3 September 2026LANTEK Computers
Microsoft’s licensing is genuinely confusing, the names change, and the comparison tables are written in feature names rather than outcomes. Most businesses end up on whatever their provider first quoted, and then either overpay for years or discover during an incident that a control they assumed they had is not included.
We are deliberately not naming editions or quoting prices in this article. Both change, and an article full of specifics becomes quietly wrong. What follows is durable: the capabilities to ask about, in the order they matter, so you can hold a useful conversation whatever the tiers are called this year.
Start from the wrong end deliberately
The usual approach is to compare editions and pick one. That produces a decision nobody can explain.
The better approach is to decide which capabilities your business needs, then find the cheapest way to get exactly those. Sometimes that is a higher edition. Sometimes it is a lower edition plus one add-on. Sometimes it is different editions for different people, which is allowed and which almost nobody does.
The capabilities to ask about, in order
1. Multi-factor authentication
Ask first, because it is non-negotiable. Basic multi-factor is generally available across the range including at the lower end, so this rarely drives the decision. But confirm it, because everything else is secondary to it. Why it is not optional.
2. Conditional rules about who can sign in from where
The ability to refuse or challenge a sign-in based on circumstances: an unfamiliar country, an unmanaged device, an impossible journey. This is where tiers start to differ, and it is the single most valuable thing that sits above basic multi-factor.
Ask specifically: can we require additional verification for sign-ins from outside South Africa, and can we block sign-ins from countries we never operate in?
3. Alerting on mailbox changes
Whether you are told when a forwarding rule to an external address is created, or when somebody is granted access to a mailbox. These are the fingerprints of a compromise, per signs your email has been read, and whether you get alerted or have to go looking is a licensing question.
4. Attachment and link protection on mail
Beyond ordinary spam filtering: opening attachments in isolation before delivery, and checking links at the moment somebody clicks rather than only on arrival. Often an add-on rather than a tier, which is exactly the case where a lower edition plus one item beats an upgrade.
5. Device management
Enforcing encryption, requiring a screen lock, and wiping a lost device. The relevant question is whether you can wipe only the company data from somebody’s personal phone, because full-device wipe on a personal phone is a conversation nobody wants to have.
This capability is a genuine tier differentiator and it is the one most often bought without being used.
6. Retention and legal hold
Preventing deletion, and holding content for a period. A compliance capability rather than a security one, and worth having if you are in a regulated sector or have had a dispute.
One caution: this is not backup. It lives in the same tenant and it does not restore in bulk. Microsoft 365 is not a backup.
7. Reporting and investigation
How far back you can see sign-in and activity history. This is the capability nobody values until an incident, when it is the difference between answering the scope question and guessing at it, which per a notification decision has real consequences.
Ask: how many days of sign-in history do we retain, and can we extend it?
Mixing licences, which most businesses should do
The default is one edition for everybody, and it is usually wrong in both directions at once.
A business typically has: a handful of people whose accounts would be catastrophic to lose control of, being directors, finance and anybody with administrative rights. A majority doing ordinary office work. And sometimes a group who need little more than email, such as shop floor or field staff.
Licensing those three groups identically means either the first group is underprotected or the third group is subsidising features they never touch. Mixing is permitted and it is frequently cheaper overall while being more secure where it counts.
Two things to check before mixing: some tenant-wide features require everybody to be licensed for them, and per-user licensing must actually match who uses what. Ask your provider about both.
What to audit, whatever you are on
Independent of the tier question, and usually the item with the fastest payback.
Are you paying for licences nobody uses? Leavers whose accounts were never deprovisioned, or licences assigned to people who left. Compare the assigned licence list against the payroll. This alone frequently covers the cost of upgrading the accounts that matter.
Are you paying for capabilities you never turned on? Extremely common. A business on a higher tier with the device management and conditional access features unconfigured is paying for security it does not have. Either configure them or move down.
Both of those should be part of a periodic review, which is one of the things a managed service ought to include per what managed IT should include.
The conversation to have with your provider
Not which licence should we be on. Instead, walk the seven capabilities above and ask for each: do we have this today, is it turned on, and what would it cost to have it.
That produces a decision you can explain, and it surfaces the common case where you already own something valuable that nobody enabled.
What we cover is on Cloud Computing, with the security side on Cybersecurity. If you want somebody to go through what you are currently paying for against what is actually configured, ask us.