How Much Copilot Data Protection Does Business Premium Buy? More Than You Think
TL;DR
- Mapped against the CIS Controls, Microsoft 365 Business Premium checks the same number of Copilot-relevant data protection and access control boxes as Microsoft 365 E3.
- Automatic data classification, the E5 feature that discovers and tags sensitive information like PII and credit card numbers across the organization, is out of reach for most SMBs.
- Entra ID P2 and EMS E5 can be bolted onto Business Standard or Business Premium for less than the cost of moving to E5, covering every access control gap but little extra data protection.
- The E5 Information Protection and Governance add-on costs $7 per user per month, requires no Enterprise base license, and covers most Copilot data protection needs on top of Business Premium.
- E3 plus the E5 Compliance add-on comes out $9 per user per month cheaper than moving to full E5.
Copilot respects permissions, which means it inherits permission problems. The practical question for anyone planning a rollout is what native tooling their license tier actually provides to govern the data Copilot can reach. We covered the underlying risks and the process work to do before onboarding Copilot at scale in a previous article. This one is about the licensing: a feature matrix of the security and compliance capabilities relevant to Copilot across the Business and Enterprise plans, the add-ons that bridge the gap, and where the money math lands as of February 2024.
Business Premium holds its own against E3
The matrix buckets features into Data Protection and Access Controls, following the CIS Controls. Business Premium checks a decent number of boxes in both categories, and notably, it checks the same number as Microsoft 365 E3. Keep the lens in mind: this matrix only evaluates features through the frame of protecting data as it relates to Copilot. E3 carries plenty of other capabilities that are not highlighted here.
For the complete plan-by-plan breakdowns, Microsoft's comparison documents are worth keeping on hand:
- Modern Work Plan Comparison, SMB (opens in new tab)
- Modern Work Plan Comparison, Enterprise (opens in new tab)
- Microsoft 365 compliance licensing comparison (opens in new tab)
What does E5 have that everyone actually wants?
Data classification. It is one of the most important features in the entire matrix: the ability to automatically discover and tag data across your whole organization based on common sensitive information types such as PII and credit card numbers, plus your own custom definitions. Trainable classifiers can be pointed at SharePoint repositories to discover new categories of information worth protecting.
The catch is the price of admission. E5-grade classification is going to be out of reach for most of the SMB market, which is why we expect most businesses to turn to a third-party solution as part of an ongoing data protection strategy rather than buying up.
Can add-ons bridge the gap without going Enterprise?
Partially. Entra ID P2 and EMS E5 can both be bolted onto Business Standard and Business Premium, and combined they still cost less than moving to E5. That combination checks every box in the Access Control section. On the data protection side, though, the additional capability is limited: auto-labeling, which arrives with EMS E5, is the highlight.
The $7 add-on that changes the math
There is an E5 Information Protection and Governance add-on that does not require an Enterprise license prerequisite. It is only a subset of E5 Compliance, but it checks a large share of the data protection boxes and costs an additional $7 per user per month on top of Business Premium.
Two more figures worth knowing if Enterprise plans are on the table:
- E5 Compliance requires at least an E3 base plan.
- E3 plus E5 Compliance combined is $9 per user per month cheaper than moving to full E5.
Watch the features in action
A demo walkthrough of these security and compliance features is available on YouTube (opens in new tab).
Feature documentation, all in one place
The Microsoft references behind every row in the matrix:
- Securing data in an AI-first world with Microsoft Purview (opens in new tab)
- Manage sharing settings for SharePoint and OneDrive in Microsoft 365 (opens in new tab)
- Sharing and permissions in the SharePoint modern experience (opens in new tab)
- Get started with trainable classifiers (opens in new tab)
- Learn about data loss prevention (opens in new tab)
- Data loss prevention and Microsoft Teams (opens in new tab)
- Learn about Endpoint data loss prevention (opens in new tab)
- Prevent data leak through web apps with Microsoft Purview Data Loss Prevention (opens in new tab)
- eDiscovery Standard vs Premium: Microsoft Purview eDiscovery solutions (opens in new tab)
- The Next Era of eDiscovery: Embracing Advanced Capabilities for a Comprehensive Digital Landscape (opens in new tab)
- Search for and delete Microsoft Copilot for Microsoft 365 data (opens in new tab)
- Entra ID Governance plans: Microsoft Entra ID Governance licensing fundamentals (opens in new tab)
- Microsoft unveils expansion of AI for security and security for AI at Microsoft Ignite (opens in new tab)
- Learn about retention for Microsoft Copilot for Microsoft 365 (opens in new tab)
- Security for AI: Discover, protect, and prepare in the AI era (opens in new tab)
- What are lifecycle workflows? (opens in new tab)
- What are access reviews? (opens in new tab)
Frequently asked questions
Does Business Premium include enough protection to deploy Copilot?
It covers a solid baseline of data protection and access controls, matching E3 in the Copilot-relevant categories. What it lacks is automatic data classification and auto-labeling, which means discovering and tagging sensitive content stays a manual exercise.
What is the cheapest path to E5-grade data protection on a Business plan?
As of February 2024, the E5 Information Protection and Governance add-on at $7 per user per month bolts onto Business Premium without an Enterprise prerequisite and covers most of the data protection feature set, though not all of E5 Compliance.
Does the E5 Compliance add-on work with Business Premium?
No. E5 Compliance requires at least an E3 base plan. Business plans should look at the E5 Information Protection and Governance add-on instead.
Find the oversharing before Copilot does
Copilot surfaces whatever your users can already touch. CloudCapsule scans 250+ controls per tenant in about 60 seconds, flagging the sharing settings and access gaps that matter before an AI rollout.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
