The most common finding when we audit a UAE Microsoft 365 tenant is not that the business bought the wrong tier. It is that they bought the right one and never enabled what they were paying for.
Why the gap exists
Business Basic has no desktop applications. Business Standard has them. Business Premium adds conditional access, device management, threat protection and information protection — and none of those are visible to a user. The difference between tiers is entirely security.
So a tenant set up by whoever was available on the day works perfectly. Mail arrives, documents open, nothing indicates that half the licence is dormant. It stays that way until an account is compromised or a laptop disappears.
The list, roughly in order of value
- Multi-factor authentication on every account — usually present for staff and exempted for the executives most worth targeting
- Conditional access: sign-in judged on location, device and risk rather than a password alone
- Alerting on mailbox forwarding rules, the first sign of a compromise in progress
- Device enrolment, so a lost laptop can be wiped remotely rather than merely regretted
- External-sender marking, so a lookalike domain is visible
- SPF, DKIM and DMARC on the domain, so it cannot be spoofed against your own staff
The licence audit that pays for itself
While you are in there, two things reliably turn up. Licences assigned to people who left, sometimes years ago. And a uniform tier bought for everybody where management and finance need Premium and frontline staff need considerably less.
Both are money, and neither requires changing anything anyone actually uses. A review before renewal rather than after is the difference between acting on it and waiting a year.
Data residency, if it applies to you
Microsoft 365 offers residency options that determine where tenant data sits at rest, and they are set when the tenant is provisioned rather than switched on afterwards. For UAE businesses with contractual residency requirements that makes it a question for the beginning of a project, not the end.
We do this as part of Microsoft 365 for UAE businesses and cover the tier arithmetic on Microsoft 365 Business Premium. If the concern is specifically fraud, how UAE trading companies lose money to email fraud covers the controls that matter most.