The baseline we put in place
Every user and every administrator signs in with multi-factor authentication. The number of global administrators is small, and each one is a named person rather than a shared mailbox. A conditional access policy requires that second factor and blocks legacy sign-in that skips it. Mail rules that forward to an outside domain are reviewed, because that is a common way a compromised mailbox leaks. SharePoint and OneDrive sharing is set to the choice you make: named people, or anyone with the link. We write the choice down.
Business Premium is usually the license that includes this baseline without a second security subscription. If you are on Business Standard, we will say so after we see the tenant, and we will quote the step up only if you want those features. We do not publish that price here. The amount depends on the term and on any nonprofit offer Microsoft has approved.
What this engagement is not
We do not sell a 24-hour security operations center on this page, and we do not claim an incident-response retainer with a clock on it. If a mailbox is compromised, email support@true.org and we will help contain it: reset the sign-in, review the inbox rules, and check forwarding. That is business-day email support, with a typical reply of one business day, for organizations in the United States and Canada. If you need a retainer with a defined response window, say that in the form. We will tell you whether we can take it.
We also do not stack extra Defender plans for their own sake. Business Premium already includes Microsoft's Defender protections for these business plans. Some tenants later add a stricter attachment policy, device policies for a shared workstation, or an Entra ID level above the business SKU. We add those only when the baseline is already in place and a specific gap remains. The quote names the gap.
How it fits the rest of the tenant
Security work is easier when we already hold the licenses, because a plan change and a policy change are the same conversation. If another partner bills the tenant, we can still configure the policies once a global admin invites us. We cannot change a subscription we do not hold. New tenants get this baseline as part of setup, not as a later project we hope someone remembers.
Nonprofit pricing, when it applies, can change which of these SKUs are discounted. We check the current offer. We do not assume a security add-on is donated. Copilot, if you are adding it, makes the sharing review more important, because Copilot uses files the person can already open. We will say if that review should happen in the same engagement.
Questions we answer before a quote
Is Business Premium required?
Not if you already have the features through an Enterprise plan. For a small tenant on Business Standard, Premium is the usual way to get conditional access and the included Defender protections. We confirm from the tenant, then quote.
Can you force multi-factor authentication for everyone?
Yes. That is part of the baseline, including administrators. We plan it so people are not locked out of mail on a Monday morning without a warning and a second admin who can help.
Do you monitor the tenant overnight?
No. This is email support at support@true.org. If you need a staffed response window, tell us in the form and we will be plain about whether that is work we can take.
Will you review mail forwarding rules?
Yes. Rules that send mail outside the organization are on the list, along with the count of global admins and the sharing setting on SharePoint and OneDrive.