MICROSOFT 365 LICENSE SIZING FOR SMALL BUSINESS — BASIC, STANDARD, PREMIUM, E3, E5 vs F3.

THE MICROSOFT 365 PLAN LANDSCAPE IN 2026.

Microsoft 365 is the productivity, collaboration, and security suite Microsoft sells to businesses — covering Outlook (email), Teams (collaboration), Word / Excel / PowerPoint (productivity), SharePoint (intranet and document storage), OneDrive (file storage), plus an expanding set of security and compliance modules. By 2026 the plan lineup has three main tracks for SMBs and one for enterprise:

• Microsoft 365 Business plans (Basic, Standard, Premium): designed for businesses under 300 users. Most North Central Florida SMBs land here.
• Microsoft 365 Enterprise plans (E3, E5): designed for organizations above 300 users or with specific enterprise security and compliance modules required. Some SMBs adopt these when E5 modules are needed.
• Microsoft 365 Frontline plans (F1, F3): designed for shift workers, field staff, kiosk users, retail floor, clinical staff — anyone who doesn't need full desktop Office.
• Standalone components: Exchange Online, Microsoft 365 Apps, Defender for Office 365, Intune, Entra ID Premium — available individually for special cases or to augment a base license.

The single biggest M365 decision an SMB makes is picking between Business Standard and Business Premium. Standard ($12.50/user/month annual commitment) is the productivity-apps-only plan. Premium ($22/user/month annual commitment) adds the security stack — Defender for Office 365 Plan 1, Defender for Business EDR, Microsoft Intune device management, and Entra ID Premium P1 identity. The price difference is $9.50/user/month, and for any SMB with sensitive data, compliance obligations, or cyber insurance, Premium is the answer. Over 95% of SMBs Simply IT works with land on Business Premium or higher.

The second biggest decision is whether to mix SKUs across users. Section 06 covers the mixing logic in depth. The short version: a 20-person company can typically save 15-20% by running a blend of Business Premium (for knowledge workers and executives), Business Standard (for less-sensitive operations), and Business Basic or F3 (for shared-device or field workers) — without compromising the security baseline for users who actually need it.

BUSINESS PLANS: BASIC, STANDARD, PREMIUM (THE SMB DEFAULT).

Microsoft 365 Business Basic — $6/user/month annual. Includes Outlook, Teams, OneDrive (1 TB/user), SharePoint, Exchange Online (50 GB mailbox), and web/mobile versions of Word, Excel, and PowerPoint. Does not include desktop versions of Office apps. Best for: shared-device users, mobile/field users, reception staff, part-time contractors, anyone who works exclusively from a browser or phone. The cheapest fully-licensed M365 path; pairs well with the higher-tier plans for the rest of the staff.

Microsoft 365 Business Standard — $12.50/user/month annual. Everything in Basic plus desktop versions of Word, Excel, PowerPoint, and Outlook for Windows and Mac. Adds Publisher (Windows only), Access (Windows only), Microsoft Bookings, and Forms. Best for: knowledge workers who need full Office on a dedicated PC or Mac and don't require the Premium security stack. In practice, the SMB use case for Standard is narrow — most knowledge workers also need the Premium security layer.

Microsoft 365 Business Premium — $22/user/month annual. Everything in Standard plus the security stack: Defender for Office 365 Plan 1 (Safe Links, Safe Attachments, anti-phishing), Defender for Business (EDR endpoint protection across Windows, Mac, iOS, Android), Microsoft Intune device management (mobile and desktop), Entra ID Premium P1 (Conditional Access, group-based licensing, self-service password reset, advanced MFA enforcement), and Azure Information Protection P1. Best for: any business with sensitive client data, compliance obligations (HIPAA, FTC Safeguards, FL Bar 4-1.6, PCI), cyber insurance requirements, or remote workforce. The default for nearly every SMB Simply IT works with.

The Business plans cap at 300 users in a single tenant. Most Florida SMBs never approach that cap. Mid-300s businesses sometimes mix Business and Enterprise plans during a transition period, though Microsoft restricts certain configurations — consult before structuring a hybrid tenant of that size.

