Microsoft 365 Business Premium is one of the best Microsoft licences for a small or mid-sized law firm.

It includes far more security than many firms realize.

You get Microsoft Entra ID P1 for identity protection, Microsoft Intune for device management, Microsoft Defender for Business for endpoint security, Microsoft Defender for Office 365 Plan 1 for email protection, and Microsoft Purview features for information protection and data loss prevention. Microsoft designed Business Premium for organizations with up to 300 users.

So, is Microsoft 365 Business Premium enough for a law firm?

As a security platform, often yes.

As a complete cybersecurity program, no.

That distinction matters.

A 25-person Ontario law firm can have excellent Microsoft licensing and still have poor security if nobody properly configures it, watches the alerts, backs up the data or responds when something suspicious happens.

Let’s break down what Microsoft 365 Business Premium gives a law firm, where the gaps are, and what we would add.

---

What Does Microsoft 365 Business Premium Include?

Business Premium isn’t simply Outlook, Word and Excel with a few security features added.

Microsoft currently includes several serious business security products with the licence:

• Microsoft Entra ID Plan 1
• Microsoft Intune Plan 1
• Microsoft Defender for Business
• Microsoft Defender for Office 365 Plan 1
• Microsoft Purview Information Protection
• Microsoft Purview Data Loss Prevention for email and files

It also includes Microsoft 365 applications, Exchange email, OneDrive and SharePoint.

For a law firm with 10, 30, 50 or even 100 staff, that is a very good starting point.

The problem is that owning these tools and using them properly are two different things.

---

1. Identity Security: Yes, Business Premium Is Strong

A stolen password is one of the easiest ways into Microsoft 365.

Business Premium includes Microsoft Entra ID P1. That gives the firm access to Conditional Access, which can control how users are allowed to sign in. Microsoft confirms Entra ID P1 is included with Business Premium.

That means your law firm can do things such as:

• Require MFA
• Apply different rules to administrators
• Control access based on device status
• Block unwanted authentication methods
• Require stronger controls for sensitive applications

For most small and mid-sized law firms, this is enough to build a strong identity-security foundation.

But it has to be configured.

Simply buying Business Premium does not magically build your Conditional Access policies.

Our verdict:

Business Premium: YES

Configuration still required: YES

---

2. Multi-Factor Authentication: Yes

Business Premium gives you the tools needed to require MFA across your firm.

That should include lawyers, clerks, assistants, accounting staff and administrators.

More sensitive accounts should receive stronger protection.

That especially applies to:

• Microsoft 365 administrators
• Managing partners
• Accounting staff
• People with access to trust funds
• IT administrators

A firm can also use phishing-resistant authentication methods such as passkeys or security keys where appropriate.

Our verdict:

Business Premium: YES

But MFA still needs to be properly deployed and monitored.

---

3. Endpoint Protection: Surprisingly Good

This is one of the strongest parts of Business Premium.

It includes Microsoft Defender for Business.

Defender for Business is more than basic Windows antivirus. Microsoft describes it as an endpoint-security product designed for organizations with up to 300 users and includes protection against ransomware, malware, phishing and other threats.

It includes capabilities such as:

• Endpoint detection and response
• Threat and vulnerability management
• Attack-surface reduction
• Antivirus and antimalware protection
• Automated investigation and remediation

It can protect Windows, macOS, Android and iOS devices.

That’s a serious security product.

A law firm does not automatically need to buy another EDR product simply because somebody tells them Microsoft Defender isn’t enough.

When properly configured and monitored, Defender for Business can be a very capable endpoint security platform.

Our verdict:

Business Premium: YES

But there is an important word there:

monitored.

We’ll come back to that.

---

4. Server Protection: Not Automatically

Here is one of the first gaps.

Defender for Business protects licensed users’ endpoint devices, but Windows and Linux servers require additional licensing.

Microsoft offers Defender for Business Servers as an add-on to Business Premium, with a separate licence required for each server.

