What Am I Actually Paying For in Microsoft 365?

I've looked at hundreds of Microsoft 365 environments over the years. I'd say the average business is using about 20% of what they're paying for. Sometimes less.

It's not because they don't care. It's because Microsoft is genuinely terrible at telling you what you've got.

You signed up for Business Premium or E3, got your Outlook and Teams working, and moved on. Fair enough — you had a business to run. But sitting behind that login is a stack of tools you're already paying for that nobody's switched on.

The usual suspects

Here's what we see sitting untouched in most environments:

Conditional Access — the ability to control who signs in, from where, on what device. You can block sign-ins from countries you don't operate in, force MFA for admin accounts, and stop people accessing company data from their kids' iPad. It's included in Business Premium and above. Most businesses have never touched it.

Intune — full device management. Enforce encryption on every laptop, push security policies to phones, remotely wipe a lost device. If your team works from home or uses their own devices, this is essential. Again, already included.

Sensitivity labels and DLP — you can classify documents as confidential and stop people emailing them externally. Set up policies that prevent sensitive data from leaving the organisation. Useful if you deal with client data, financial information, or anything covered by the Privacy Act.

Safe Links and Safe Attachments — advanced email protection that scans every link and file before it reaches your inbox. Not just basic spam filtering — proper threat protection. Included in Business Premium and E5, but most businesses are running on Microsoft's default settings.

Power Automate — workflow automation using standard connectors. Simple things like "when a form is submitted, create a task and notify the team." Included in every M365 plan.

Why does this happen?

Three reasons, usually:

1. Nobody told you. Microsoft's licensing pages are a maze. Unless you've got someone who stays across this stuff, features slip through.

2. Your IT setup was "get email and Teams working" and stopped there. The basics got done, the rest didn't.

3. Configuration takes expertise. Having Intune available and actually configuring Intune properly are two very different things.

What to do about it

We built a free tool that lets you pick your M365 plan and see everything that's included — then check off what you're actually using. Takes about five minutes and gives you a clear picture of the gap.

Try the Microsoft 365 Features Calculator

Or if you'd rather someone just looked at your tenant and told you straight, we do that too. Takes about 30 minutes and it's free. We'll show you your Microsoft Secure Score, what's switched on, what isn't, and what to prioritise.