ENTERPRISE PLANS: E3, E5, F1, F3.

Microsoft 365 E3 — $36/user/month. Designed for organizations above 300 users or those needing enterprise compliance features not available in Business plans: extended mailbox retention (in-place archive), eDiscovery Premium, Information Protection labels with full deployment options, Privileged Access Management, advanced audit log retention. Detection capability is roughly equivalent to Business Premium minus Defender for Business (Defender for Endpoint Plan 1 is the E3 endpoint layer, with Plan 2 available as an upgrade). For most North Central Florida SMBs E3 is overkill — you'd pay the premium for enterprise compliance modules you don't use day-to-day.

Microsoft 365 E5 — $57/user/month. Everything in E3 plus Defender for Office 365 Plan 2 (Threat Explorer, Attack Simulator, AIR), Defender for Identity (on-prem AD monitoring), Defender for Cloud Apps (SaaS security), Power BI Pro, MyAnalytics. For SMBs, E5 is almost always more capability than needed. The exception: businesses with specific E5-only modules required for SOC 2 Type 2 audits, certain CMMC paths, or advanced compliance requirements.

Microsoft 365 F1 — $2.25/user/month. Lightweight web/mobile license for shift workers, frontline staff, kiosk users. Includes Teams, OneDrive (2 GB), SharePoint with read-only on most content, and limited Office web apps. Best for: retail floor staff, restaurant front-of-house, manufacturing line workers, warehouse staff — users who need to receive Teams messages and check schedules but don't produce documents.

Microsoft 365 F3 — $8/user/month. The full Frontline tier. Web and mobile versions of Word, Excel, PowerPoint, Outlook, OneNote; Teams; SharePoint; OneDrive (2 GB); Exchange Online (2 GB mailbox). No desktop Office apps. Best for: clinical staff with shared workstations, field service workers with tablets, manufacturing supervisors, hotel front desk, retail managers. Critical constraint: F-licenses cap at 50% of total tenant users, so for every F-licensed user you must have at least one regular Business or Enterprise licensed user.

The Frontline plans (F1 and F3) are tied to the user, not the device — multiple shift workers can share a single physical device, but each individual user requires their own F license. Common Florida deployments: medical practice front-desk (F3), dental hygienists with chairside iPads (F3), restaurant managers (F3), construction site supervisors with phones (F3 or F1), warehouse pickers (F1).

THE ADD-ON SKUs YOU'LL ACTUALLY USE.

Microsoft sells dozens of add-on SKUs. For SMBs, these are the ones that actually come up in real procurement conversations:

• Microsoft 365 Copilot — $30/user/month, annual commitment. Generative AI integrated into Outlook, Word, Excel, PowerPoint, Teams, and OneNote. The marquee add-on of 2024-2026. For SMBs, deploy to 10-30% of users (executives, marketing, sales, finance, analyst roles) rather than everyone — the per-user spend justifies the productivity gain where it's concentrated.
• Defender for Office 365 Plan 1 — $3/user/month standalone (included in Business Premium). Adds advanced email security: Safe Links, Safe Attachments, anti-phishing policies, impersonation protection. Required for any SMB with cyber-insurance requirements above the basic spam/malware tier.
• Defender for Office 365 Plan 2 — $5/user/month above Plan 1. Adds Threat Explorer for security analysts, Attack Simulator for phishing awareness training, automated investigation and response (AIR). Becomes worth the upgrade for SMBs with a dedicated IT lead or strong compliance documentation requirements.
• Microsoft Defender for Endpoint Plan 1 / Plan 2 — $3 / $5.20/user/month standalone. EDR for SMBs not on Business Premium. Plan 1 covers core EDR; Plan 2 adds advanced threat investigation. See our EDR vendor comparison for the full landscape.
• Entra ID Premium P1 — $6/user/month standalone (included in Business Premium). Conditional Access, group-based licensing, self-service password reset, advanced MFA enforcement. The identity layer that makes Conditional Access policies enforceable.
• Entra ID Premium P2 — $9/user/month standalone (P1 + $3). Adds Identity Protection (risk-based Conditional Access), Privileged Identity Management, Access Reviews. Worth the upgrade for IT administrator accounts; usually not necessary for end users.
• Microsoft Intune Plan 1 — $8/user/month standalone (included in Business Premium). Mobile device management, mobile application management, conditional app launch. The device-management layer.
• Microsoft Purview Archive — $3/user/month standalone. Long-term mailbox archive for retention beyond Exchange Online's defaults. Required for some regulated practices.
• Power BI Pro — $14/user/month standalone (included in E5). Self-service BI platform for users producing dashboards and analytics.
• Exchange Online Plan 1 — $4/user/month. Standalone email (50 GB mailbox) without the productivity apps or security stack. Niche use case.