That matters for firms still running:

• File servers
• Active Directory servers
• Practice-management servers
• SQL servers
• Remote Desktop servers
• Other on-premises legal applications

A completely cloud-based firm may have very few servers.

A traditional firm may still have several.

Our verdict:

Workstations: YES

Servers: Additional licensing required

---

5. Device Management: Yes

Business Premium includes Microsoft Intune.

Intune lets the firm’s IT provider centrally manage Windows, macOS, iOS and Android devices. Microsoft confirms that Business Premium includes the full Intune capabilities available under the plan.

For a law firm, that can help manage:

• Security settings
• BitLocker encryption
• Software deployment
• Mobile devices
• Compliance policies
• Windows configuration
• Lost devices
• Application access

This becomes very useful when lawyers work from home, court, client offices and other locations.

Instead of hoping every laptop has the right security settings, the firm can manage those settings centrally.

Our verdict:

Business Premium: YES

---

6. Laptop Encryption: Yes

Lawyers carry a lot of information around.

Sometimes literally.

A laptop may contain cached email, OneDrive files, client documents and access to practice-management systems.

Business Premium and Intune can help centrally manage BitLocker encryption on Windows devices.

If a laptop disappears from a car or airport, encryption becomes an important layer of protection.

Our verdict:

Business Premium: YES

Again, somebody needs to actually turn it on and verify it.

---

7. Email Security: Good, But Not Microsoft’s Highest Tier

Business Premium includes Microsoft Defender for Office 365 Plan 1.

That provides protection against threats in email and Microsoft collaboration tools.

For many smaller law firms, Plan 1 gives you a good email-security base.

But Microsoft also has Defender for Office 365 Plan 2.

Plan 2 adds capabilities including automated investigation and response, attack simulation training, threat trackers, advanced hunting and more advanced investigation tools. Microsoft now offers these higher-level capabilities through its Defender Suite add-on for Business Premium.

Does every law firm need Plan 2?

No.

A firm may use another managed email-security platform or security-awareness system instead.

The important thing is the control, not the Microsoft product name.

Our verdict:

Basic advanced email protection: YES

Microsoft’s more advanced email security capabilities: NO — additional licensing or another security service may be needed

---

8. Phishing Training: You Still Need a Program

Technology can filter thousands of malicious messages.

Eventually, something will get through.

A lawyer may receive a fake DocuSign notice.

An assistant may get a fake Microsoft password-expiry warning.

Accounting may receive an email that looks like it came from a partner asking for an urgent wire transfer.

Business Premium’s included Defender for Office 365 Plan 1 does not include Microsoft’s Attack Simulation Training. Microsoft lists that capability with Defender for Office 365 Plan 2 through its newer Defender Suite for Business Premium.

You can add Microsoft’s higher tier.

Or use a separate cybersecurity-awareness and phishing-testing platform.

Either approach can work.

Our verdict:

Security awareness program: Additional service or licence needed

---

9. 24/7 Human Monitoring: No

This may be the biggest misunderstanding.

Microsoft Defender can detect threats.

It can create alerts.

It can automatically investigate certain activity.

But buying Business Premium does not mean a security analyst is personally watching your law firm’s Microsoft environment 24 hours a day.

Software and a security operations team are not the same thing.

For firms that want 24/7 monitoring, somebody still needs to provide that service.

That may be:

• An internal security team
• An MSP
• An MDR provider
• A managed SOC service

LAWPRO’s case study of an Ontario law firm that suffered a cyberattack identified continuous monitoring of endpoints, servers, cloud services and network components as one of the security improvements made after the attack.

Our verdict:

Security technology: YES

24/7 human MDR/SOC monitoring: NO

---

10. Microsoft 365 Backup: No

This is another big one.

Business Premium does not mean that Microsoft 365 Backup is included in your licence.

Microsoft now offers its own Microsoft 365 Backup product for Exchange, OneDrive and SharePoint, but it is a separate pay-as-you-go service based on the amount of protected data.

A law firm can also use a third-party Microsoft 365 backup platform.

