What your Microsoft licence lets us see
Which checks need Entra ID P1 or P2, which licences we recognise, and how we tell you what an upgrade would buy before you decide whether it is worth it.
Some of what a security assessment would like to look at is not available at every Microsoft licence tier. Where that is the case we say so explicitly — we could not evaluate X because your Entra licence does not emit it — and we tell you what an upgrade would actually add before you decide whether to buy it.
This article is the map: which licences we recognise, which capabilities depend on which tier, and the five findings we produce about licensing itself.
The licences we recognise by name
We read your subscriptions from your tenant and translate Microsoft's internal part numbers into names a human recognises. If your report says Microsoft 365 Business Premium rather than SPB, this table is why.
| What Microsoft calls it | What we call it in your report |
|---|---|
SPB | Microsoft 365 Business Premium |
SPE_E3 or ENTERPRISEPACK | Microsoft 365 E3 |
SPE_E5 or ENTERPRISEPREMIUM | Microsoft 365 E5 |
BUSINESS_BASIC or O365_BUSINESS_ESSENTIALS | Microsoft 365 Business Basic |
BUSINESS_STANDARD or O365_BUSINESS_PREMIUM | Microsoft 365 Business Standard |
AAD_PREMIUM | Microsoft Entra ID P1 |
AAD_PREMIUM_P2 | Microsoft Entra ID P2 |
EMS or EMSPREMIUM | Enterprise Mobility + Security |
EXCHANGESTANDARD | Exchange Online Plan 1 |
A part number we do not recognise is shown to you verbatim rather than guessed at. An invented licence name in a report about your own spending would be worse than an unfamiliar code you can search for.
What depends on your tier
| Capability | Needs | Without it |
|---|---|---|
| Conditional Access policy evaluation — whether a second factor is actually required and whether legacy sign-in is blocked | Entra ID P1 (included in Business Premium) | We can see who has registered a second factor but not whether anything enforces it. The related checks are skipped, not passed. |
| Sign-in log analysis — legacy authentication in use, impossible geography, sign-ins where no policy applied | Entra ID P1 and AuditLog.Read.All | The sign-in stage is recorded as a coverage gap and every check that reads sign-ins is skipped. |
| Last sign-in per account, used to find dormant accounts | Entra ID P1 and AuditLog.Read.All | We could not read when each account was last used, so we have not reported any account as dormant. We retry the user list without the attribute rather than losing your staff list. |
| Sign-in risk scoring — whether Microsoft flagged a sign-in as risky | Entra ID P2 | Microsoft hides its sign-in risk scoring on your licence tier, so we could not check whether any sign-in was flagged as risky. Graph returns the literal string hidden, which we normalise away rather than reading as none. |
| Automatic reaction to a risky sign-in or a compromised password, and on-request administrator access | Entra ID P2 | Reported once, as information, with what it would add. Certain classes of attack are detected later than they otherwise would be. |
Everything else in the assessment works at any tier. Your accounts, your administrators, your groups, your registered devices, your application consents and your inbox forwarding rules are all readable on a Business Basic tenant, and that is where most of the critical findings live.
Why we read service plans, not only the licence name
A licence name is not a capability. Two tenants on the same SKU can have different features actually provisioned, so we read the individual service plans and count only the ones Microsoft reports as provisioned. A plan in any other state cannot be relied on, and recommending a feature you cannot actually use damages trust in the whole report — including the parts of it that are right.
The practical effect is that we will not tell you to configure something your tenant cannot do. If a recommendation appears, the capability behind it was present in your subscriptions when we looked.
The five things we tell you about licensing
| Finding | Severity | What it means |
|---|---|---|
| You are paying for licences nobody is using | Low | Seats you pay for every month that are not assigned to anyone. Your money rather than a security problem — but we can see it and you may not be able to. Spare licences do make it easy to create an extra account without anyone noticing a cost increase. |
| You are paying for security features you are not using | Medium | Your licence includes protections that are switched off. This is the cheapest security improvement available to any business, because the money is already spent. |
| Licences are suspended or overdue | High | Usually a billing problem. When a licence lapses the security features attached to it stop working, generally without anyone being told — the console still shows the policy; the licence to enforce it is gone. |
| More seats are in use than you have paid for | Medium | Microsoft will eventually reconcile this, and features can stop working when it does. Better to unassign the extras deliberately than to let Microsoft choose which accounts lose them. |
| Your licence cannot provide some of the protections you need | Info | The honest note that a higher tier would add specific things. Reported as information because it is a purchasing decision, not a defect in your setup. |
The upgrade is your decision, and no is a reasonable answer
Where a capability needs a higher tier, the change we generate is classified as a business judgement, which means it can only land in the decide bucket. We are not permitted to make it for you at any autonomy setting, and it cannot be presented as a one-tap approval either.
The wording we use is deliberate. You are on Microsoft 365 Business Standard. The next tier adds automatic reaction to risky sign-ins and on-request administrator access. It costs money, so this is entirely your decision and a reasonable answer is no. And the undo note on that change reads: Nothing is purchased or changed unless you act on it yourself.
For many organisations of 40 people the answer genuinely is no. Removing an unused administrator, requiring a second factor on the accounts that already have one registered, and deleting an application consent nobody remembers granting will do more for you than a tier upgrade, and all three are free. Weigh the cost against what it adds, and treat the earlier findings in the report as the higher priority.
What to check yourself
- Whether you already own P1. If your report names Business Premium, you do. Then read the paying for security features you are not using finding first, because it is describing something you have already bought.
- Whether any licence is suspended or in warning. This is the one licensing finding that is a live security issue rather than a spending one.
- Which checks came back skipped for a licence reason. When a check cannot run explains how to read them. The count tells you honestly how much of your estate this report could see.