The math on standalone components is what makes Business Premium so dominant. Adding Defender for Office 365 P1 ($3) + Defender for Business ($3) + Intune ($8) + Entra ID Premium P1 ($6) to a Business Standard base ($12.50) totals $32.50/user/month for less integration. Business Premium delivers the same components at $22/user/month with native integration in one portal. The Business Premium bundle is one of the strongest value plays in Microsoft's catalog.

LICENSE SIZING BY SEAT COUNT — 5, 10, 15, 25, 50, 100 USERS.

Concrete recommendations by company size for typical North Central Florida SMBs. Each scenario assumes an office-based knowledge-worker business in a regulated or compliance-touching industry — the typical Simply IT client profile. Numbers are at published commercial Microsoft pricing; nonprofits substitute accordingly.

Across all of these scenarios, the security baseline of Business Premium remains intact for the users handling sensitive data. The mixing exists to right-size the productivity spend for users who genuinely don't need the desktop apps or the security stack. The wrong mix — putting a knowledge worker on Basic, or a PHI-handling staffer on Standard — undermines the whole purpose of the license decision.

MIXING SKUs: WHY MOST SMBs SHOULD RUN A BLENDED LICENSE MIX.

The case for mixing SKUs is simple: not every user in your organization has the same productivity and security needs. A bookkeeper who lives in Excel needs Business Premium with Copilot. A field service technician who only checks email on a phone needs Business Basic. Putting both on the same license — either by over-licensing the technician at $22/month or under-licensing the bookkeeper at $6/month — is wrong in both directions.

The typical SMB license mix has three or four tiers:

• Tier 1 — Business Premium + Copilot ($52/user/month): Executives, finance leads, marketing leads, sales leads, analysts — high-leverage users where Copilot productivity gain justifies the spend. Usually 10-30% of users.
• Tier 2 — Business Premium ($22/user/month): Office-based knowledge workers handling client data, PHI, financial information — the bulk of the workforce for most regulated practices. Usually 50-70% of users.
• Tier 3 — Business Standard ($12.50/user/month): Operations / admin roles outside the sensitive data flow who still need full desktop Office. Useful where the data segregation is real and documented.
• Tier 4 — Business Basic ($6/user/month) or F3 ($8/user/month): Shared-device, mobile, field, frontline staff who don't need desktop Office. F3 is preferable to Basic for shift workers because F3 includes Teams calling and the Office mobile apps; Basic is preferable for traditional desk staff who don't share devices.

The case against over-mixing: every additional SKU type adds operational complexity. Group-based licensing in Entra ID Premium (included with Business Premium) makes the management overhead reasonable, but each tier you add doubles the configuration surface. For a 20-person company, 3-4 license tiers is the sweet spot. Beyond that the savings curve flattens and the management overhead grows.

The Business Premium math vs assembled components. If you need any of the Business Premium security components individually, Business Premium is cheaper than Business Standard + standalone purchases. Standard ($12.50) + Defender for Office 365 P1 ($3) + Defender for Business ($3) + Intune ($8) + Entra ID Premium P1 ($6) = $32.50/user/month, versus Business Premium at $22 for the same components with native integration. The bundle discount is one of the strongest in Microsoft's commercial catalog and the reason Business Premium dominates SMB deployments.

