Microsoft 365 features Kenyan businesses already pay for but rarely switch on

Most Kenyan businesses already pay for Microsoft 365 features they have never switched on. Every plan supports multifactor sign-in and Copilot Chat; Business Standard adds Bookings, Forms and Teams webinars; and Business Premium adds Defender for Business, Intune and data loss prevention. Turning these on usually gives you more value than buying anything new.

This is the first article in our series on getting full value from Microsoft 365 and Copilot. The second asks whether your Microsoft 365 plan is right for each person on your team, and the third sets out an adoption plan for getting staff to use Copilot.

The pattern is familiar across Nairobi offices, upcountry SACCO branches and NGO field stations. Someone buys licences, email moves across, and the work carries on much as before. Files still live on laptops. Clients still phone to book appointments. The finance manager’s account still signs in with only a password. Below, plan by plan, is what you are likely paying for already, what it does in plain terms, and where to start. Plan details come from Microsoft’s plans and pricing pages (checked 3 October 2026), and feature guidance from Microsoft Learn (checked 4 October 2026).

On every plan: security defaults and multifactor sign-in

Every Microsoft 365 tenant can use security defaults at no extra cost, and they are the single most useful setting most small organisations have not checked. Microsoft describes security defaults as preconfigured settings that require all users to register for multifactor authentication, require administrators to use it, block legacy authentication protocols and block device code flow (Microsoft Learn: Configure security defaults for Microsoft Entra ID, checked 4 October 2026).

Microsoft says security defaults may already be on if your tenant was created on or after 22 October 2019, but many Kenyan tenants are older than that, and some were switched off years ago because a scanner or an old version of Outlook stopped working. Legacy protocols such as POP3, IMAP and SMTP authentication cannot do multifactor sign-in, so an attacker with a stolen password can use them to get around it. That is why a photocopier that emails scans, or an accounts package that sends invoices through your mailbox, needs checking before you switch security defaults back on.

Security defaults are on or off, with no exceptions. If you need rules such as “allow sign-in only from company laptops”, you need conditional access, which Microsoft says requires at least Microsoft Entra ID P1. That comes with Business Premium and E3, as we explain below.

On every plan: Copilot Chat

Copilot Chat is available at no additional cost to users with an eligible Microsoft 365 work account. It gives staff an AI chat with web information, writing help and file uploads, under your organisation’s sign-in rather than a personal consumer account. Many organisations never tell staff it exists, so people keep pasting work documents into free consumer AI tools instead. Pointing everyone to Copilot Chat is a quick win; our article Is Microsoft Copilot free? explains what it can and cannot do compared with paid Copilot.

Business Basic: OneDrive, Teams and Bookings

Microsoft 365 Business Basic includes business email with a 100 GB mailbox and a 50 GB archive, 1 TB of OneDrive storage per user, Microsoft Teams, and web and mobile versions of Word, Excel, PowerPoint and Outlook. Three things in it are often left unused.

• OneDrive Known Folder Move. This moves each person’s Desktop, Documents, Pictures, Screenshots and Camera Roll folders into OneDrive. Microsoft says staff keep using the folders they know, while their files are backed up in the cloud and reachable from any device (Microsoft Learn: Redirect and move Windows known folders to OneDrive, checked 4 October 2026). For an office where a stolen laptop on a matatu means a lost year of work, this matters.
• Microsoft Bookings. Microsoft lists Bookings in Business Basic, Business Standard and Business Premium. It gives you a web booking page linked to Outlook calendars, sends email and SMS notifications to reduce no-shows, and can create a Teams link for online appointments (Microsoft Learn: Microsoft Bookings, checked 4 October 2026). A clinic, a law firm or a training centre can let clients book without a phone call.
• Teams as the place where files live. Most teams use Teams for calls only. Each team also has a shared file library in SharePoint, so a branch or department can work on one copy of a document instead of emailing versions back and forth.

Business Standard: desktop apps, webinars, Forms and Planner

Microsoft 365 Business Standard adds desktop versions of Word, Excel, PowerPoint and Outlook on up to five PCs or Macs, five tablets and five phones per person, plus what Microsoft calls “10+ additional apps”, naming Loop, Clipchamp, Bookings, Planner and Forms. It also lets you host webinars in Teams.

