Microsoft 365
Deployed and
Locked Down
Tenants stood up properly. Conditional Access that actually blocks something. Defender for Business tuned. Intune compliance policies that mean what they say. Licensing right-sized in ZAR. We have been in the M365 admin centre since back when it was called BPOS.
Eight out of ten tenants we audit have a Conditional Access gap. Most passed a security review last year.
MFA enforced, green tick in the admin centre, security policy on paper. The IMAP client still connects. The service account excluded from MFA is unchanged since 2021. The Conditional Access policy scoped to SharePoint is in report-only because no one was confident enforcing it wouldn't break something.
This is the typical Business Premium tenant we inherit. The licences are right. The intent was right. The follow-through wasn't. Legacy authentication still permitted. An attacker who finds a credential logs in via IMAP or SMTP AUTH. The MFA prompt never fires. Conditional Access covers the right apps on paper and misses three service accounts in practice. Defender for Business is fully licenced, policies are default, console untouched for six months.
The most common question we get after an audit is "how did this pass our last review?" The answer is usually that the review checked whether policies existed, not whether they were in enforcement. There's a difference, and attackers know it.
Block legacy auth before you celebrate the green tick. It's one Conditional Access policy. The reason most tenants still have it open is that nobody is sure what it will break. Test it in a pilot group, run report-only for a week, then enforce it. We've done this for 50+ tenants. Nothing breaks. Reach out and we will walk you through every step.
On licensing: most South African SMEs should be on Business Premium. It's the smallest licence that includes the full security stack: Defender for Business, Intune, Conditional Access via Entra ID P1, and Sensitivity Labels. Drop to Business Standard and the security stack simply isn't there. Mixed tiers across the tenant are normal and often cheaper, frontline staff on Business Basic, knowledge workers on Business Premium. Right-sizing is part of the audit, and email authentication (SPF, DKIM, DMARC) goes in as part of the deployment. The full detail is on the DMARC page.
Which SKU actually fits
Most SMEs end up on the wrong tier. Here's the short version we walk clients through before they sign anything. Business Premium is the right answer for almost everyone. Below it, the security stack doesn't exist.
| SKU | Defender for Business | Intune | Conditional Access | Our take |
|---|---|---|---|---|
| Business Basic | No | No | No | Email, Teams and OneDrive. No security stack at all. Fine for frontline workers on a mixed tenant. |
| Business Standard | No | No | No | Adds desktop Office apps. Still no security stack. The gap between Standard and Premium is the entire security product suite. |
| Business Premium | Yes | Yes | Yes (Entra P1) | The right SKU for most SMEs. Defender, Intune, Conditional Access, and AIP P1 for Sensitivity Labels are all included. |
| E3 | Via add-on | Yes | Yes (Entra P1) | Needed when compliance, e-discovery or legal hold requirements appear. Most SMEs hit this when a regulator or listed-company obligation lands. |
| E5 | Yes (P2) | Yes | Yes (Entra P2) | Defender for Office 365 P2, Purview, Entra P2. Worth it when you have a security analyst reading the alerts. Rarely right below 200 seats. |
Mixed tiers are normal and cheaper
Frontline staff on Business Basic, knowledge workers on Business Premium. The security stack applies tenant-wide through Conditional Access regardless of per-user licence. Right-sizing the mix is part of the audit.
Pricing in ZAR moves
Microsoft reprices the local market periodically. Anyone quoting a fixed rand figure from a website is quoting something stale. We pass through CSP partner pricing, billed in ZAR, and give you the current rate when you ask.
Business Standard is the wrong SKU if security matters
Business Standard doesn't include Defender, Intune, or Conditional Access. That's an absent security product, not a missing feature. If you're in a regulated industry or have had a phishing incident, we've had that conversation with clients before.
What We Do in Your M365 Tenant
How an M365 Engagement Runs
Tenant audit against CIS Microsoft 365 Foundations Benchmark v3, licence right-sizing, identity posture check, mail-flow and DNS audit. Written findings, prioritised.
Conditional Access design, Defender for Business policy build, Intune compliance baselines, Sensitivity Labels taxonomy, mail authentication (DMARC, SPF, DKIM, MTA-STS). Change windows agreed in writing.
Pilot group first. Every CA policy goes through report-only mode for at least a week before enforcement. Intune compliance staged by device group. No surprises.
Monthly Secure Score and patch review, quarterly CA revisit, licence right-sizing every renewal, admin escalations on a one-hour SLA during business hours.
CSP partner or buy direct from Microsoft?
Where the partner channel earns its keep, and where it doesn't
| Capability | Via OSH (CSP) | Direct from Microsoft |
|---|---|---|
| ZAR invoicing, local VAT | ✓ | Limited |
| Month-to-month licensing | ✓ | Annual commitment |
| SKU advice (not sales-led) | ✓ | Sales-led |
| Partner escalation channel | ✓ | Public queue |
| Tenant audit against CIS Benchmark | ✓ | Self-service |
| Hardening project delivery | ✓ | Partner-routed |
| Monthly Secure Score review | ✓ | Not included |
Get a 60-Minute M365 Fit and Hardening Review
We log into your tenant read-only, score it against the CIS Microsoft 365 Foundations Benchmark v3, and tell you the three changes that would close the biggest gaps. Written report. No obligation. Real engineer.
M365 Questions We Get Every Week
Get a 60-Minute M365 Fit and Hardening Review
We log into your tenant read-only, score it against the CIS Microsoft 365 Foundations Benchmark v3, and tell you the three changes that would close the biggest gaps. Written report. No obligation. Real engineer.
