Choosing a Microsoft 365 license involves more than deciding whether employees need Word, Excel, and Outlook. Your choice also affects how you protect business email, manage devices, and control access to company information.
For businesses in Austin and Houston, three common options are Microsoft 365 Business Basic, Business Standard, and Business Premium. Here is how they compare, how they fit into SOC 1 and SOC 2 requirements, and what to consider when keeping records for seven years or longer.
SOC 1 and SOC 2 do not require a particular Microsoft 365 license. Purchasing a license does not, by itself, make your company compliant.
Watch: Which Microsoft 365 Plan Does Your Team Actually Need?
Watch this Microsoft 365 licensing video on YouTube.
Microsoft 365 Business Plans at a Glance
| Feature | Business Basic | Business Standard | Business Premium |
|---|---|---|---|
| Business email using your company domain | Yes | Yes | Yes |
| Web and mobile Office apps | Included | Included | Included |
| Licensed desktop Office apps | Not included | Included | Included |
| OneDrive and SharePoint | Included | Included | Included |
| Baseline email filtering | Included | Included | Included |
| Advanced identity, device, and threat protection bundle | Separate licensing needed | Separate licensing needed | Included |
| Typical fit | Employees working mainly online | Employees needing desktop Office apps | Productivity plus centrally managed security |
Microsoft offers versions with and without Teams, so confirm the exact subscription before purchasing. These business plans are designed for organizations with up to 300 users. See Microsoft’s business plan comparison for current offerings.
Business Basic: Email and Online Productivity
Business Basic is a practical option for employees who mainly use business email, shared files, and browser-based applications.
Example: A field technician checks email, reviews job documents, and updates files from a phone or web browser. They do not need installed desktop versions of Word or Excel.
Basic may meet those productivity needs. The company must still determine how to secure the employee’s account and device. Basic does not mean security can be ignored.
Business Standard: Desktop Office Applications
Business Standard adds installed desktop applications such as Word, Excel, PowerPoint, and Outlook.
Example: An office manager prepares proposals in Word, works with spreadsheets in Excel, and uses desktop Outlook throughout the day.
Standard may be the right productivity license. However, moving from Basic to Standard does not provide the full security and device management bundle included with Premium. Choose Standard when desktop applications are the main requirement, and evaluate security separately.
Business Premium: Productivity and Stronger Security Controls
Business Premium combines desktop applications with additional security and management tools:
- Microsoft Entra ID P1: Supports Conditional Access policies governing access to company resources.
- Microsoft Intune Plan 1: Helps manage devices and protect business applications and data.
- Microsoft Defender for Business: Provides endpoint protection, detection, and response capabilities.
- Microsoft Defender for Office 365 Plan 1: Adds protections against malicious email links and attachments.
These tools help establish and enforce security policies. See Microsoft’s Business Premium security overview.
Example: A professional services company has employees working from the office, home, and customer locations. They access contracts, financial records, and confidential documents. BCS would evaluate Premium as a potential foundation for controlling access, managing devices, and protecting email.
The tools still require proper configuration, monitoring, and ongoing maintenance.
What Is SOC 1, and Which License Is Required?
SOC means System and Organization Controls in this context. A SOC 1 examination addresses controls at a service organization relevant to its customers’ internal control over financial reporting.
Example: A payroll processing company calculates payroll for customers. Its controls could affect the accuracy of those customers’ financial reporting.
There is no universal requirement to purchase Business Premium for SOC 1. Licensing depends on the controls needed within the examination’s scope. Premium may help implement access restrictions, device management, and threat protection. Another organization might use Basic or Standard alongside separately licensed security tools.
The company must also address payroll processing controls, approvals, change management, and other relevant procedures. Microsoft 365 licensing covers only part of that environment. Read the AICPA SOC 1 overview.
What Is SOC 2, and Who Needs It?
A SOC 2 examination evaluates a service organization’s controls against relevant Trust Services Criteria covering security, availability, processing integrity, confidentiality, or privacy. The examination’s scope determines which categories apply.
Example: A software company hosts customer information. Prospective customers request a SOC 2 report before trusting the company with their data. Other potential examples include managed service providers, data hosting companies, and outsourced service providers handling sensitive customer information.
Does every business need a SOC 2 report? No. A formal report may be driven by customer contracts, procurement requirements, or the services provided. A local business does not automatically need a SOC 2 examination simply because it uses Microsoft 365.
Every business should assess its security needs, even when a formal report is unnecessary. See the AICPA SOC 2 guide.
Which Microsoft 365 License Supports SOC 2?
SOC 2 does not prescribe Business Basic, Standard, Premium, or E5. For a smaller organization preparing for SOC 2, BCS would often evaluate Business Premium first because its bundled tools can support access and device controls.