• Five installs per person. Staff can install the desktop apps on a home laptop and a phone as well as the office PC, under the same licence. Many organisations still buy separate Office copies for these.
• Teams webinars. Microsoft’s admin guide to Teams events describes registration forms, waitlists, attendance and engagement reports, and Q&A (Microsoft Learn: Plan for Teams events, checked 4 October 2026). Which features and how many attendees you get depends on your licence, so check before a large event. For an association running member briefings or an NGO hosting a partner launch, this can replace a separate webinar subscription.
• Forms and Planner. Forms handles staff surveys, event registrations and simple applications, with responses straight into Excel. Planner gives a team a shared task board. Together they replace a surprising number of paper forms and WhatsApp reminders.

Business Premium: the security most owners never set up

Microsoft 365 Business Premium includes everything in Business Standard plus a full security stack. It is also the plan where the gap between what is paid for and what is used tends to be widest, because none of these features protects you until someone configures it.

• Microsoft Defender for Business. Device protection for company laptops. Until devices are onboarded, it protects nothing.
• Defender for Office 365 Plan 1. Email and threat protection against phishing, malware and other attacks that arrive in the inbox.
• Intune Plan 1. Endpoint management, so you can require a PIN on phones that hold work email, push settings to laptops, and wipe company data from a lost device.
• Advanced identity and access management with Microsoft Entra ID. This is where conditional access lives: block sign-ins from unmanaged devices, require multifactor sign-in for risky logins, and keep admin accounts tightly controlled.
• Microsoft Purview Information Protection and data loss prevention. Sensitivity labels for board papers, payroll and client files, and rules that warn or block when someone tries to email ID numbers or other personal data outside the organisation. These help you protect personal data under the Data Protection Act 2019, alongside your own policies and processes.
• A 1.5 TB archive mailbox and a Windows 11 Pro upgrade. Long-serving staff with years of email no longer run out of space, and eligible PCs can move to Windows 11 Pro.

If you pay for Business Premium and only use email and Office apps, you are paying for protection you do not have. Our Microsoft 365 security service exists to close that gap.

Enterprise and frontline plans

Larger organisations on enterprise plans have even more switched off by default. Microsoft 365 E3 includes Microsoft Entra ID Plan 1, Intune Plan 1, Defender for Endpoint Plan 1, Purview Information Protection, Audit Standard and eDiscovery Standard. Microsoft 365 E5 adds Entra ID Plan 2, Defender for Endpoint Plan 2, Defender for Identity, Defender for Cloud Apps, Power BI Pro, Security Copilot (default capacity) and, in the version with Teams, Teams Phone and Audio Conferencing. Microsoft 365 F3, designed for frontline staff, includes Windows Autopilot and Power Apps and Power Automate for Microsoft 365.

Feature	Plans that include it	What it does for you
Security defaults (MFA, block legacy sign-in)	All tenants	A second check at sign-in for every user
Copilot Chat	Eligible Microsoft 365 work accounts	AI chat under your organisation’s sign-in
OneDrive Known Folder Move	Plans with OneDrive, on Windows PCs	Desktop and Documents backed up to the cloud
Bookings	Business Basic, Standard, Premium, E3, E5, F3	Online appointment booking with reminders
Desktop apps on 5 PCs or Macs	Business Standard, Business Premium	No separate Office copies for home or travel
Teams webinars	Business Standard, Business Premium, E3	Registration and attendance reports
Defender for Business, Intune Plan 1	Business Premium	Protected, manageable company devices
Conditional access	Business Premium, E3, E5, F1, F3	Rules on who signs in, from where and on what
Data loss prevention and labels	Business Premium, E3, E5	Stops personal data leaving by email
Power BI Pro	E5	Shared dashboards and reports

How we help you switch it on

We walk with you through this, from the first check to the training that makes new habits stick. Our security setup covers multifactor sign-in, conditional access, Intune and Defender, tested so staff are not locked out. Our training and advisory sessions show each team how to use OneDrive, Teams, Bookings and Forms on its own work. And if you find you are on the wrong plan for some people, read the next article in this series or compare plans on our Microsoft 365 prices in Kenya page.