PRICING REALITY AND ANNUAL vs MONTHLY COMMITMENTS.

Microsoft sells M365 on two commitment models, and the choice has real impact on SMB cost. Annual commitment paid monthly is the standard published pricing (e.g., $22/user/month for Business Premium). You commit for 12 months and pay monthly; seats can be added at any time but typically can't be reduced until renewal. Annual commitment paid annually is the same per-user rate but paid as a lump sum up front — sometimes useful for cash flow planning but offers no additional discount. Monthly commitment is roughly 20% more expensive ($26.40/user/month for Business Premium) but allows month-to-month flexibility — useful for short-term contractors, seasonal staff, project-based engagements.

The 20% monthly premium adds up fast. For 25 Business Premium users at the monthly rate: $26.40 × 25 × 12 = $7,920/year versus $22 × 25 × 12 = $6,600/year at annual. Annual saves $1,320 per year. For 50 users it's $2,640 per year. The right approach for most SMBs is annual-commit-paid-monthly as the default with a few monthly-flex licenses reserved for high-turnover roles or temporary staff.

CSP (Cloud Solution Provider) channel pricing through partners like Simply IT is the same as direct Microsoft pricing — no markup, no discount. The value an MSP adds is configuration, security baseline, ongoing management, and the BAA + compliance documentation work — not licensing arbitrage. Some non-Microsoft channels claim discounts but those are usually for Microsoft Action Pack partners reselling at thin margins.

Microsoft has been increasing list prices roughly 5% annually since 2022. Plan for 3-5% increases at renewal. Multi-year prepayments are sometimes available through the CSP channel to lock in current pricing for 3 years — useful when budget predictability matters more than seat flexibility.

NONPROFIT AND FRONTLINE WORKER LICENSING.

Microsoft 365 Nonprofit pricing is dramatically discounted for qualifying 501(c)(3) organizations and equivalents. The economics dramatically change the SKU math for nonprofits:

• M365 Business Basic Nonprofit: FREE for up to 300 users.
• M365 Business Standard Nonprofit: FREE for up to 300 users.
• M365 Business Premium Nonprofit: $5.50/user/month (vs $22 commercial).
• M365 Apps for Nonprofit: FREE.
• F1 Nonprofit: FREE.
• F3 Nonprofit: $2.50/user/month (vs $8 commercial).

For nonprofits that qualify, Business Premium at $5.50/user/month is the dominant economic choice — the security stack at this price is effectively unbeatable. Houses of worship qualify as nonprofits in most cases (501(c)(3) status); many religious nonprofits don't realize they qualify and pay commercial prices unnecessarily. The verification process through Microsoft Nonprofit Hub (or TechSoup) takes 1-3 weeks; once verified, the nonprofit pricing applies retroactively in some cases.

Frontline (F-series) licensing constraints worth knowing:

• F-licenses cap at 50% of total tenant users. For every F-licensed user you need at least one regular Business or Enterprise licensed user.
• F-licenses are per-user, not per-device. Shift workers can share a physical device, but each user needs their own license to log in.
• F3 includes Teams Phone capability for receiving calls (with an additional Teams Phone license); F1 does not.
• F-licenses are subject to Microsoft's Frontline policy — users must genuinely meet the “non-knowledge-worker” profile. Microsoft has reserved the right to audit and reclassify; in practice this rarely happens at SMB scale but worth knowing.

Common Florida deployments: medical practice front-desk staff on F3, dental hygienists with chairside iPads on F3, restaurant managers on F3, construction site supervisors on F1 or F3, warehouse pickers on F1, retail floor staff on F1 or F3 depending on POS requirements.

THE 10 THINGS THAT DRIVE M365 LICENSE CHOICE.

License choice is rarely a single-criterion decision — it's a weighted-average of these 10 factors. The right SKU for any specific user is the one that satisfies the most of these factors at the lowest cost.