The final decision should follow the organization’s control requirements. Additional tools or licenses may be needed for logging, evidence retention, monitoring, or other requirements.
Premium does not replace documented policies, employee training, access reviews, incident response procedures, or an independent examination.
Does Everyone Need Business Premium?
Not automatically. Different employees may have different productivity needs. However, employees covered by licensed security features need appropriate licenses. Buying Premium for one administrator does not automatically license those features for the entire company.
Example: A company wants managed device checks and Conditional Access policies for all employees accessing confidential files. It should evaluate licensing for everyone covered by those controls, not just the IT manager.
Mixing plans requires careful planning so security coverage matches the people and information being protected.
Microsoft’s SOC Reports Do Not Cover Your Entire Business
Microsoft publishes SOC reports for specified cloud services. Those reports can support vendor reviews and audit evidence, but they do not mean your company has completed its own SOC examination.
Your business still controls user permissions, configurations, devices, and operating procedures. Review Microsoft’s reports for the relevant services and reporting period. See Microsoft’s SOC 1 and SOC 2 documentation.
A Security Operations Center, also called a SOC, is a separate concept: a team or service that monitors and responds to threats. Business Premium does not automatically provide a staffed, 24/7 monitoring service.
Microsoft 365 Add-Ons: What About Seven-Year Retention?
“We need to keep our records for seven years” sounds simple, but first identify the records: email, SharePoint and OneDrive documents, Teams conversations, or audit logs showing who accessed or changed information. These require different retention settings and sometimes different licenses.
Keeping Email and Documents for Seven Years
Microsoft Purview retention policies can preserve covered content for a specified period, even when a user deletes it.
Example: A company’s approved records policy requires certain business emails to be retained for seven years. IT configures a retention policy for the appropriate mailboxes.
The starting date matters. For email, retention generally runs from when a message was sent or received. Applying a seven-year policy today to a six-year-old email generally preserves it for one more year, not seven additional years.
Which License or Add-On Do You Need?
| Requirement | Licensing option to evaluate |
|---|---|
| Basic or Standard users need policy-based email preservation | Exchange Online Archiving add-on, or an appropriate license upgrade |
| Email, SharePoint, and OneDrive retention policies | Business Premium includes standard retention policy rights |
| More email archive capacity | Exchange Online Archiving; Business Premium already includes auto-expanding archive rights |
| Advanced automatic labeling or records management | Additional Microsoft Purview licensing may be required |
An email archiving add-on does not automatically provide retention rights for every Microsoft 365 service. Licensing must match the content locations, features, and users covered. See the Microsoft Purview licensing guidance.
Can You Keep Records Longer Than Seven Years?
Yes. Supported Microsoft Purview content retention policies can specify 10 years, 15 years, or indefinite retention. A longer period does not automatically require E5 or a special “over seven years” add-on. Standard content retention licensing may already support the desired duration.
Example: A company’s approved policy requires project records to be retained for 10 years. It can configure an appropriate retention policy instead of assuming everything must be deleted after seven years.
Longer retention also requires storage planning. Preserved SharePoint and OneDrive content counts toward storage quotas, and retained email must fit within applicable mailbox and archive limits. See Microsoft’s retention settings documentation.
What Does Exchange Online Archiving Do?
Exchange Online Archiving provides additional email archiving and preservation capabilities for eligible subscriptions.
Example: An employee has years of customer correspondence and needs an online archive with more capacity.
Business Premium already includes auto-expanding archiving, up to Microsoft’s published 1.5 TB limit per eligible user. Basic and Standard users may need the archiving add-on for those expanded capabilities.
Moving email into an archive does not, by itself, prevent deletion. The preservation policy or hold must also be configured.
Seven-Year Audit Logs Are Different
Keeping an email is different from keeping a log showing who accessed a mailbox or changed a file.
Microsoft offers a 10-Year Audit Log Retention add-on, used with qualifying Audit Premium licensing. Despite its name, this add-on is also required for Microsoft’s three-, five-, and seven-year audit retention options.
Business Premium alone does not provide seven-year audit log retention. Appropriate licenses must cover the users generating the audit records, and retention policies must be configured.
For covered audit records, this option supports retention up to 10 years. Requirements beyond that call for a separately designed export and long-term storage solution. The policy cannot recover logs that have already expired, and Microsoft’s 10-year audit policy is not retroactive. See audit retention policies and Microsoft Purview auditing options.
Retention, Archiving, and Backup Serve Different Purposes
- Retention: Preserves covered records according to a policy.
- Archiving: Provides a place to store older email.
- Backup: Provides recovery capabilities after data loss or unwanted changes.
