The Security Gap Nobody Budgets For: What's Built Into Microsoft, What Isn't

Somewhere on your desk is a Microsoft renewal quote that costs more than last year's. It lists Entra ID P1 and Defender for Office 365 Plan 1 by name, and if someone asked which of them are switched on in your tenant today, you'd need a few days to find out.

That delay is the gap. Configuration and response sit on top of it, and neither one usually gets a budget line of its own. Dave Sampson, Senior Vice President of Cybersecurity & Advisory at Ascend Technologies, puts the test leadership should run in one line: "How do we prove that we have deployed systems in a way that we think we have deployed them?" October is Cybersecurity Awareness Month, which makes it a good month to run that test against your Microsoft stack.

“Very often, one of the things we see when customers do have breaches, it’s because access was achieved within their environment through some tool that likely was implemented internally and not by someone who’s experienced with that particular tool.” — Dave Sampson, Ascend Technologies

What Microsoft Includes, by License

Start with what's on paper. You can't find the gap without knowing the baseline.

Microsoft 365 Business Premium caps at 300 users and lists at $22 per user per month, unchanged in Microsoft's July 2026 pricing update. It bundles Entra ID P1 for identity and Conditional Access, Intune for device management, Defender for Office 365 Plan 1 for email protection, and Defender for Business. That last one matters: it includes endpoint detection and response (software that watches device behavior for signs of an attack) along with automated investigation and response. For an organization under the seat cap, that's a serious security baseline, and it gets less credit than it deserves.

Microsoft 365 E3 removes the seat cap and lists at $39 per user per month after the July 2026 increase, up from $36. It adds Windows Enterprise licensing and deeper Purview compliance tooling. Its endpoint protection is Defender for Endpoint Plan 1, which covers next-generation antivirus and attack surface reduction but leaves out the detection, investigation, and automated response that Business Premium's Defender for Business includes. You can pay nearly twice as much per seat and get a lighter endpoint toolset than the cheaper plan. Teams usually find that out during an incident rather than at renewal.

Microsoft 365 E5 lists at $60 per user per month and is the full stack: Defender for Office 365 Plan 2 with attack simulation and post-breach investigation, Defender for Endpoint Plan 2, Entra ID P2 for risk-based Conditional Access and privileged identity management, and advanced Purview for data loss prevention and insider risk.

One trap worth naming. Office 365 E3 and Microsoft 365 E3 are different products with nearly identical names. Office 365 E3 includes no Intune, no Entra ID P1, no Defender for Endpoint, and no Windows licensing. If you aren't certain which one you hold, check that first, and confirm it in the admin center rather than from memory. Microsoft's own documentation draws the distinction more carefully than most reseller quotes do.

Q: What security features are included in Microsoft 365? A: Microsoft 365 Business Premium includes Entra ID P1, Intune, Defender for Office 365 Plan 1, and Defender for Business, which adds endpoint detection and response. Microsoft 365 E3 adds enterprise licensing and Purview compliance, with Defender for Endpoint Plan 1 for antivirus and attack surface reduction. E5 adds Defender for Office 365 Plan 2, Defender for Endpoint Plan 2, Entra ID P2, and advanced Purview. Ascend Technologies configures these controls against each organization's compliance obligations through Microsoft 365 Management.

What Changed on July 1, 2026

The packaging change matters more than the price increase everyone noticed.

Microsoft 365 E3 gained Defender for Office 365 Plan 1, which brings Safe Links, Safe Attachments, and anti-phishing into a license that previously needed a separate add-on, one that ran about $2 per user per month. If your E3 invoice still carries a standalone email security product, that tool should now have to earn its place. Sometimes it does. Some organizations keep a third-party filter for a specific use case or because the team trusts it. That should be a decision someone made this year, rather than a line item that renewed itself.

Timing is the part to act on. Existing customers stay on current pricing until their first renewal after July 1, 2026. If yours lands in the next few months, you're about to have a licensing conversation, and you'll have a better one with a current map of your own entitlements. Ascend Technologies handles Microsoft licensing as part of managed IT for that reason.

What No License Includes

Some gaps have a price tag. Advanced Purview compliance sits at E5 or in add-ons. The Defender Suite add-on brings Business Premium closer to E5 threat protection, though not to full parity on compliance and information protection. A purchase order closes those.

