Level 0 — Security hygiene
MFA through Security Defaults and built-in mail protection. The entry point from day one.
Solutions · Cybersecurity
From basic hygiene, through Microsoft 365 Business Premium, to Defender XDR, Purview, Sentinel, and Security Copilot.
Microsoft Security products let you raise the level of protection as the organisation grows.
Roadmap
The customer does not replace the base suite. They add to it.
MFA through Security Defaults and built-in mail protection. The entry point from day one.
Conditional Access, Intune, and Defender for Office 365. The first advanced layer.
Wider protection for identity, devices, mail, and data, without replacing the base suite.
Incident correlation, SIEM, and AI in advanced security operations.
Level 0
Level 0 starts with Microsoft 365 Business Basic and Business Standard. Every subscription uses Microsoft Entra ID Free and can use Security Defaults. It is the base. It is not yet full protection.
Built into Microsoft Entra ID Free and on by default in new tenants.
Built-in anti-spam, anti-malware, and anti-phishing for every mailbox.
Included with every Microsoft 365 Business Basic and Business Standard subscription.
Level 1
Business Premium moves past default settings and matches how the company actually works.
Access to company data depends on the device, its compliance, the location, and the user.
Advanced management of mobile devices, PCs, and applications.
Scanning of links and attachments, plus protection against phishing and impersonation.
Classification with sensitivity labels, and DLP in Exchange, SharePoint, and OneDrive.
Endpoint protection: EDR, threat detection, and automatic investigation and response.
Level 2 · Defender
An add-on that extends the existing security environment. The customer does not swap the base suite.
Risky users and sign-ins, and Conditional Access policies based on risk.
Detect and contain identity threats, including in on-premises Active Directory.
Advanced hunting, Live Response, and six months of data retention.
Automated investigation and response, and phishing attack simulations.
Shadow IT discovery, SaaS app risk scoring, and access and session control.
Level 2 · Purview
Data protection, information governance, and regulatory compliance. Find sensitive information and secure it.
Classify and protect sensitive data with sensitivity labels, encryption, and access limits.
Detect and block unauthorised sharing or transfer of confidential data.
Read risk signals around copying, downloading, and sharing data.
Manage formal records and protect them from modification.
Automate retention, archiving, and deletion against the organisation’s policies.
Advanced search and activity monitoring for audits and investigations.
Assess compliance and recommend what to do next.
More control over access to data and the encryption keys Microsoft uses.
See how AI tools, including Microsoft 365 Copilot, use the organisation’s data.
Level 3
This level is more than another license. The organisation builds a security operations centre as one system, not a pile of tools.
Correlate signals from endpoints, identity, mail, and cloud apps into one incident.
A cloud SIEM that collects and analyses data from many sources, not only Microsoft 365.
Summarise incidents and analyse suspicious scripts, in support of investigation and response.
We will shape the right adoption path for the end customer.