M365 Roundup, November 2021: Defender for Business Rides Free with Premium

November 2021 is a licensing month. Almost everything that matters to MSPs in this batch changes what you sell or what you pay: NCE promos got a new date, Business Voice got a retirement date, Business Premium got an endpoint security suite for free, and Microsoft announced the beginning of the end for DAP. Here is the full set of MSP-relevant announcements.

Licensing and billing: three changes to your line cards#

NCE promotional pricing moves to January 2022 (billing impact)#

Microsoft will launch introductory promotional pricing for CSP seat-based offers, giving customers more time to transition to new commerce. Originally scheduled for October 14, 2021, general availability of this release, when introductory promotional pricing becomes available for commercial seat-based offers in new commerce, has moved to January 2022. The delay ensures partners can use the tooling, both in Partner Center and via API, to migrate existing CSP customer subscriptions easily and efficiently, which matters most for indirect providers and downstream indirect resellers holding thousands of subscriptions.

Two time-bound promotions begin in January 2022 to accelerate adoption:

• The annual term promo gives a 5% discount off the CSP price list amount.
• The monthly term promo applies the regular annual term price instead of the usual 20% higher price point.

For more on New Commerce, see the NCE breakdown. The Microsoft announcement is here (opens in new tab).

Teams Phone with Calling Plan replaces Business Voice (licensing impact)#

• The Teams Phone SMB bundle (Microsoft 365 Business Voice) and the Enterprise bundle (Teams Calling Essentials) are consolidating into a new offering named Teams Phone with Calling Plan.
• Available for purchase starting January 1, 2022.
• Business Voice is phased out on February 28, 2022, though existing subscriptions can renew until June 30, 2022.

This affects only new customers. Existing Business Voice customers take no action: they continue on Business Voice until their subscription expires, at which point renewal directs them to the new Teams Phone with Calling Plan bundle, or they renew Business Voice until June 30, 2022.

Full announcement here (opens in new tab).

Defender for Business joins Business Premium at no extra cost (licensing impact)#

Microsoft is forking the Defender for Endpoint offering into two plans. Defender for Endpoint has traditionally been an enterprise-grade product living in higher-tier plans like E5, though in recent years it became a standalone offering that could bolt onto other plans more cost-effectively. In the fork, Plan 1 is the lightweight version, covering components like next-gen protection and attack surface reduction.

The bigger news: a Microsoft Defender for Business offering will be included at no additional cost in Microsoft 365 Business Premium ($20/user/month). For a SKU already heavy with security features, that is a serious addition.

For more information, see the Defender for Business breakdown.

Rollout: early 2022.

Partner security: P2 for free and the GDAP reveal#

Azure AD Premium P2 free for 24 months (security enhancement)#

Microsoft announced a free 24-month subscription to Azure AD Premium Plan 2 for partners in the CSP program with DAP to customer tenants. MSPs can use it to strengthen their own security controls with premium features like Azure AD Privileged Identity Management (PIM) and risk-based Conditional Access, plus longer sign-in log retention, at no extra charge.

• Free subscription covers up to 25 users
• Available until October 2022
• If you purchase CSP through a distributor, the trial does not come from the distributor; claim it directly from Microsoft here (opens in new tab)

GDAP announced: least privilege comes to delegated admin (security enhancement)#

Microsoft announced granular delegated admin privileges, or GDAP, coming early 2022, a direct response to supply chain attacks like Nobelium. Traditionally, both distributors (Microsoft Indirect Providers, CSP Tier 1s) and MSPs (Indirect Resellers) have established Delegated Admin Privileges (DAP) with all downstream customers, letting distributors license tenants and provide support, and letting you support and manage customers day to day through Partner Center.

The security concern is that DAP grants the keys to the kingdom, Global Admin access, to all downstream customers. If you are compromised, or your distributor is, all of your customers might be compromised as well. GDAP addresses this with a least-privilege model for access controls.

The full write-up is here: https://tminus365.com/granular-delegated-admin-privileges/

Teams and Defender for Office 365 features#

Per-organizer control of anonymous meeting join (feature enhancement)#

A new policy gives administrators more granular control by letting them allow specific users, or groups of users, to admit anonymous users into meetings they organize.

The new per-organizer policy is controlled with the -AllowAnonymousUsersToJoinMeeting parameter in Set-CsTeamsMeetingPolicy, which ships with Teams PowerShell version 2.6.0 and later.

To ease the transition from the old tenant-wide setting, the rollout has two phases:

• Phase 1: the new policy rolls out and can be set by administrators. The old tenant-wide setting still exists and can be changed, so administrators need to understand how the tenant-wide setting and the per-organizer policy interact.
• Phase 2: the old tenant-wide setting retires, and the per-organizer policy fully controls anonymous join.

Rollout: mid-November 2021, expected complete late November 2021.

Built-In Protection arrives in Defender for Office 365 (security enhancement)#

Applicable only if you have a Defender for Office 365 subscription (included in Business Premium).

Built-In Protection is a third preset security policy, alongside the Standard and Strict presets, enabled by default for all new and existing customers. It implements a version of Safe Links and Safe Attachments with low end-user impact: URL links are not wrapped, but delivery-time file and URL detonation plus time-of-click protection are in force.

Built-In Protection does not affect users who already have a Safe Links or Safe Attachments policy. Users covered by the Standard or Strict presets, or by an explicit custom policy, are untouched because the new preset has the lowest priority. Policies apply in this order of precedence:

1. Strict
2. Standard
3. Custom
4. Built-In Protection or default

Rollout: mid-December 2021, complete by late January 2022.