A purchase order can’t close two gaps. The first is configuration. Microsoft publishes security baselines, but no license applies them to your tenant or keeps them tuned as your environment and Microsoft’s defaults change. The second is attention. Defender raises an alert. Entra flags a risky sign-in. Both assume someone on the other end sees it and decides what to do. Microsoft sells the capability. Setting it up right and watching it are on you.

That work takes people who have done it before. Sampson points to the skills behind it: “It takes different skill sets, experience, and certifications to operate these tools effectively.” That’s the expertise Ascend’s team brings. Ascend runs Microsoft heavily and plugs in other vendors’ tools when a use case or a customer’s preference calls for it. The license is the foundation. Coverage comes from the layers built on it.

Q: Does Microsoft 365 include a security team? A: No. Microsoft 365 licenses include security tooling such as Defender, Entra ID, and Purview, but no license tier includes analysts who monitor the alerts those tools generate or respond when something looks wrong. Licenses also don't include applying and tuning security baselines to your tenant. Ascend Technologies provides both layers through Ascend Defend. Ascend Defend Shield turns Business Premium licensing into a fully managed security foundation and is included in Ascend Core. Ascend Defend Guardian adds a 24/7 Security Operations Center with managed detection and response, meaning a security team that watches your environment around the clock and acts when something looks wrong instead of only sending an alert.

“Understand where your boundaries are from organizational expertise and experience and where those start and end. Wherever that ends is where your outsourcing plan needs to begin.” — Dave Sampson, Ascend Technologies

The Three Layers Between a License and Actual Protection

Every Microsoft security investment has three layers, and they get funded very differently.

Entitlement is what your license includes. Finance approves it, it appears on a renewal quote, and it's the only layer with a clear owner and a budget line.

Configuration is what's switched on and tuned to how your business works: Conditional Access policies, data loss prevention rules, device compliance baselines. This layer usually gets funded once, by whoever set up the tenant, and then drifts. Defaults stay defaults. New features ship into your license and nobody turns them on. If you answer to HIPAA, SOC 2, or CMMC, an auditor will ask for evidence of configured controls, and a license PDF doesn't count. Sampson has seen what drift costs: "Very often, one of the things we see when customers do have breaches, it's because, access was achieved within their environment through some tool that likely was implemented internally and not by someone who's experienced with that particular tool."

Response is who reads the output and acts on it. This layer has no line item, no owner, and no renewal date. It gets assumed rather than budgeted, and the assumption usually lands on an internal team of two to eight people already covering the help desk, the network, and the audit. Sampson's advice is to draw the line on purpose: "But understand where your boundaries are from organizational expertise and experience and where those start and end, right? Wherever that ends is where your outsourcing plan needs to begin."

Which puts one question on your renewal checklist: are you using Defender, or just paying for it?

Q: How do I know if my Microsoft security tools are configured correctly? A: Check whether your Conditional Access policies were built for your business or left at defaults, whether anyone receives Defender alerts and acts on them, and whether your email protection reports any intercepted phishing or impersonation attempts. If your provider can't say which controls are switched on in your tenant today, that's the gap. Ascend Technologies maps a tenant's current Microsoft 365 configuration against what the license already includes as part of Microsoft 365 Management.

A Renewal-Season Audit You Can Run This Week

Five checks, all answerable from inside your own environment without a vendor conversation.

1. Identify your exact SKU. "We're on E3" isn't an answer. Office 365 E3 or Microsoft 365 E3, confirmed in the admin center.
2. Check whether Conditional Access policies exist, and whether anyone has reviewed them since the tenant was built.
3. Find out who receives Defender alerts and what happens after one arrives. If the answer is a distribution list, the answer is nobody.
4. Look at what your email protection caught last month. Sampson treats silence as a warning sign: "We implement a solution, email filtering, and there's no results regarding intercepted, emails, right? Like impersonation attacks or phishing attacks, right? If we're not seeing that, something's not right." While you're there, check whether a standalone email tool now overlaps with what E3 includes.
5. Check your headcount against 300. If you're near the Business Premium cap, know what changes the day you cross it, because your security baseline changes with it.

Then take the answers upstairs. Sampson recommends a quarterly security meeting with whoever owns organizational risk, CEO and CFO included: "Get these folks together so that quarterly we can say, this is what our security program looks like." Five answers from this audit make a strong first agenda.

Your renewal quote prices the tools. The alert nobody read never shows up on an invoice, right up until it shows up in an incident report.

Talk to an expert about Ascend Defend for Microsoft 365.