • Sender notifications: Do not enable Notify internal sender or Notify external sender. Notifying external senders can validate their address for future spam, and an internal sender’s mailbox might be compromised, which could alert the attacker.

PowerShell Method: Creating and Configuring the Policy

This script is idempotent (you can run it multiple times without errors) and will create or update the policies as needed.

PowerShell

# --- PowerShell Script to Configure Exchange Online Anti-malware Policies ---

# Define variables for your tenant
$tenantDomain = "contoso.com"
$highRiskGroupName = "ExecutiveTeam"
$adminNotificationMailbox = "security@contoso.com"
$policyName = "High-Risk Users - Anti-malware Policy"
$ruleName = "High-Risk Users - Anti-malware Rule"

# Define the common attachment filter file types
$fileTypes = @(
    'ade','adp','ani','app','bas','bat','chm','cmd','com','cpl',
    'crt','csh','dll','exe','fxp','hlp','hta','inf','ins','isp',
    'jar','js','jse','ksh','lnk','mda','mdb','mde','mdt','mdw',
    'mdz','msc','msi','msix','msp','mst','pcd','pif','prg','ps1',
    'reg','scr','sct','shb','shs','url','vb','vbe','vbs','wsc',
    'wsf','wsh','xnk','iso','img','7z','zipx','docm','xlsm'
)

# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName $adminNotificationMailbox -ShowProgress:$true

# Check if the policy exists
$policy = Get-MalwareFilterPolicy -Identity $policyName -ErrorAction SilentlyContinue

if ($null -ne $policy) {
    Write-Host "Policy '$policyName' already exists. Updating settings..." -ForegroundColor Yellow
    Set-MalwareFilterPolicy -Identity $policyName `
        -Action DeleteMessage `
        -EnableFileFilter:$true `
        -FileTypes $fileTypes `
        -EnableInternalSenderAdminNotifications:$true `
        -EnableExternalSenderAdminNotifications:$true `
        -AdminDisplayName "Custom policy for high-risk users."
} else {
    Write-Host "Policy '$policyName' not found. Creating a new one..." -ForegroundColor Green
    New-MalwareFilterPolicy -Name $policyName `
        -Action DeleteMessage `
        -EnableFileFilter:$true `
        -FileTypes $fileTypes `
        -EnableInternalSenderAdminNotifications:$true `
        -EnableExternalSenderAdminNotifications:$true `
        -AdminDisplayName "Custom policy for high-risk users."
}

# Check if the rule exists
$rule = Get-MalwareFilterRule -Identity $ruleName -ErrorAction SilentlyContinue

if ($null -ne $rule) {
    Write-Host "Rule '$ruleName' already exists. Updating settings..." -ForegroundColor Yellow
    Set-MalwareFilterRule -Identity $ruleName `
        -MalwareFilterPolicy $policyName `
        -Comments "Applies to high-risk group." `
        -SentToMemberOf $highRiskGroupName `
        -Priority 0
} else {
    Write-Host "Rule '$ruleName' not found. Creating a new one..." -ForegroundColor Green
    New-MalwareFilterRule -Name $ruleName `
        -MalwareFilterPolicy $policyName `
        -Comments "Applies to high-risk group." `
        -SentToMemberOf $highRiskGroupName `
        -Priority 0
}

Write-Host "Configuration complete. Run 'Get-MalwareFilterPolicy' and 'Get-MalwareFilterRule' to verify." -ForegroundColor Green

4. Defender for Office 365 Add-ons (If Licensed)

These advanced policies provide an additional layer of protection.

