| Microsoft 365 is Microsoft’s subscription for business email, the Office apps, Teams, file storage and, on the higher plans, security and device management. Small businesses choose between three main plans, Business Basic, Business Standard and Business Premium, and the difference between the last two is mostly security. |
Plenty of New Zealand businesses chose their Microsoft 365 plan once, years ago, and have not looked at it since. Microsoft’s 2026 changes, including versions of the plans with Copilot built in and new pricing, make this a good time to check.
This page explains what each Microsoft 365 business plan includes, how to choose between them, what affects the cost, which security features stay switched off until somebody turns them on, and what changed in 2026. Licensing details were checked in September 2026.
What is Microsoft 365?
Microsoft 365 is a per-user subscription that bundles business email, Word, Excel, PowerPoint and Outlook, Teams, OneDrive and SharePoint storage, and on the higher plans a layer of security, identity and device management tools. You pay monthly or annually for each person, and Microsoft runs the service.
What separates the plans is not really the productivity apps. Every business plan includes email and cloud storage, and each comes in versions with and without Teams. The differences are whether you get the desktop versions of the apps, and above all how much control you have over who signs in, from which devices, and what happens to sensitive information once it is inside the system.
Is Microsoft 365 the same as Office 365?
Mostly, for a small business. Microsoft renamed its small business Office 365 plans as Microsoft 365 business plans some years ago, and the business subscriptions are now sold under the Microsoft 365 name. The Office 365 name survives on some enterprise suites, which is why both names still turn up in search results and on invoices.
What are the Microsoft 365 business plans?
The three main bundled business plans compared here are Business Basic, Business Standard and Business Premium, and they stack: each includes everything in the one below it. Business plans are designed for organisations of up to 300 people, which Microsoft enforces as a limit of 300 seats across all its business plans combined.
- Business Basic gives you business email, Teams, cloud storage and the web and mobile versions of the Office apps. No desktop apps.
- Business Standard adds the desktop versions of Word, Excel, PowerPoint and Outlook, plus a few extra collaboration tools.
- Business Premium adds the security and management layer: conditional access, device management, advanced threat protection for email and devices, and information protection.
Basic, Standard and Premium are available in versions with and without Teams, so check the exact plan name when comparing quotes. Microsoft 365 Apps for business is a separate option that provides the desktop apps and OneDrive where business email is provided elsewhere.
The table below compares the versions with Teams, without Copilot included, and sets out where the security features sit, taken from Microsoft’s own security overview for the business plans. It is the part that decides which plan you need.
| Feature | Basic | Standard | Premium |
|---|---|---|---|
| Everyday apps | |||
| Email, Teams, OneDrive and SharePoint storage | ✓ | ✓ | ✓ |
| Desktop Word, Excel, PowerPoint and Outlook | – | ✓ | ✓ |
| Security and management | |||
| Basic multi-factor authentication through security defaults | ✓ | ✓ | ✓ |
| Conditional access, through Microsoft Entra ID P1 | – | – | ✓ |
| Device management with Microsoft Intune | – | – | ✓ |
| Defender for Business, for laptops and desktops | – | – | ✓ |
| Defender for Office 365 Plan 1, for email threats | – | – | ✓ |
| Sensitivity labels, and data loss prevention for Exchange, SharePoint and OneDrive | – | – | ✓ |
| Windows Business features, on devices already running Windows Pro | – | – | ✓ |
Read down the right-hand column and a pattern jumps out. Between Standard and Premium, the everyday experience barely changes. What changes is the set of tools that control access and protect data. If you have been told that all Microsoft 365 business plans include Intune and Defender, that is not right: in Basic and Standard, the identity service is the free edition, and Intune, Defender for Business and the full Defender for Office 365 Plan 1 are not included.
One more thing to check: Business Premium does not upgrade Windows Home to Windows Pro. Its Windows features only switch on for laptops and desktops that already run Windows Pro, so any Home machines need a Pro upgrade first.
Microsoft’s plan comparison for New Zealand has the full feature list.
How much does Microsoft 365 cost for a business?
The licence cost depends on the plan, the number of users, whether Teams or paid Copilot is included, and the subscription commitment. Compare like with like: a price shown per month may still require an annual commitment, and monthly billing does not necessarily mean you can reduce seats or cancel each month.
