Most mid-market tenants already own more than they use
A mid-market company typically bought Microsoft 365 for email, Office apps and Teams, then kept paying for a password manager, a file-sharing service, a task tool and a device management product on the side. The plan it already licenses often covers several of those jobs. Microsoft describes Microsoft 365 Business Premium as a cloud productivity and security solution for small and medium-sized businesses of 1 to 300 users that includes everything in Microsoft 365 Business Standard plus Microsoft Defender for Business and Microsoft Defender for Office 365 Plan 1 (Microsoft Learn, Microsoft 365 Business Premium frequently asked questions, accessed 2026-10-20). Above that size, EPC Group typically finds Microsoft 365 E3. EPC Group's Microsoft 365 consulting practice starts every mid-market engagement the same way: list the business problems, list the capabilities the current plan already includes, match the two, and switch them on in an order that does not break anyone's Monday.
What Business Premium and E3 already include
Microsoft lists the Business Premium components plainly: Microsoft 365 Apps on devices, account protection with Microsoft Entra ID P1, endpoint management, security and mobile application management with Microsoft Intune Plan 1, device protection with Microsoft Defender for Business, email and file protection with Microsoft Defender for Office 365 Plan 1, and Microsoft Purview Information Protection and data loss prevention for email and files (Microsoft Learn, Add Microsoft Defender Suite for Business Premium to your subscription, accessed 2026-10-20). Business Premium subscribers are licensed for full Intune capabilities for iOS, Android, Mac and other cross-platform device management (Microsoft Learn, Microsoft 365 Business Premium security - frequently asked questions, accessed 2026-10-20).
For enterprise plans, Microsoft includes Microsoft Entra ID P1 in Microsoft 365 E3 and E5, and Microsoft Entra ID P2 in Microsoft 365 E5 (Microsoft Learn, Microsoft Entra licensing, accessed 2026-10-20). Defender for Endpoint Plan 1 is available standalone or as part of Microsoft 365 E3 (Microsoft Learn, Overview of Microsoft Defender for Endpoint Plan 1, accessed 2026-10-20). In EPC Group assessments of mid-market tenants on either plan, the same four capabilities are most often licensed but unconfigured: Conditional Access, device enrollment in Intune, sensitivity labels, and data loss prevention policies. Each one maps to a business problem the company is often paying a separate vendor to solve.
Security: what is included and what is an add-on
The line between included and add-on is documented. All Microsoft 365 for business subscriptions include Microsoft Entra ID Free with security defaults, which are on by default and enable multifactor authentication. Business Premium adds Microsoft Entra ID P1 with Conditional Access, Defender for Office 365 Plan 1, Intune Plan 1 and Defender for Business; Microsoft Defender Suite for Business Premium, which brings Microsoft Entra ID P2, Defender for Office 365 Plan 2 and Defender for Endpoint Plan 2, is purchased separately (Microsoft Learn, Microsoft 365 for business security overview, accessed 2026-10-20). On the enterprise side, Microsoft summarizes Microsoft 365 E3 as foundational identity with Microsoft Entra ID P1, basic threat protection and core Microsoft Purview capabilities, and Microsoft 365 E5 as adding Microsoft Entra ID P2, full Microsoft Defender XDR and advanced Purview capabilities, with Microsoft Copilot available as an add-on to both (Microsoft Learn, Compare Microsoft Copilot in Microsoft 365 E3, E5, and E7, accessed 2026-10-20).
EPC Group's rule is to exhaust what is included before recommending an add-on. A tenant on Business Premium that still relies on security defaults, has no Conditional Access policy and no enrolled devices is not ready for Defender Suite; it is ready for the configuration it has already paid for.
Replacing scattered tools with Teams, SharePoint and Planner
The collaboration side of the plan is where scattered tools pile up: a consumer file-sharing service for external partners, shared spreadsheets as project trackers, and a separate task application per department. Microsoft 365 already connects the pieces. Planner is powered by Microsoft Graph and the Microsoft 365 group service; files attached to Planner tasks are stored in SharePoint, Planner comments are based on Outlook group conversations, and plans and tasks can be viewed and updated from SharePoint and Microsoft Teams (Microsoft Learn, Planner tasks and plans API overview, accessed 2026-10-20). Inside Teams, the Planner app brings together Microsoft To Do, Planner and Project for the web, and gives each user My Day, My Tasks, including tasks assigned from Teams meeting notes and flagged Outlook email, and My Plans (Microsoft Learn, Manage the Planner app for your organization in Microsoft Teams, accessed 2026-10-20).