  • Safe Attachments: This sandboxing technology “detonates” email attachments in a virtual environment to detect zero-day malware.
    • Block: The most secure option. Messages with attachments are held while being scanned. If a threat is found, the message is blocked and quarantined. This can introduce a short delay (minutes) for emails with attachments.
    • Dynamic Delivery: A balance between security and user experience. The email body is delivered immediately with a placeholder for the attachment. The attachment is delivered once the scan is complete. Use this for users who can tolerate a minor delay on the attachment itself but need the email content right away. For a high-risk user group, Block is often the recommended setting.
  • Safe Links: This feature scans URLs at the time of the click, not just upon arrival. If a URL is later determined to be malicious, it will be blocked even if it was safe when the email was first received.
  • Zero-hour Auto Purge (ZAP): ZAP for malware is included in EOP and is enabled by default. MDO adds ZAP for high-confidence phishing and spam. This is a powerful, service-side feature that removes messages that have already been delivered to a user’s inbox if new threat intelligence indicates they are malicious. There is no per-policy PowerShell switch for this; its behaviour is managed by the service and the policy’s action on detection.

5. Quarantine Policies

Quarantine policies control what users can do with messages held in quarantine.

  1. Navigate to Email & collaboration → Policies & rules → Threat policies.
  2. Under Templates, click on Quarantine policies.
  3. The default quarantine policy for malware (AdminOnlyAccessPolicy) prevents end-users from releasing messages. This is the recommended setting. You can create a new policy and enable notifications or release requests for other threat types (e.g., spam), but for malware, keep it locked down.
  4. You can set up quarantine notifications (digests) for users, which provide a summary of messages in their quarantine.

6. Testing & Validation

Once your policies are configured, you must validate them.

The EICAR Test

Use a safe, legal test file to validate your policies. The EICAR (European Institute for Computer Antivirus Research) test file is a non-malicious file that all major anti-malware programs will detect.

  1. To test the Common Attachment Filter, create a plain text file, rename it to eicar.zip, and place the EICAR string X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* inside it.
  2. To test Safe Attachments, send a test email with the EICAR file attached (as a .zip or other container) to a user in your test group.

Verifying with Message Trace

  1. In the Microsoft Defender portal, go to Email & collaboration → Exchange message trace.
  2. Search for the test message.
  3. Click on the message to view details. The Event field should show a Fail status with the reason Malware.
  4. Header Analysis: You can also check the message headers. Look for the X-Forefront-Antispam-Report header and the SCL (Spam Confidence Level) and PCL (Phishing Confidence Level) values. A message blocked by an anti-malware policy will have a CAT (Category) entry indicating malware.

7. Ongoing Monitoring & Tuning

  • Threat Explorer (MDO P2) / Reports (EOP): Regularly review the Threat Explorer (or Reports for EOP) in the Microsoft Defender portal to see what threats are being blocked. This helps you identify trends, attack vectors, and potential false positives.
  • Configuration Analyzer: Located under Email & collaboration → Policies & rules → Threat policies → Configuration analyzer, this tool compares your custom policies to Microsoft’s recommended Standard and Strict preset security policies. Use it to find and fix settings that are less secure than the recommended baselines.
  • ORCA Module: The Office 365 Recommended Configuration Analyzer (ORCA) is a community-developed PowerShell module that provides a comprehensive report of your M365 security posture. While not an official Microsoft tool, it’s an excellent resource for a deeper dive.
  • False Positive/Negative Submissions: If a legitimate message is blocked (false positive) or a malicious message gets through (false negative), you must submit it to Microsoft for analysis to improve their detection engines. The submission workflow is found under Actions & submissions → Submissions in the Microsoft Defender portal.

8. Change Control & Rollback

  • Documentation: Always document any changes made to a policy, including the date, reason, and the specific settings changed.
  • Phased Rollout: When creating a new policy, first apply it to a small test group before rolling it out to production users.
  • Rollback: If you encounter issues, you can disable the custom policy in the GUI by toggling its status to Off or with PowerShell using Set-MalwareFilterRule -Identity "Rule Name" -State Disabled. You can also decrease its priority to ensure it no longer applies.

9. Final Checklist

Use this checklist to ensure all best practices have been implemented.