A business may need all three. When evaluating a backup service, verify its retention period, covered applications, recovery options, and handling of former employees’ data. Read our related guide: Cloud Storage Is Not Cloud Backup.
Does SOC 2 Require Seven-Year Retention?
SOC 2 does not impose one universal seven-year retention requirement on every business or every record. Your retention schedule should reflect applicable obligations, customer contracts, business needs, and the controls within the examination’s scope.
Office 365 E1, E3, and E5 vs Microsoft 365 E3, E5, and E7
The full product name matters. Office 365 E3 and Microsoft 365 E3 are different subscriptions. Office 365 E5 and Microsoft 365 E5 are also different. Do not approve a quote that says only “E3” or “E5” without identifying the product family and cloud environment.
Office 365 enterprise plans focus on productivity and cloud services. Microsoft 365 enterprise plans combine productivity with broader Windows, identity, device management, and security capabilities.
| Plan | Main focus | Example to evaluate |
|---|---|---|
| Office 365 E1 | Business email, web and mobile apps, and collaboration services; desktop Office licensing is not included | Employees working mainly in a browser, with devices secured through other tools |
| Office 365 E3 | Desktop Office apps plus expanded email, retention, and compliance capabilities | An organization needing desktop applications and core information governance |
| Office 365 E5 | Office 365 E3 capabilities plus advanced email protection, compliance, and analytics features | An organization requiring stronger email investigations and data controls |
| Microsoft 365 E3 | Office productivity plus Windows Enterprise rights, Intune, and Entra ID P1 capabilities | A business wanting centralized device management and access policies |
| Microsoft 365 E5 | Broader advanced identity, endpoint security, and compliance capabilities than Microsoft 365 E3 | An organization with complex security monitoring and investigation needs |
| Microsoft 365 E7 | Microsoft 365 E5 plus Microsoft Copilot, Microsoft Entra Suite, and Microsoft Agent 365 | An organization deploying AI assistants and agents with centralized governance |
Compare Microsoft’s Office 365 enterprise plans and Microsoft 365 enterprise plans before buying.
Example: A 400-person company needs desktop Office, managed laptops, and Conditional Access. Office 365 E3 alone does not provide the same Intune and Entra ID P1 bundle as Microsoft 365 E3. It should evaluate Microsoft 365 E3 or separately licensed management and security products.
Enterprise plans can also make sense for smaller organizations when specific features are required. Windows Enterprise subscription rights have qualifying operating system requirements; they should not be treated as a replacement for a computer’s required underlying Windows license.
What Is Microsoft 365 E7?
Microsoft 365 E7, called the Frontier Suite, adds paid Copilot and broader identity and agent governance to E5. Agent 365 helps organizations oversee AI agents. E7 is not required merely to use AI, and E5 by itself does not automatically include the paid productivity Copilot license.
Example: An organization deploying multiple AI agents needs to evaluate their permissions, ownership, monitoring, and lifecycle. E7 may be worth comparing with E5 plus selected add-ons. See Microsoft’s E3, E5, and E7 comparison.
Copilot: Free Chat vs Paid Business AI
The Copilot name appears on several products. A Copilot icon does not establish that an employee has the full paid business experience.
| Option | What it means | Example |
|---|---|---|
| Consumer Microsoft Copilot | A personal AI experience; it should not be assumed to have your organization’s work-account protections | General brainstorming with public information |
| Copilot Chat with an eligible work subscription | Included chat at no additional license cost, with enterprise data protection when signed in appropriately | Drafting generic communications or researching public topics |
| Paid Microsoft Copilot / Microsoft 365 Copilot | Additional work-data grounding and supported application experiences, subject to permissions and service availability | Finding relevant work information and assisting within supported Office applications |
| Microsoft Copilot Business | A paid option for eligible small-business subscriptions | A small business evaluating Copilot for selected employees |
Microsoft distinguishes included web-based chat from paid work-based chat. Eligible Basic, Standard, Premium, and Office 365 enterprise subscriptions can qualify for Copilot add-ons. E7 includes the paid Copilot entitlement. See Microsoft’s Copilot licensing guidance.
Included chat is not a promise of unlimited agents or every Office AI feature. Some agents incur consumption charges. IT should configure access and billing before deployment. See Microsoft’s agent billing guidance.
Example: An employee wants help rewriting a generic announcement. Included work-account chat may be sufficient. An executive wants assistance finding information across work content they are permitted to access. Evaluate paid Copilot and its specific capabilities.
Enterprise data protection applies to appropriately signed-in work use. Microsoft states that covered prompts and responses are not used to train foundation models. Before enabling work-data access, review sharing permissions and sensitive information policies. Copilot is not a substitute for correcting excessive access. Read the Copilot Chat FAQ.
