Microsoft 365 Security in Dubai: What Each Plan Includes and What to Switch On First

If you run a business in Dubai or anywhere in the UAE on Microsoft 365, the real question about Microsoft 365 security is rarely "which product should we buy". It is "what does our current plan already include, and what should we switch on first". This guide answers both: a plan-by-plan table for Microsoft 365 Business Premium, E3 and E5, taken from Microsoft's own licensing documentation, followed by the order we recommend UAE businesses turn the controls on, and how to measure progress with Microsoft Secure Score.

The short answer

Most of the protection a typical UAE business needs is already inside Microsoft 365 Business Premium or Microsoft 365 E3: Conditional Access through Microsoft Entra ID P1, Microsoft Intune for devices, Microsoft Defender for Office 365 Plan 1 for email, endpoint protection, and Microsoft Purview data loss prevention (DLP) for email and files. Microsoft 365 E5 adds the deeper layer: Defender for Office 365 Plan 2, Defender for Endpoint Plan 2, Entra ID P2 for risk-based access, automatic sensitivity labelling and Microsoft Defender for Cloud Apps. The order matters more than the plan: identity first, then email, then devices, then endpoints, then data, then cloud apps.

What each Microsoft 365 plan includes for security

Microsoft 365 Business Premium is designed for small and medium-sized businesses of up to 300 users; Microsoft 365 E3 and E5 are the enterprise plans. The table below covers the security capabilities this guide discusses. It is based on Microsoft's service descriptions and licensing pages as published on Microsoft Learn; licensing changes, so confirm the current terms for your own agreement before you buy.

Two notes on the table. First, Microsoft's licensing pages now also list a Microsoft 365 E7 bundle alongside E3 and E5; this guide sticks to the three plans most UAE businesses compare. Second, the E3 change to Defender for Office 365 is recent: Microsoft states that from 1 July 2026, Defender for Office 365 Plan 1 is included with Microsoft 365 E3, and that it does not include Plan 2 capabilities. If your E3 tenant was set up before then, Safe Links and Safe Attachments may never have been configured. If you are unsure which licences you hold or whether you are paying for features you do not use, our Microsoft 365 licensing team can map that for you, and our guide to Entra ID P1 vs P2 covers the identity tiers in detail.

The order to switch Microsoft 365 security on

Licences do nothing until they are configured. This is the sequence we use with UAE clients, starting with the controls that close the most common attack paths and ending with the ones that need the most tuning.

1. Identity: MFA and Conditional Access in Microsoft Entra ID

Microsoft's own top 10 list for securing a Microsoft 365 business tenant puts multifactor authentication first. Microsoft also states that, based on its learnings, more than 99.9% of common identity-related attacks are stopped by using multifactor authentication and blocking legacy authentication.

• No Entra ID P1 or P2: use security defaults, which Microsoft makes available to all customers and which require every user to register for MFA and block legacy authentication protocols.
• Business Premium, E3 or E5: Microsoft says security defaults are probably not right for organisations with Entra ID P1 or P2 licences. Use Conditional Access instead, which works as if-then rules: if a user wants to reach Microsoft 365, then they must complete MFA.
• Test before you enforce: Microsoft recommends enabling new policies in report-only mode first, so you can see their effect on real sign-ins in the sign-in logs before anyone is locked out.
• E5 only: risk-based policies (sign-in risk and user risk) need Microsoft Entra ID Protection, which is an Entra ID P2 feature.

Our Conditional Access service designs, tests and rolls out these policies without disrupting staff who travel or work from home.

2. Email: Microsoft Defender for Office 365 email security

Every Microsoft 365 plan includes anti-spam, anti-malware and anti-phishing protection for cloud mailboxes. Defender for Office 365 Plan 1, included in Business Premium and now in E3, adds protection against advanced and zero-day phishing and malware, including Safe Links, Safe Attachments and real-time detections, plus user and domain impersonation protection. Plan 2, included in E5, adds threat hunting, automation and investigation tools for security teams.

The fastest safe starting point is Microsoft's preset security policies, which Microsoft lists as step three in its top 10 for business tenants. For organisations that are a frequent target of supplier and executive impersonation, impersonation protection is the setting to check first. See our Defender for Office 365 service in Dubai for how we configure and tune it.

3. Devices: Microsoft Intune implementation, compliance and mobile security

Intune Plan 1, included in Business Premium, provides mobile device management (MDM) and mobile app management (MAM), and Intune is also part of Microsoft 365 E3 and E5. Two Intune controls do most of the work:

• Compliance policies: sets of rules and conditions that a managed device must meet. When the compliance result is fed into Conditional Access, only compliant devices can reach company data. One setting is easy to miss: by default Intune treats devices with no compliance policy assigned as compliant, and Microsoft advises changing it to Not compliant if you use Conditional Access with compliance.
• App protection policies for mobile security: these protect company data in Microsoft 365 apps on phones without requiring device enrolment, for example by preventing staff from copying and pasting company data into personal apps. This suits teams where staff read work email on their own phones.