  • [ ] Prerequisites: Confirm M365 Business Premium or Defender for Office 365 licensing for advanced features.
  • [ ] Policy Strategy: Leave the default anti-malware policy untouched as a safety net.
  • [ ] New Policy: Create a new custom anti-malware policy for high-risk users/groups (e.g., ExecutiveTeam).
  • [ ] Action: Set the action for malware detection to Quarantine the message.
  • [ ] Common Attachment Filter: Enable and verify a comprehensive list of high-risk file extensions.
  • [ ] Admin Notifications: Configure admin notifications for malware detections.
  • [ ] Sender Notifications: Disable notifications for both internal and external senders.
  • [ ] Safe Attachments (if licensed): Configure a new policy and set the action to Block for high-risk users.
  • [ ] Safe Links (if licensed): Configure a new policy to scan URLs in emails at the time of click.
  • [ ] Quarantine Policies: Confirm the quarantine policy for malware is set to AdminOnlyAccessPolicy to prevent user releases.
  • [ ] Testing: Send a test email with a containerised EICAR file to a user in the new policy’s scope.
  • [ ] Validation: Use Message Trace to confirm the message was blocked, and review the headers for malware detection results.
  • [ ] Monitoring: Schedule a regular review of threat reports and submissions.
  • [ ] Tuning: Address false positives/negatives by submitting them to Microsoft.
  • [ ] Change Control: Document all changes and have a rollback plan in place.
  • [ ] Configuration Analyser: Run the Configuration Analyser and compare your policies to Microsoft’s recommended settings.

For more information, refer to these authoritative resources:

Microsoft 365 Business Premium vs. Hardware Firewalls for SMBs

Small and medium businesses (SMBs) with remote employees have shifted from a single “office network” model to a Zero Trust model. Microsoft 365 Business Premium (BPP) already includes extensive security layers – identity protection, device management, email scanning, and endpoint defenselearn.microsoft.comlearn.microsoft.com. With those controls fully configured, the traditional on-premises network perimeter (and thus an expensive firewall appliance) becomes far less critical. In practice, a standard router/NAT firewall combined with Windows/macOS built‑in firewalls and M365’s cloud protections can cost‑effectively secure a remote SMB. We explain how M365 BPP’s features cover typical firewall functions, and when a dedicated firewall (beyond a basic one) may not be needed.

Built-In Security in Microsoft 365 Business Premium

Microsoft 365 Business Premium bundles multiple security layers: endpoint protection, identity/access controls, device management, and more. Key built‑in features include:

  • Endpoint Security – Microsoft Defender for Business (included) provides next‑gen antivirus, threat detection/response and a host firewall on each devicelearn.microsoft.comlearn.microsoft.com. Devices (Windows, macOS, iOS, Android) get managed protection against ransomware, malware and network attacks.
  • Email and App Protection – Defender for Office 365 Plan 1 (included) scans email attachments and links for malware and phishing. Safe Links/Safe Attachments help stop threats before they reach userslearn.microsoft.com.
  • Identity and Access (Zero Trust) – Azure AD Premium P1 (included) enables Conditional Access policies and mandatory multi-factor authenticationmicrosoft.comlearn.microsoft.com. Only compliant, enrolled devices can access company resources, and admins/devices are always re‑authenticated.
  • Device Management – Microsoft Intune can enforce security policies on all devices: requiring device encryption (BitLocker), patching, endpoint firewalls, and even configuring VPN or Wi‑Fi profileslearn.microsoft.comlearn.microsoft.com. In short, Intune ensures every device meets the company’s security baseline before it connects.
  • Secure Remote Access – Azure AD Application Proxy (via Azure AD P1) publishes any on‑premises app through Azure AD, so remote users can reach internal resources without opening inbound firewall portssherweb.com. This often replaces a VPN or on‑site reverse proxy, making remote access simpler and safer.