Setup, migration, security configuration, ongoing support and backup may be separate from the licence. Ask for a quote that lists those items clearly, including GST treatment, renewal terms and when licence numbers can be changed. Microsoft’s comparison shows current list prices, and Exodesk can help compare the plans against what your team uses and the controls already in place.
What changed with Microsoft 365 in 2026?
Two things, and they are easy to confuse. From 1 July 2026 Business Standard with Copilot and Business Premium with Copilot became standard plans, following earlier Copilot bundle offers. Separately, Microsoft changed prices: existing customers keep their current pricing until renewal, and in its published US dollar list Basic and Standard went up while Premium did not change. New Zealand quotes still depend on local pricing and subscription terms.
The Copilot plans sit alongside the old ones
The new plans are called Microsoft 365 Business Standard with Copilot and Microsoft 365 Business Premium with Copilot. They cost more than the plain versions, because they include paid Copilot in the apps, which is different from the Copilot Chat Microsoft makes available more widely. The important detail is that the plain Business Standard and Business Premium plans have not gone anywhere. They are still sold in New Zealand, on Microsoft’s own site.
At the time of writing, Microsoft’s main pricing page leads with the Copilot plans, with the plain plans on a separate tab. A business owner comparing plans for the first time could easily conclude that Standard now costs a good deal more than it used to, when the plan they actually want is one click away.
Whether Copilot is worth it for your business is a separate decision. Our page on Microsoft Copilot covers what it does well and what needs sorting out first, particularly around who can see which files.
The plans without Teams
Basic, Standard and Premium also come in versions without Teams. These started in Europe after a competition case and were extended worldwide from April 2024. They leave out Teams chat, meetings, calling and webinars, and they cost less. Microsoft groups Bookings and Shifts with the Teams versions in its New Zealand comparison, so check the exact plan if you rely on them. They make sense only if your business already uses a different tool for meetings and chat, and Teams can be added back later on its own if you change your mind. Teams meetings and internal calls are not the same as a business phone system: calling outside numbers needs extra licensing and connectivity, covered on our Microsoft Teams Phone page.
Which Microsoft 365 plan does a small business need?
Business Premium is our usual starting point for businesses that need Microsoft’s identity, device and information-protection tools together. It includes conditional access through Microsoft Entra ID P1, Intune and additional security capabilities, but those tools still need to be configured and managed. Basic or Standard can be appropriate where they meet each person’s app needs and the required security controls are provided through other licences or services. We check what is already in place before recommending an upgrade or a mixed set of plans.
The Privacy Commissioner has said that two-factor authentication is a bare minimum for small businesses holding or sharing personal information digitally, and that a small business which has a cyber-related privacy breach without it should expect to be found in breach of the Privacy Act. That is an expectation about safeguards, not an endorsement of a particular plan, and every Microsoft 365 plan can meet the minimum through security defaults. But security defaults are all or nothing. Deciding that sign-ins from an unmanaged laptop or an unexpected country should be refused, or that administrators need a stronger method than everybody else, takes conditional access, which is included in Business Premium or available through Microsoft Entra ID P1 licences. Our page on multi-factor authentication requirements covers the rest.
- Start with Business Premium if you need conditional access, device management and information protection together and do not already have them through other licences or services, for example where staff work from laptops outside the office or you want to be able to lock or wipe enrolled devices.
- Business Standard can be a reasonable choice where people need the desktop apps and the security controls you require are already provided another way.
- Business Basic suits people who only need email, Teams and the web versions of the apps, such as field staff or occasional users, and it can be mixed with other plans in the same business.
Mixing plans is allowed and can be sensible. There is no rule that everybody in the business has to be on the same one. Every user who benefits from a licensed feature needs the right licence and configuration, so assigning Premium to a few people does not secure the whole tenancy, and people on other plans still need protecting.
What Microsoft 365 security is switched off by default?