Microsoft 365 With Teams or Without Teams
Microsoft offers commercial business and enterprise options with and without Teams. Confirm the exact SKU, purchasing channel, and regional availability.
- With Teams: Appropriate when staff need licensed Teams chat, meetings, and collaboration.
- Without Teams: May fit organizations that use another collaboration platform or license Teams separately.
Example: A company using Zoom for meetings and another platform for internal messaging should compare the no-Teams option. A company relying on Teams for daily collaboration should verify that its selected subscription includes Teams or add the appropriate standalone license.
Teams collaboration is not automatically a complete business telephone service. Public telephone calling can require Teams Phone rights and a connectivity arrangement such as a Calling Plan, Operator Connect, or Direct Routing. Features depend on the subscription and cloud. Copilot’s Teams features also require the applicable Teams entitlement.
Review the current business plan options and enterprise plan options.
Microsoft 365 for Nonprofits: Grants and Discounts
Eligible nonprofits can apply for Microsoft grants and discounted subscriptions. Nonprofit status does not automatically activate these offers; Microsoft must validate eligibility.
As reviewed in October 2026, Microsoft’s US nonprofit page lists a Business Basic grant for up to 300 users, with discounted Business Standard and Business Premium staff plans. Larger nonprofits can evaluate enterprise offerings. Check current nonprofit offers rather than relying on an old price sheet.
Example: A nonprofit’s office staff need desktop applications and managed laptops. A free Basic grant may cover some productivity needs, but discounted Premium should be evaluated for employees needing its desktop applications and security bundle.
Licenses must also match the person’s role. Microsoft’s grant rules generally cover paid employees and unpaid executive staff. Discounted offers have broader permitted staff and volunteer use; donors, beneficiaries, and members should not automatically receive staff licenses. Review Microsoft’s nonprofit eligibility and permitted-user rules.
Donor records, payment information, and beneficiary data deserve appropriate protection. A grant reduces software cost; it does not configure security, implement retention, or supply managed IT support.
Government Licensing: Commercial, GCC, GCC High, and DoD
The license tier and the cloud environment are separate decisions. Buying commercial Microsoft 365 E5 or E7 does not turn a commercial tenant into GCC High.
| Environment | Who should evaluate it? | Main consideration |
|---|---|---|
| Commercial | Businesses and organizations whose requirements permit commercial services | Match available controls and service commitments to the data and contract |
| GCC | Eligible government organizations and qualifying contractors | Government-specific service commitments and eligibility validation |
| GCC High | Eligible organizations with specialized controlled-data or export-control needs, including certain defense contractors | Separate cloud environment with stricter access commitments and feature differences |
| DoD | Department of Defense entities | DoD-specific environment; not the ordinary contractor purchasing option |
Government plans may use G1, G3, or G5 naming, while quotes can also identify GCC High variants and component subscriptions. Require the full product name and cloud designation. Microsoft validates eligible government and qualifying nongovernment organizations. See Microsoft 365 Government purchasing and eligibility guidance.
Why GCC High Matters for Defense Contractors
Microsoft offers GCC High for eligible customers with requirements involving DoD Controlled Unclassified Information (CUI) or International Traffic in Arms Regulations (ITAR). Its cloud architecture and personnel access commitments differ from commercial Microsoft 365.
Example: A Texas manufacturer receives export-controlled defense drawings. Before storing those drawings in email, SharePoint, or Teams, it should evaluate the contractual and data-handling obligations, its compliance boundary, and whether GCC High meets the required cloud commitments.
GCC High does not automatically make a contractor CMMC compliant. Likewise, a CMMC requirement should not be reduced to a universal instruction that every contractor buy GCC High. The decision must follow the specific data, contract, and required controls. Implementation, employee practices, evidence, and assessment obligations still matter.
GCC High Is a Migration and Operating Decision
GCC High is not an ordinary add-on applied to an existing commercial tenant. Plan eligibility validation, provisioning, identity and data migration, and the effect on integrations and collaboration. Microsoft documents differences in features, sharing, support handling, and Teams telephony. See the GCC High and DoD service description.
Verify backup, archiving, cybersecurity tools, Teams calling, and Copilot availability for the exact government environment. Commercial feature announcements do not establish government-cloud availability. Check the current government Copilot licensing guidance and confirm actual feature rollout before purchasing.
Get Help Choosing and Securing Microsoft 365
Business Communication Solutions helps businesses evaluate Microsoft 365 licensing, configure security controls, and manage their IT environments. We consider how employees work, what information you handle, and what your customers require.
Learn more about our managed IT support and cybersecurity solutions.
Austin: 512-257-1433
Houston: 281-815-8784
Microsoft licensing and features can change. Confirm current product terms and your required controls before purchasing or implementing a solution.