1. 01
   Compliance Obligation

   HIPAA, FTC Safeguards, FL Bar 4-1.6, PCI DSS, CMMC, SOC 2. Each framework has minimum-control requirements that map to specific M365 SKUs. Business Premium is the minimum for any framework with mandated security controls (HIPAA, FTC Safeguards, FL Bar). CMMC Level 2+ pushes to Microsoft 365 GCC, a separate license tier and a major migration.
2. 02
   Cyber Insurance Requirements

   Every major cyber-insurance carrier (Coalition, Travelers, AIG, Chubb, Beazley) requires MFA, EDR, email security, and Conditional Access on the underwriter questionnaire. Business Premium provides all four out of the box; Standard requires standalone add-ons; Basic isn't enough on its own. Insurance compliance often dictates Business Premium as the minimum.
3. 03
   Sensitive Data Flow Through the Endpoint

   Does this user routinely touch PHI, PII, payment data, or client confidential information? If yes, Business Premium minimum. If no (truly — documented in the data flow diagram), Standard or Basic can be defensible. Many SMBs assume users don't handle sensitive data when in fact those users receive emails containing it.
4. 04
   Device Management Need (Intune)

   If the business owns the device or has BYOD policy with company-data segregation, Intune device management is needed. Intune is included in Business Premium. Without it, lost or stolen devices can't be remotely wiped of company data — a significant breach risk.
5. 05
   Identity Security Posture (Conditional Access)

   Conditional Access policies (block sign-in from outside the US, require MFA on risky sign-ins, block sign-in from unmanaged devices) require Entra ID Premium P1 — included in Business Premium. The identity layer is increasingly where attacks are blocked vs the endpoint.
6. 06
   Email Threat Profile

   Does this user have wire-transfer authority, supplier-payment authority, or executive-impersonation exposure? Business Premium's Defender for Office 365 Plan 1 covers most SMB needs; Plan 2 adds threat investigation. For high-risk users a specialty platform like Proofpoint may be layered on top — see our email security platforms guide.
7. 07
   Remote / Hybrid Work Posture

   Remote and hybrid workers benefit disproportionately from Business Premium because Intune, Conditional Access, and Defender for Business all keep working over the public internet without VPN. The remote-work productivity gain is real but the security gain is larger.
8. 08
   Specialty Apps and Power Users

   Copilot ($30/user/month) for high-leverage users (executives, analysts, marketing). Power BI Pro for analytics users. Visio Plan 1 or Plan 2 for users producing process diagrams. These add-ons land on top of the base SKU, not in place of it.
9. 09
   Compliance Archive / Retention Requirements

   Litigation hold, FINRA archiving, FL Bar retention. Business Premium includes the default M365 archive features; longer retention requires Purview Archive ($3/user/month) or E3/E5 plans with extended retention built in.
10. 10
    Frontline / Shared-Device Worker Count

    Shift workers, retail floor, manufacturing, clinical staff — F1 or F3 instead of Business plans. Capped at 50% of total users. Significant cost saver for businesses with large frontline populations.

The right answer for any specific user is rarely “all 10 say the same thing.” The decision is a weighted-average across these factors. For most Florida SMB knowledge workers, Business Premium wins on 7-8 of the 10 criteria, making it the structural default. The mix exists for users where 4-5 of the criteria don't apply.

COMPLIANCE-DRIVEN SKU DECISIONS — HIPAA, FTC, FL BAR, CMMC.

For regulated industries the SKU decision is often dictated by the compliance framework. Each framework maps to a minimum M365 license tier:

HIPAA (medical, dental, veterinary, behavioral health, pharmacy): Business Premium minimum for any user touching PHI. Microsoft Business Associate Agreement (BAA) must be activated in the M365 admin portal — it's not automatic. The BAA covers Exchange Online, SharePoint Online, OneDrive for Business, Teams, and the core compliance services. The technical safeguards required by 45 CFR 164.312 (access control, audit logging, integrity, transmission security) all map to Business Premium components. Document the M365 controls in your Security Risk Analysis. See our HIPAA cybersecurity guide for the full implementation path.

