Microsoft says strengthen identity. Here is the license and the price

Microsoft published the 2026 edition of the Digital Defense Report on 1 October. It draws on more than 165 trillion security signals a day and covers 1 July 2025 to 30 June 2026.

The figures that matter for a small or medium business:

Phishing

Accounted for 23% of all intrusions, against 7% the year before. More than a threefold rise in a year.

Valid accounts

In 52.2% of intrusions where the attacker used a valid account, further credentials were stolen along the way. One compromised login rarely stays one.

Speed

The median time from a vulnerability being discovered to being weaponised is well below 24 hours. Microsoft expects a record 72,000 published CVEs in 2026.

Who is hit

Public sector accounted for 27% of observed threat activity worldwide, up from 17% the year before. Microsoft calls that better than one intrusion in four.

Microsoft puts it this way: *"reduce exposure before an attack begins. That means strengthening identity, limiting privilege, finding internet-facing assets, fixing exposed systems quickly"*, and names the areas identity, data protection, software security, exposure management and Zero Trust.

The first four are concrete enough to act on tomorrow. But the report does not say a word about which Microsoft license they require, or what they cost.

There is a reason for that. The report is written for a global audience and covers the threat landscape rather than procurement. But for a business reading it and wanting to act, the next question is unavoidable: what do we buy, and what does it cost?

The rest of this article is that answer, at Microsoft list price per user per month on an annual commitment.

Strengthen identity

The cheapest answer to phishing costs no license at all. Since 1 September 2026 passkeys are the default sign-in in Entra, and Microsoft retires its own SMS and voice codes on 1 February 2027, and 1 July 2027 for Global Administrators and external users.

Conditional Access is what turns that into an enforced policy rather than an option, and it requires Entra ID P1. P1 ships with Business Premium, E3, E5, E7 and the frontline plans F1 and F3.

Limit privilege

This is the difference between having one login stolen and having the organization taken over. Privileged Identity Management gives time-bound admin rights instead of permanent ones, and requires Entra ID P2 or Entra ID Governance.

You do not buy it for everyone. Microsoft counts only the users who are eligible for a role, approve activations or perform access reviews. Microsoft's own example: 25 administrators, of which 14 are managed through PIM, plus 3 approvers needs 17 licenses, not 25.

Find and close

The last two belong together and sit in the same place. Security Exposure Management gives the overview of what is exposed, and Defender for Business closes the holes. Business Premium at $22 includes both.

Three realistic starting points.

Finally. The report shows that the two most common ways in are user actions and valid logins. No license solves that on its own. The license gives you the tool; configuration and training decide whether it works.

Sources: Microsoft Digital Defense Report 2026, Microsoft's announcement of the report, 1 October 2026, 2026 Digital Defense Report, Security Insider, Microsoft Entra pricing and Microsoft Entra licensing (Microsoft Learn).