EPC Group replaces tools team by team rather than all at once. Each team gets one Microsoft Teams team, the SharePoint site behind it for its documents, and one plan for its work, with external sharing configured so that partners stop receiving consumer links. The retirement of each replaced tool is a dated milestone in the plan, because the value only appears when the old subscription is actually canceled.
Measuring adoption
Switching a feature on is not the same as people using it. Adoption Score, under Reports in the Microsoft 365 admin center, scores People experiences categories, communication, meetings, content collaboration, teamwork and mobility, plus AI adoption where Copilot licenses are enabled, at 100 points each. It shows peer benchmarks against organizations of similar size, industry and license mix, offers 28-day and 180-day views of key activities, and updates daily from user actions in the last 28 days; all insights are calculated at the organizational level, not the individual level (Microsoft Learn, Microsoft Adoption Score, accessed 2026-10-20). The usage reports add per-service detail, such as mailbox storage by user, and can be exported to Excel or Power BI (Microsoft Learn, Microsoft 365 admin center usage reports overview, accessed 2026-10-20). EPC Group records both before any change, so that the 90-day review compares against a real baseline.
A 90-day plan to switch it on
EPC Group runs the sequence in three blocks. Days 1 to 30 are identity: Conditional Access policies where Microsoft Entra ID P1 is licensed, multifactor authentication for every account, and a cleanup of standing admin roles. Days 31 to 60 are devices and data: Intune enrollment for company and personal devices, Defender onboarding, sensitivity labels and DLP policies for the content that matters. Days 61 to 90 are collaboration and adoption: Teams and SharePoint structure, Planner in place of side tools, and a champions network. The adoption work follows the areas Microsoft sets out for end-user adoption: stakeholders, scenarios, awareness, training, and planning and managing change (Microsoft Learn, Microsoft 365 End User Adoption Guide, accessed 2026-10-20). EPC Group's adoption and change management team runs that third block, and the plan ends with an Adoption Score review against the day-one baseline.
Documented work
ANON-CASES: EPC Group engagement data for mid-market Microsoft 365 value programs covers mid-market organizations, including a construction company and professional services firms, activating Conditional Access, Intune, data loss prevention and Planner on plans they already licensed and retiring overlapping tools, delivered by the firm's Microsoft 365 consulting and managed Microsoft services practices. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.
Primary sources
- Microsoft 365 Business Premium frequently asked questions — Microsoft Learn, accessed 2026-10-20
- Add Microsoft Defender Suite for Business Premium to your subscription — Microsoft Learn, accessed 2026-10-20
- Microsoft 365 Business Premium security - frequently asked questions — Microsoft Learn, accessed 2026-10-20
- Microsoft 365 for business security overview — Microsoft Learn, accessed 2026-10-20
- Microsoft Entra licensing — Microsoft Learn, accessed 2026-10-20
- Overview of Microsoft Defender for Endpoint Plan 1 — Microsoft Learn, accessed 2026-10-20
- Compare Microsoft Copilot in Microsoft 365 E3, E5, and E7 — Microsoft Learn, accessed 2026-10-20
- Planner tasks and plans API overview — Microsoft Learn, accessed 2026-10-20
- Manage the Planner app for your organization in Microsoft Teams — Microsoft Learn, accessed 2026-10-20
- Microsoft Adoption Score — Microsoft Learn, accessed 2026-10-20
- Microsoft 365 admin center usage reports overview — Microsoft Learn, accessed 2026-10-20
- Microsoft 365 End User Adoption Guide — Microsoft Learn, accessed 2026-10-20
Frequently Asked Questions
What do Business Premium and E3 include that most companies never turn on?
Microsoft lists Microsoft Entra ID P1, Microsoft Intune Plan 1, Microsoft Defender for Business, Microsoft Defender for Office 365 Plan 1, and Microsoft Purview Information Protection with data loss prevention as part of Microsoft 365 Business Premium (Microsoft Learn, Add Microsoft Defender Suite for Business Premium to your subscription, accessed 2026-10-20). Microsoft 365 E3 includes Microsoft Entra ID P1 (Microsoft Learn, Microsoft Entra licensing, accessed 2026-10-20) and Defender for Endpoint Plan 1 (Microsoft Learn, Overview of Microsoft Defender for Endpoint Plan 1, accessed 2026-10-20). In EPC Group assessments, Conditional Access, device enrollment, sensitivity labels and DLP policies are the capabilities most often licensed but unconfigured.