The product is less important than having a clear recovery plan for:

• Exchange email
• OneDrive
• SharePoint
• Teams-related data where required

LAWPRO also recommends a proper backup strategy because law firms increasingly hold client files, communications and work product only in digital form.

Our verdict:

Microsoft 365 Backup included with Business Premium: NO

Separate backup strategy required: YES

---

11. Backup Restore Testing: No

Buying backup still isn’t enough.

Someone needs to test recovery.

Can you restore an email?

A mailbox?

A SharePoint site?

A lawyer’s OneDrive?

How long would it take?

This is operational work.

No Microsoft licence will automatically replace a managed backup-testing process.

Our verdict:

Technology available: YES

Managed restore testing: NO

---

12. Data Loss Prevention: Yes, at a Useful Basic Level

Business Premium includes Microsoft Purview Information Protection and Data Loss Prevention for email and files.

That can help a firm identify and protect sensitive information.

But Microsoft also offers much more advanced Purview capabilities as add-ons to Business Premium.

Those higher tiers can add features such as more advanced DLP, records management, insider-risk management, advanced eDiscovery and expanded auditing.

For a 15-person firm doing family law, the standard Business Premium capabilities may be enough.

For a larger litigation firm with complex discovery, retention and governance requirements, additional Microsoft Purview capabilities may make sense.

Our verdict:

Basic information protection and DLP: YES

Advanced compliance and governance: MAY REQUIRE ADD-ONS

---

13. Advanced Identity Protection: Not All of It

Business Premium gives you Entra ID P1.

Microsoft’s newer Defender Suite for Business Premium upgrades that to Entra ID P2 and adds capabilities such as Microsoft Entra ID Protection and additional identity governance.

That brings features such as more advanced identity-risk detection and risk-based access decisions.

Does every 10-person firm need Entra ID P2?

Probably not.

Could it make sense for a 75-person firm with a more complex environment and high-value data?

Absolutely.

Our verdict:

Strong identity controls: YES

Microsoft’s advanced identity-risk capabilities: ADDITIONAL LICENSING

---

14. Network and Firewall Security: No

Microsoft 365 Business Premium does not replace your office firewall.

It doesn’t manage your switches.

It doesn’t secure your Wi-Fi design.

It doesn’t segment guest wireless from your internal network.

It doesn’t replace DNS security.

Your firm still needs network security appropriate to the environment.

Our verdict:

Business Premium: NO

---

15. Incident Response Planning: No

Imagine somebody compromises a partner’s Microsoft 365 account tomorrow morning.

What happens next?

Who investigates?

Who disables the account?

Who checks mailbox rules?

Who reviews sign-in history?

Who determines what information may have been accessed?

Who contacts management?

Who contacts the firm’s cyber insurer?

Who documents the incident?

A Microsoft licence cannot make those decisions.

LAWPRO continues to warn Ontario lawyers that law firms are attractive cybercrime targets because of both the confidential information they hold and the money moving through their accounts.

Your firm still needs an incident-response process.

Our verdict:

Security tools: YES

Incident response plan and people: NO

---

So, Is Microsoft 365 Business Premium Enough?

For most small and mid-sized Ontario law firms, we think Microsoft 365 Business Premium is the right Microsoft 365 starting point.

It gives you an unusually strong set of tools in one licence.

Microsoft currently includes:

• Entra ID P1
• Conditional Access
• MFA capabilities
• Intune
• Defender for Business
• Defender for Office 365 Plan 1
• Information Protection
• DLP
• Device management
• Endpoint detection and response

All within a plan designed for organizations with up to 300 users.

That’s a very strong foundation.

But Business Premium is not a managed cybersecurity service.

It doesn’t automatically give you:

• 24/7 security monitoring by humans
• Microsoft 365 backup
• Backup restore testing
• Security-awareness management
• Full incident response
• Firewall and network protection
• All advanced Entra ID P2 capabilities
• Defender for Office 365 Plan 2
• All advanced Purview capabilities
• Server protection without additional licensing

That is the difference.