A good deal of it, including features you are already paying for. Microsoft 365 ships with sensible basics turned on for many new tenancies, but the more powerful controls wait for somebody to configure them, and older tenancies may not even have the basics. The table shows where each control starts and what to check. Our cloud security service covers configuring and reviewing these controls.
| Control | Out of the box | What to check |
|---|---|---|
| Security defaults All plans |
Might be on for tenancies created from 22 October 2019. Check yours. | Whether they are on, or replaced by conditional access. They get switched off to fix a problem and forgotten. |
| Conditional access Premium |
Policies may already exist, including Microsoft-managed ones | Their scope, state and exclusions, plus rules for unmanaged devices, unexpected countries and admin sign-ins. Tailored policies replace security defaults. |
| Defender for Office 365 Premium |
Basic protection for email links and attachments | The stronger Standard or Strict preset is turned on. |
| Defender for Business Premium |
Protects only onboarded laptops and desktops | Every company laptop and desktop is onboarded. |
| Data loss prevention Premium |
Not set up for New Zealand data | A policy using the New Zealand patterns below. |
Basic and Standard are not left with nothing on email. Microsoft’s 2026 packaging update adds protection that checks links at the moment they are clicked to both plans, rolling out from mid-June 2026 with completion for business plans expected by 30 September 2026. It is useful, but it is one feature rather than the full Defender for Office 365 Plan 1 protection in Premium.
Data loss prevention that knows New Zealand
This is an underused feature worth knowing about. Premium’s data loss prevention covers Exchange Online, SharePoint and OneDrive. It can recognise sensitive information in email and documents and warn or block before it is sent somewhere it should not go, and Microsoft has built-in patterns for New Zealand data:
- IRD numbers, for payroll, tax and accounting records.
- New Zealand bank account numbers, for invoices, payment details and supplier records.
- Driver licence numbers, collected as proof of identity.
- Ministry of Health numbers, which is to say NHI numbers, for anyone holding health information.
For a medical practice, an accountant or a payroll provider, that is protection aimed at the information you hold. A recognised pattern is not a guarantee: policies have to select the right information types, locations and actions, and be tested against your own documents. Wider coverage, such as Teams chats or devices, can need additional licensing.
Is Microsoft 365 backed up?
Not in the way many businesses assume. Microsoft keeps the service running and keeps deleted items recoverable for limited periods, but those protections are designed around mistakes caught quickly, not a copy of your data that you control and can go back to months later.
The difference matters when something is deleted and nobody notices for a while, when a departing employee removes files on the way out, or when an attacker with a working password deletes or encrypts what they can reach. In each case the recovery options depend on how long ago it happened and which setting was in place at the time.
Built-in retention and recovery can help, but their scope and time limits may not match what your business needs. Exodesk provides separately managed backup and recovery for the workloads agreed in your scope. Our page on Microsoft 365 backup sets out what the built-in retention covers, how long it lasts and how recovery works.
What do businesses pay for and not use?
More than you would think, across every plan. The Microsoft 365 subscription covers a set of tools that many businesses do not open, and several of them replace things people pay for separately.
- SharePoint as an intranet rather than a place files go to be lost. Set up properly it replaces the shared drive and the policy folder. Our page on SharePoint intranets covers how.
- OneDrive folder sync, which keeps each person’s Desktop and Documents folders in OneDrive so a failed laptop does not take their work with it. It protects against a dead device, not against deletion, which is the backup question above.
- Power Automate for the small repeated tasks, approvals and notifications that eat time every week. Standard connectors are included; premium connectors need extra licensing.
- Intune on Premium, which lets you set up new laptops remotely, enforce encryption, and lock or wipe a lost device that is enrolled, supported and able to connect. Our page on Microsoft Intune goes into the detail.
The other common waste is licences themselves: accounts still paid for after somebody left, and people on a higher plan than their work needs. A licence review every few months can identify unused subscriptions and mismatched plans.
Frequently Asked Questions
What is Microsoft 365 in simple terms?
Microsoft 365 is a per-user subscription that covers business email, the Office apps, Teams, cloud file storage and, on the higher plans, security and device management. Microsoft runs the service and you pay for each person, monthly or annually. Small businesses choose between Business Basic, Business Standard and Business Premium, and can mix them within the same business.
What is the difference between Business Standard and Business Premium?