Which security features are included versus add-ons (Microsoft, attributed)?
Every Microsoft 365 for business plan includes Microsoft Entra ID Free with security defaults; Business Premium adds Entra ID P1 with Conditional Access, Defender for Office 365 Plan 1, Intune Plan 1 and Defender for Business, while Microsoft Defender Suite for Business Premium, which brings Entra ID P2, Defender for Office 365 Plan 2 and Defender for Endpoint Plan 2, is purchased separately (Microsoft Learn, Microsoft 365 for business security overview, accessed 2026-10-20). Microsoft describes E3 as foundational identity with Entra ID P1, basic threat protection and core Microsoft Purview, and E5 as adding Entra ID P2 and full Microsoft Defender XDR (Microsoft Learn, Compare Microsoft Copilot in Microsoft 365 E3, E5, and E7, accessed 2026-10-20).
How do Teams, SharePoint and Planner replace scattered tools?
Planner is powered by Microsoft 365 groups: files attached to Planner tasks are stored in SharePoint, comments are based on Outlook group conversations, and plans can be viewed and updated from SharePoint and Microsoft Teams (Microsoft Learn, Planner tasks and plans API overview, accessed 2026-10-20). In Teams, the Planner app brings To Do, Planner and Project for the web together, and shows My Day, My Tasks and My Plans in one place (Microsoft Learn, Manage the Planner app for your organization in Microsoft Teams, accessed 2026-10-20). EPC Group replaces shared spreadsheets, consumer file-sharing and standalone task tools team by team, so that each team gets one Teams team, one SharePoint site and one plan.
How is adoption measured?
Adoption Score, under Reports in the Microsoft 365 admin center, scores People experiences categories such as communication, meetings, content collaboration, teamwork and mobility at 100 points each, shows peer benchmarks against similar organizations, and updates daily from the last 28 days of activity (Microsoft Learn, Microsoft Adoption Score, accessed 2026-10-20). All insights are calculated at the organizational level, not the individual level (same source). The usage reports add per-service detail such as mailbox storage and can be exported to Excel or Power BI (Microsoft Learn, Microsoft 365 admin center usage reports overview, accessed 2026-10-20). EPC Group sets a baseline before changes and reviews the trend monthly with the business sponsor.
What is a sensible 90-day plan?
EPC Group sequences the work in three 30-day blocks. Days 1 to 30 cover identity: Conditional Access policies where Microsoft Entra ID P1 is licensed, or security defaults where it is not, which Microsoft describes as enabling multifactor authentication by default (Microsoft Learn, Microsoft 365 for business security overview, accessed 2026-10-20), plus admin role cleanup. Days 31 to 60 cover devices and data: Intune enrollment, Defender onboarding, sensitivity labels and DLP. Days 61 to 90 cover collaboration: Teams and SharePoint structure, Planner and champions, following the stakeholders, scenarios, awareness and training steps in Microsoft guidance (Microsoft Learn, Microsoft 365 End User Adoption Guide, accessed 2026-10-20).
Talk to a senior architect
If your company pays for Microsoft 365 and for a stack of tools beside it, a 30-minute discovery call with a senior EPC Group architect maps your current plan to the problems it already solves and sets out the 90-day order. See the Microsoft 365 consulting service hub for engagement structures.
Email contact@epcgroup.net or call 888-381-9725.
a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.
Documented engagements
Each record publishes a redacted primary-source document — a client purchase order, executed agreement or payment record — with a SHA-256 hash you can recompute, and states what the document does not establish.
- Amador County Superior Court — Delivered — payment-corroborated (client payment records published)Case study: Amador Superior Court: Exchange Online Migration (2026)
- Amador County Superior Court — ContractedCase study: Amador Superior Court: Exchange 2019 Migration (2024)
- Tarleton State University — Contracted — countersignedCase study: Tarleton State: Office 365 Cross-Tenant Migration (2021)
- Office of the Texas State Chemist — Contracted — countersignedCase study: Texas State Chemist: Exchange 2019 Migration (2021)
- Prairie View A&M University — Contracted — public procurement recordCase study: Prairie View A&M: Gmail to Exchange Online Migration (2020)