Our Intune compliance policies and Intune app protection policies services cover each of these, and the Microsoft Intune page covers full implementation.

4. Endpoints: Defender for Business, Defender for Endpoint and vulnerability management

Business Premium includes Microsoft Defender for Business, which Microsoft describes as including the features of Defender for Endpoint Plan 1, some features from Plan 2, and some features unique to small and medium businesses. E3 includes Defender for Endpoint Plan 1, which covers next-generation anti-malware, attack surface reduction rules, device control, endpoint firewall, network protection and application control. E5 includes Defender for Endpoint Plan 2.

If your search was for Microsoft Defender vulnerability management, the licensing differs again: Defender for Endpoint Plan 2 includes the core Defender Vulnerability Management capabilities, the premium capabilities need a Defender Vulnerability Management add-on, and a standalone version is available for Defender for Endpoint Plan 1 and Microsoft 365 E3 customers. Protecting Windows and Linux servers with Defender for Business needs extra licences. See Defender for Endpoint in Dubai and Defender Vulnerability Management for how we deploy both.

5. Data: Microsoft Purview DLP and sensitivity labels

Purview DLP for Exchange Online, SharePoint and OneDrive is licensed in Business Premium, E3 and E5, and lets you identify, monitor and automatically protect sensitive information in email and files, including files in Teams. Manual sensitivity labels are available in all three plans; automatic labelling needs Microsoft 365 E5 or Microsoft 365 Information Protection and Governance (IPG).

Microsoft recommends implementing DLP policies in simulation mode first. Start with the information types that matter to your business, and agree a short label scheme (for example Public, Internal, Confidential) before asking staff to apply it. Our Microsoft Purview service covers classification, DLP and labelling.

6. Cloud apps: Microsoft Defender for Cloud Apps (formerly MCAS)

Microsoft Defender for Cloud Apps is the current name of Microsoft Cloud App Security, often shortened to MCAS. So an MCAS implementation today is a Defender for Cloud Apps implementation. It is included in Microsoft 365 E5 and is also sold as a standalone licence. It provides cloud access security broker (CASB) functions such as Shadow IT discovery, assesses discovered apps against more than 90 risk indicators, and surfaces misconfigurations in connected SaaS apps. Its Conditional Access App Control features also need Entra ID P1.

This is the last step, not the first, because it is most useful once identity and devices are under control. See Defender for Cloud Apps implementation in the UAE.

How to measure progress: Microsoft Secure Score

Microsoft Secure Score, in the Microsoft Defender portal, measures your security posture: a higher number means more of the recommended actions have been taken. Each recommended action is worth 10 points or less. Some score in full once done; others score partially, so if MFA protects 50 of your 100 users, you get five of the ten points. Where an action does not fit your business, you can record that you accept the risk. Defender for Cloud Apps also feeds SaaS security posture data into Secure Score for connected apps.

We use Secure Score as the shared measuring stick: take a baseline before step 1, then review it after each step. It turns "are we secure?" into a number you can track month by month.

Common mistakes we see in UAE tenants

• Buying E5 before using what Business Premium or E3 already includes. Most of the steps above work on the plan you have.
• Turning on Conditional Access without report-only testing, which locks out staff and leads to policies being switched off again.
• Leaving the Intune default of "compliant" for devices with no policy, which quietly undoes device-based Conditional Access.
• Assuming email protection is configured because the licence is there. Check which Defender for Office 365 policies actually apply to your users.

Our article on the Microsoft 365 security settings Dubai businesses leave open goes through the individual settings in more detail.

How GR IT Services helps with Microsoft 365 security in Dubai

GR IT Services is a Microsoft partner based in Business Bay, Dubai, with a Dubai-based security operations centre. We have delivered more than 50 Microsoft Sentinel tenants. A typical engagement starts with a Microsoft 365 security audit that maps your licences against what is actually configured, then works through the six steps above, and can continue as monitoring through Microsoft Sentinel. We respond to support requests within 10 minutes.

To get started, tell us about your tenant, call +971 54 130 0988 or email hello@gritservices.ae. We quote on request.

Frequently asked questions

Does Microsoft 365 Business Premium include Defender for Office 365?

Yes, Plan 1. Plan 2 is included in Microsoft 365 E5. From 1 July 2026, Plan 1 is also included in Microsoft 365 E3 and Office 365 E3.

Is MCAS the same as Microsoft Defender for Cloud Apps?

Yes. Microsoft Cloud App Security was renamed Microsoft Defender for Cloud Apps. It is included in Microsoft 365 E5 and is also available as a standalone licence.

Do we need Intune if staff use their own phones?

Intune app protection policies can protect company data in apps on personal phones without enrolling the device, so staff keep control of their own phone while company email and files stay protected.

Do we need Microsoft 365 E5 for good Microsoft 365 security in the UAE?

Not to start. Business Premium (up to 300 users) and E3 include Conditional Access, Intune, Defender for Office 365 Plan 1, endpoint protection and DLP. E5 makes sense when you need risk-based Conditional Access, Defender for Endpoint Plan 2, automatic labelling or Defender for Cloud Apps, and the team to act on what they find.