These built-in layers cover most attack vectors. For example, M365 BPP’s Defender for Business includes a managed host-based firewall and web filtering, so each laptop is protected on any networklearn.microsoft.com. And Conditional Access can block sign-ins from unsecured locations or unregistered devices, effectively extending the network perimeter to only trusted endpoints.

Zero Trust and Remote Work

In a modern SMB, employees “can work anywhere,” so the old model of trusting the office LAN no longer applies. As Microsoft describes, traditional protections rely on firewalls and VPNs at fixed locations, whereas Zero Trust assumes no network is inherently safelearn.microsoft.com. Every sign-in is verified (via Azure AD) and every device is checked (via Intune) no matter where the user is.

In this diagram, a corporate firewall on the left no longer suffices when employees roam (right side)learn.microsoft.com. With Business Premium, identity and device policies take over: multifactor authentication and Conditional Access ensure only known users on compliant devices connectlearn.microsoft.commicrosoft.com. In effect, the organization’s “perimeter” is the cloud. Remote workers authenticate directly to Azure/Office 365 and receive Microsoft’s protection (e.g. encrypted tunnels, safe browser checks), rather than passing first through an on‑site firewall.

Host-Based Firewalls and Device Security

Even without a hardware firewall, devices must protect themselves on untrusted networks. All common operating systems include a built‑in firewall. Enabling these host firewalls is free and highly effective – many MSP guides advise turning on Windows Defender Firewall (and macOS’s) on every device before even buying a hardware applianceguardianangelit.com. Microsoft Defender for Business not only installs antivirus but can manage each device’s firewall settings: for instance, Intune can push a profile that blocks all inbound traffic except essential serviceslearn.microsoft.com.

By treating each endpoint as its own secured “network edge,” an SMB covers the user’s connection in coffee shops or home Wi‑Fi. For example, if a user’s laptop is on public Wi‑Fi, the Windows firewall (enforced by Defender policies) stops inbound attacks, while Defender’s web protection filters malicious sites. This layered endpoint approach (antivirus+EDR + host firewall + encrypted disk) significantly shrinks the need for a central firewall inspecting all traffic.

Network Perimeter and When to Use Firewalls

If an SMB still maintains an office or data closet, some firewall or router will normally be used for basic perimeter functions (NAT, DHCP, segmentation of guest networks, etc.). However, the level of firewall needed is typically minimal. A basic managed router or inexpensive UTM is often enough to separate IoT/guest Wi-Fi from internal staff, and to enforce outbound rules. Beyond that, heavy enterprise firewalls yield little benefit in a predominantly cloud-centric setup.

For remote-heavy SMBs, many experts suggest zero-trust access (e.g. VPN, ZTNA) instead of relying on office hardware. ControlD’s SMB security checklist, for instance, recommends ensuring VPN or Zero-Trust Network Access for remote employees, rather than expecting them to route through the office firewallcontrold.com. In other words, with cloud apps and M365-managed devices, the on‑site firewall sees only its local subnet – almost all work and threats are already handled by Microsoft’s cloud services and endpoint defenses.

Configuring M365 Business Premium as Your “Firewall”

A Business Premium tenant can be tuned to cover typical firewall functions:

  • Enroll and Update All Devices: Use Intune (part of BPP) to enroll every company device (Windows, Mac, mobile) and onboard them to Defender for Businesslearn.microsoft.comlearn.microsoft.com. Ensure full disk encryption (BitLocker/FileVault), automatic OS updates, and Defender real‑time protection are all enabled.
  • Enforce Host Firewalls: Create an Intune endpoint security policy that turns on Windows Defender Firewall for all profiles (Domain/Private/Public) and disables unnecessary inbound rulesguardianangelit.comlearn.microsoft.com. Similarly, enable the macOS firewall via Intune configuration. This ensures devices block unwanted network traffic by default.
  • Enable Multi-Factor Authentication & Conditional Access: Turn on Azure AD security defaults or define Conditional Access policies so that every login requires MFA and checks device compliancelearn.microsoft.commicrosoft.com. You can restrict access by device state or location, preventing unknown devices from even reaching company apps.
  • Protect Email and Apps: Activate Defender for Office 365 (Plan 1) to scan all incoming email and Teams messages. Safe Links/Attachments in Office documents serve as an additional layer that no firewall can providelearn.microsoft.com.
  • Use Application Proxy for Internal Apps: If you have any on-premises servers, install the Azure AD Application Proxy connector. This publishes apps (e.g. intranet, CRM) through Azure without punching holes in your firewallsherweb.com. Remote users then access the app via Azure AD login, with no need to maintain a VPN or open router ports.
  • Monitor and Respond: Use Microsoft 365 Defender’s security portal (included) to monitor alerts. Its threat analytics will flag unusual traffic or sign-ins. Automated investigation and remediation in Defender for Business can contain a threat on a device before it spreads.
  • Network-Level Protections (Optional): For extra DNS- or web-filtering, an SMB might add services like Microsoft Defender SmartScreen (built into Edge/Windows) or a cloud DNS filter. These complement – but don’t replace – the firewall; they block malicious domains at the device level.

In this configuration, each device and identity becomes a control point. The M365 stack effectively sits in front of your data, rather than hardware at the network perimeter.

Cost vs. Benefit of Dedicated Firewalls

Without regulatory mandates, a high-end firewall appliance is often not cost-justified for an SMB fully on M365. The hardware itself and ongoing subscriptions (threat feeds, VPN licenses, maintenance) add significant cost. Given that M365 Business Premium already provides next-generation protection on endpoints and enforces secure access, the marginal security gain from a $2k+ firewall is small for remote-centric SMBs.

That said, a simple firewall/router is still recommended for the office LAN. It can provide:

  • Basic NAT/segmentation: Separating staff devices from guest or IoT VLANs.
  • VPN termination (if needed): A site‑to‑site VPN or point‑to‑site gateway for branch offices or legacy systems (though Azure VPN with Azure AD is an alternative).
  • On‑prem device connectivity: If on-premises servers exist, the firewall can regulate incoming traffic.

For example, installing Azure AD Application Proxy (no cost beyond BPP license) often removes the need to expose an on‑site port for remote accesssherweb.com. Similarly, if home users connect via secure VPN with M365 credentials, the corporate firewall is bypassed by design.

In contrast, host-based security and cloud controls cover most threats: phishing and remote intrusion are handled by Defender and MFA, malware is stopped at the device, and data exfiltration is controlled by identity and DLP settings. As one MSP guide notes, for small businesses the built-in OS firewalls should be used before investing in hardware firewallsguardianangelit.com. In practice, the total protective overlap from Intune+Defender+Conditional Access can eliminate many risks that a hardware firewall is meant to address.

Conclusion

For a typical SMB with Microsoft 365 Business Premium fully enabled, the need for an expensive dedicated firewall is greatly reduced. M365 BPP delivers comprehensive security – endpoint protection, email filters, and zero-trust access – that, when properly configured, cover most attack vectorslearn.microsoft.comlearn.microsoft.com. A basic network firewall (even the one built into a router) is useful for simple segmentation, but beyond that most protections are handled by Microsoft’s cloud services and host firewalls. In short, by leveraging Business Premium’s features (Defender, Intune, Azure AD P1, etc.), an SMB can safely rely on default and cloud-managed defenses rather than purchasing a high-end firewall applianceguardianangelit.comsherweb.com.

Sources: Microsoft documentation and SMB security guides detailing Microsoft 365 Business Premium’s included protectionslearn.microsoft.comlearn.microsoft.comcontrold.comguardianangelit.comsherweb.com, and industry best practices for SMB security in a remote-work, zero-trust modellearn.microsoft.comcontrold.com.