The apps are the same. Premium adds the security and management layer: conditional access through Microsoft Entra ID P1, device management with Intune, Defender for Business on laptops and desktops, Defender for Office 365 Plan 1 for email, sensitivity labels and data loss prevention, and Windows Business features on devices already running Windows Pro. Standard includes none of those.
Which Microsoft 365 plan should a small business choose?
Business Premium is our usual starting point for businesses that need identity, device and information protection together, including conditional access and Intune. Basic or Standard can be appropriate where they meet the app needs of each person and the required security controls come from other licences or services. We check what is already in place before recommending an upgrade or a mix of plans.
What are the Microsoft 365 Copilot plans?
From 1 July 2026 Business Standard with Copilot and Business Premium with Copilot became standard plans, following earlier Copilot bundle offers. They include paid Copilot in the apps and cost more than the plain versions. The plain Standard and Premium plans are still sold in New Zealand, and at the time of writing the Microsoft pricing page shows the Copilot versions first.
What are the Microsoft 365 plans without Teams?
Versions of Basic, Standard and Premium that leave out Teams chat, meetings, calling and webinars, at a lower price. They began in Europe after a competition case and were extended worldwide from April 2024. Microsoft groups Bookings and Shifts with the Teams versions in its New Zealand comparison, so check the exact plan if you rely on them. Teams can be bought separately later if needed.
Is Microsoft 365 the same as Office 365?
For a small business, largely yes. Microsoft renamed its small business Office 365 plans as Microsoft 365 business plans, and the business subscriptions are now sold under the Microsoft 365 name. The Office 365 name still exists on some enterprise suites, which is why both names appear in search results and on invoices.
How many users can a Microsoft 365 business plan have?
Up to 300. Microsoft limits business plans to 300 seats in total across all its business plans combined, so a business with more people than that moves to the enterprise suites. Within that limit you can mix Basic, Standard and Premium licences for different people in the same organisation.
How much does Microsoft 365 cost for a business?
It depends on the plan, the number of users, whether Teams or paid Copilot is included and the commitment term. A price shown per month may still require an annual commitment, and setup, migration, support and backup can be separate from the licence. Ask for a quote that lists those items, the GST treatment and when licence numbers can be changed.
Does Microsoft 365 include multi-factor authentication?
Yes, on every plan, through security defaults, which might be enabled in tenancies created from 22 October 2019, so check yours. Security defaults apply a fixed baseline with little room to adjust. Finer control, such as refusing sign-ins from unmanaged devices or requiring stronger methods for administrators, needs conditional access, which comes with Business Premium through Microsoft Entra ID P1.
Can Microsoft 365 detect IRD numbers and other New Zealand data?
Yes, on Business Premium, for Exchange, SharePoint and OneDrive. Its data loss prevention includes built-in patterns for New Zealand IRD numbers, bank account numbers, driver licence numbers and Ministry of Health numbers, which covers NHI numbers. Policies have to be set up and tested against your own documents, and can then warn or block when that information is about to be sent somewhere it should not go.
Is Microsoft 365 data backed up by Microsoft?
Not in the sense many businesses mean. Microsoft keeps the service available and keeps deleted items recoverable for limited periods, but that is not a copy you control and can return to long after something was deleted or encrypted. What the built-in retention covers depends on the setting and how long ago the loss happened, which our Microsoft 365 backup page sets out. Exodesk provides separately managed backup for the workloads agreed in your scope.
Can we mix Microsoft 365 plans in one business?
Yes. You can give Premium to the people who need its identity, device and information-protection tools, Standard to people who need the desktop apps, and Basic to people who only need email and Teams. Every user who benefits from a licensed feature needs the right licence and configuration, so Premium for a few people does not secure the whole business.
How often should we review our Microsoft 365 licences?
Every few months. The two common problems are licences still paid for after people have left, and people on a higher plan than their work needs. A regular review catches both, and it is also a good moment to check that security defaults or conditional access are still switched on, since they are sometimes turned off to fix a problem and forgotten.
NEXT STEP
Need help choosing or managing Microsoft 365?
Talk to Exodesk about the plans your team needs, the security controls already in place and the work needed to set things up properly. We can scope licensing, migration, configuration, support and backup for businesses across New Zealand. For a broader review of your IT, see our IT assessment.
Or read more about our managed IT services.