---

What We Would Use for a Typical Ontario Law Firm

For a typical 10-to-100-person Ontario law firm, we would be very comfortable building a cybersecurity program around Microsoft 365 Business Premium.

The base might look something like this:

Microsoft 365 Business Premium

Provides the productivity platform, identity security, device management, endpoint protection and Microsoft 365 security controls.

Proper Microsoft 365 hardening

Conditional Access, MFA, separate administrator accounts, device policies, email-security configuration, SharePoint controls and other tenant security settings.

24/7 security monitoring

Someone needs to watch and respond to security events.

Microsoft 365 backup

Microsoft’s own backup platform or an appropriate third-party service.

Security awareness and phishing testing

Regular training for lawyers and staff.

Managed firewall, network and DNS security

Protection beyond Microsoft 365.

Documented incident response

A clear process for what happens when something goes wrong.

Quarterly security reporting

Proof that the controls are actually operating.

That is a very different thing from simply buying Microsoft 365 Business Premium licences.

---

What About Microsoft Defender Suite for Business Premium?

This has become more interesting.

Microsoft now offers a Defender Suite add-on specifically for Business Premium customers.

It adds several capabilities previously associated with higher Microsoft enterprise security licensing, including:

• Entra ID P2
• Microsoft Defender for Identity
• Defender for Endpoint Plan 2
• Defender for Office 365 Plan 2
• Microsoft Defender for Cloud Apps
• More advanced threat hunting and investigation
• Attack simulation training
• Risk-based identity protection

For some law firms, that could make sense.

Especially firms that want to build most of their security stack inside Microsoft.

But we wouldn’t automatically tell every law firm to buy it.

A firm may already receive some of those controls from its managed cybersecurity provider using other security platforms.

Buying two products that solve the same problem doesn’t automatically make you twice as secure.

The architecture should be deliberate.

---

The Bigger Problem Is Usually Configuration

Here is what we would worry about more than whether your firm has P1 or P2.

Does every user actually have MFA?

Are Conditional Access policies configured?

Are administrator accounts separate?

Are old accounts removed?

Are laptops encrypted?

Is Defender properly deployed?

Is email authentication configured?

Are SharePoint sharing permissions controlled?

Is anyone reviewing security alerts?

Is Microsoft 365 being backed up?

When was the last restore test?

Those questions usually tell you much more about the security of a law firm than the name printed on the Microsoft invoice.

---

Why This Matters for Ontario Law Firms

The Law Society of Ontario’s Rules of Professional Conduct state that lawyers should understand the benefits and risks associated with technology relevant to their practice, while recognizing their duty to protect confidential information.

That doesn’t mean the LSO tells firms which Microsoft licence to buy.

It means the firm needs to manage the risks created by the technology it uses.

If Outlook, SharePoint, OneDrive and Teams contain confidential client information, then Microsoft 365 security deserves more attention than simply asking:

“Do we have MFA?”

---

How Atomic Guardian Approaches Microsoft 365 for Law Firms

At Atomic Guardian, we generally see Microsoft 365 Business Premium as an excellent foundation for small and mid-sized law firms in Vaughan, Toronto and across Ontario.

We don’t think firms need to buy every Microsoft security product available.

We do think the important controls need to exist.

That means properly configuring Microsoft 365, protecting identities and devices, monitoring security events, securing email, backing up data, testing recovery and documenting the firm’s security posture.

The question isn’t:

“Do we have Microsoft 365 Business Premium?”

The better question is:

“Are we actually using the security we already paid for, and what risks are still left?”

For many law firms, that’s where the real work starts.

This article provides general technology and cybersecurity information and is not legal advice. Microsoft licensing and product capabilities change regularly. Law firms should confirm current Microsoft licensing and consult current Law Society of Ontario guidance when determining their professional, privacy and cybersecurity requirements.

For a closer look at the security controls that matter after licensing, explore our Microsoft 365 security hardening service.