Microsoft has made the E5 Security add-on available for Microsoft 365 Business Premium—a focused upgrade that lets SMEs bolt on enterprise-grade protection without moving to the full E5 suite. In a single bundle, you unlock Entra ID P2 (Identity Protection, PIM, Access Reviews), Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, and Defender for Cloud Apps—all orchestrated in the Microsoft 365 Defender portal. The outcome is risk-based access, automated investigation and remediation, advanced threat hunting, and shadow-IT control that go well beyond the Business Premium baseline. For Australian organisations working toward ISO 27001 and lifting ACSC Essential Eight maturity, this add-on delivers a measurable security uplift with predictable, per-user pricing. The guide below explains what you already have, what E5 Security adds, and how Kantanna deploys it to harden your environment end-to-end.
If you’re running Microsoft 365 Business Premium and want enterprise-grade protection without jumping to full E5, the Microsoft 365 E5 Security add-on is the sweet spot. It layers advanced identity, endpoint, email, and SaaS-app protections on top of your existing Business Premium stack—ideal for meeting ISO 27001 controls and lifting ACSC Essential Eight maturity without blowing up your budget.
What you already have with Business Premium (your baseline)
Business Premium includes Entra ID P1 (identity), Intune Plan 1 (device/app management), Defender for Business (endpoint AV/EDR), and Defender for Office 365 Plan 1 (email/web protection), plus Microsoft Purview information protection & DLP. That’s solid coverage for SMEs—but it’s Plan 1 in several areas.
What the E5 Security add-on adds (the big upgrades)
E5 Security upgrades your security stack to “pro mode” in five critical areas:
-
Identity & access: Entra ID P2
Risk-based Conditional Access, Identity Protection, Privileged Identity Management (PIM), and Access Reviews. This tightens admin control and reduces lateral movement risk from compromised accounts.
-
Identity threat detection: Defender for Identity
Sensors on domain controllers spot credential theft, pass-the-hash, and other on-prem AD attack patterns—an ITDR layer most SMEs lack.
-
Endpoints: Defender for Endpoint Plan 2 (P2)
Advanced threat hunting, live response, automated investigation & remediation, and extended telemetry retention (up to 6 months) for deeper investigations.
-
Email/Teams: Defender for Office 365 Plan 2
Automated Investigation & Response (AIR), Threat Explorer/real-time detections, Attack Simulation Training, and advanced hunting—big uplift from Plan 1.
-
SaaS & “shadow IT”: Defender for Cloud Apps
Discover unsanctioned apps, enforce session controls, and protect data across third-party cloud services.
These capabilities surface together in Microsoft 365 Defender, correlating signals across identities, devices, email, and apps—so you see incidents, not thousands of noisy alerts.
What this means in practice for Kantanna clients
- Block more attacks earlier through risk-aware access and identity threat detections (P2 + Defender for Identity).
- Shrink dwell time with automated investigation/remediation in both endpoint and email layers.
- Close SaaS blind spots by discovering/controlling cloud apps where sensitive data may be flowing.
Align with ISO 27001 & ACSC E8 through stronger identity governance, admin control (PIM), logging/retention for investigations, and demonstrable technical controls. Microsoft Learn
What it doesn’t include (so you plan accordingly)
E5 Security is a security bundle—it does not add the full E5 compliance suite (e.g., advanced eDiscovery/Audit, Insider Risk) or Power BI/voice/calling features. For most SMEs, pairing Business Premium + E5 Security delivers the right security-per-dollar; if you need advanced compliance, we’ll discuss E5 Compliance add-on or full E5.
Australian pricing snapshot (as of September 2025)
- Business Premium: AU$32.90 per user/month (ex-GST).
- E5 Security add-on (typical CSP retail in AU):
- ~AU$20.79 per user/month (ex-GST) or AU$237.60 per user/year (ex-GST)
Why upgrade now?
- Threats target identities first. Entra ID P2 + ITDR closes common gaps we see in audits.
- Email remains the #1 attack vector. Plan 2 automation cuts manual triage and speeds response.
- Regulatory pressure is up. The uplift maps cleanly to ISO 27001 Annex A controls and helps push ACSC Essential Eight maturity (esp. MFA, app control, patching visibility, incident response).
- It’s officially supported for Business Premium—Microsoft has documented this add-on path for SMEs, and major AU distributors have announced availability.
How Kantanna implements this (our proven approach)
- Readiness & gap assessment – Map current controls against ISO 27001/ACSC E8 and baseline your Microsoft Secure Score.
- License optimisation – Validate who needs E5 Security
- Deploy & harden – Roll out PIM, conditional access, Defender P2 baselines, DLP/safe links, threat policies, and Cloud App controls.
- Test & simulate – Run attack simulations and threat-hunting exercises; tune policies to reduce noise.
- Operate & improve – Ongoing monitoring, monthly posture reviews, and incident response playbooks.
The bottom line
For 30–300 user organisations, Business Premium + E5 Security delivers the biggest real-world security uplift per dollar: better prevention, faster detection/response, and clearer audit evidence—without paying for features you don’t need. If you’re aiming for ISO 27001 certification or levelling up to ACSC Essential Eight Maturity, this is the upgrade we recommend.