FTC Safeguards Rule (CPAs, accountants, financial planners, tax preparers, mortgage brokers, auto dealers, payday lenders): Business Premium minimum for all users. The Safeguards Rule (16 CFR Part 314) requires MFA, encryption, access controls, and incident response — all of which the Premium stack provides. Reference the M365 controls in your Written Information Security Program (WISP). See our FTC Safeguards guide.

Florida Bar Rule 4-1.6 (law firms): “Reasonable efforts” standard under FL Bar guidance maps to Business Premium minimum. The 2026 FL Bar interpretation specifically calls out cloud security controls, BAA equivalents for client confidential data, and supervised use of AI — all of which the Business Premium stack supports. See our FL Bar 4-1.6 guide.

PCI DSS (any business taking credit cards): Business Premium covers most PCI requirements at the M365 layer (MFA, access logging, network segmentation via Conditional Access). Specific PCI requirements for the payment-processing environment itself sit outside M365 and require additional controls.

CMMC (defense contractors, DoD supply chain): Level 1 can sometimes be supported by Business Premium for non-CUI handling environments. Level 2 typically requires migration to Microsoft 365 GCC (Government Community Cloud) — a separate license tier and a major migration project. Level 3 requires GCC High. CMMC isn't a license-tier change; it's a tenant migration. See our CMMC compliance guide.

SOC 2 (businesses with SOC 2 commitments to customers): Business Premium is typically sufficient for SOC 2 Type 1 reporting. For Type 2 audits or when customer requirements specifically call for advanced compliance modules, E3 or E5 may be needed. The decision often turns on which Trust Services Criteria are in scope and what controls the auditor accepts.

THE SIMPLY IT M365 LICENSE MIX — RECOMMENDED BY INDUSTRY AND SIZE.

Simply IT's default for new managed clients is Microsoft 365 Business Premium for all knowledge workers, with mix-ins for specific scenarios. The reasoning is consistent across our client base: Premium is the only SMB plan that satisfies cyber insurance, compliance frameworks (HIPAA, FTC Safeguards, FL Bar), and modern security expectations out of the box without standalone add-ons.

For office-based small businesses (5-25 users): 100% Business Premium. The mixing complexity isn't worth the dollar savings at this size, and the security stack is what the business needs. Total cost typically $110-550/month for the M365 layer.

For mid-sized SMBs (25-100 users): Business Premium for office knowledge workers, F3 for shared-device staff (clinical, reception, field), Business Standard for documented operations roles outside the sensitive data flow. Copilot for 10-20% of power users where productivity gain justifies the spend. Entra ID Premium P2 for IT and security administrator accounts.

For regulated practices (medical, dental, legal, CPA — any size): 100% Business Premium for all users with PHI / client data exposure. BAA activated, Conditional Access policies enforced, Intune device management deployed, Defender for Business EDR on every endpoint. F3 only for staff demonstrably outside the data flow (very rare in a small practice).

For nonprofits (any size): 100% Business Premium for Nonprofit ($5.50/user/month). The economics make it the obvious choice — the security stack at that price is unbeatable. Houses of worship qualify and frequently don't realize it.

For approaching-Enterprise-size businesses (100-300 users): Plan migration to E3 within 12-18 months. Begin tenant prep work early. Specifically: identify users who need E5-only modules, evaluate compliance archive requirements, and plan Conditional Access policy redesign for E3-tier scale.

For defense contractors with CMMC Level 2+: Microsoft 365 GCC tenant required. This is a separate planning conversation — not a license swap. The migration is substantial and should be paced over 90-180 days with the CMMC assessor consulted on every major step. If you'd like a vendor-neutral M365 license sizing recommendation specific to your business, get a free Simply IT M365 license audit — we'll review your current SKUs against actual usage, compliance environment, and growth trajectory, then provide a written recommendation. No obligation, no long-term contracts.

FREQUENTLY ASKED QUESTIONS.