Security Exposure Management: which Microsoft 365 license gives you access?
By Michal Lampe Sørensen · 7 min read · 22 September 2026
Verified against Microsoft Learn, September 2026
Contents
In short
Microsoft announced a new feature, Secure Now, in Security Exposure Management on September 17, 2026. According to Microsoft's technical licensing documentation, full access doesn't necessarily require Microsoft 365 E5 ($60/user/month): Microsoft 365 Business Premium ($22/user/month) gives full access because it includes Defender for Business. A plain Microsoft 365 E3 ($39/user/month) without an add-on only gets access to Secure Score, not the full experience. Business Standard and Business Basic have no access at all. Microsoft's own product marketing page states it more loosely than the technical documentation, so confirm with your CSP partner if this matters for you.
What Microsoft announced on September 17
On September 17, 2026, Microsoft expanded its Security Exposure Management portal with a new feature, Secure Now. This is according to a post by Ron Pessner, corporate vice president for Microsoft Security, on Microsoft's security blog. The post's core argument is that the basic security measures work together: identity and sign-in, endpoints, access management, and, new for 2026, AI agent governance. Among the threats the post cites as examples are the Storm-2945/Midnight Blizzard and CaptiveCrunch campaigns, along with agentic-AI incidents at both OpenAI and Anthropic.
The blog post itself contains no numbers and no licensing information. What's actually relevant for you as a Microsoft 365 customer sits instead in Microsoft's technical documentation for Security Exposure Management: which license actually gives you access to the feature.
Which of your 10 plans gives access
According to Microsoft's licensing documentation for Security Exposure Management (updated July 26, 2026), there are two tiers: full access to all Exposure Management experiences, or Microsoft Secure Score only. Here's how that maps to the 10 plans we compare:
| Plan | Security Exposure Management access |
|---|---|
| Business Basic | None |
| Business Standard | None |
| Business Premium | Full access (via Defender for Business) |
| Office 365 E3 | Secure Score only |
| Microsoft 365 E3 (alone) | Secure Score only |
| Office 365 E5 | Full access |
| Microsoft 365 E5 | Full access |
| Microsoft 365 E7 | Full access |
| Frontline F1 | None |
| Frontline F3 | None |
The reason Business Premium makes the list is that the plan includes Defender for Business, which is explicitly named on Microsoft's list of licenses granting full access. Business Standard doesn't include Defender for Business and falls outside the list entirely.
Both E3 variants land in the Secure Score category, but for different reasons. Microsoft 365 E3 is explicitly named on Microsoft's list of licenses that only get Secure Score. Office 365 E3 joined it because the plan gained Defender for Office 365 Plan 1 on July 1, 2026, and Plan 1 sits on that same Secure Score list. If you need the full tool on an E3 foundation, you need to add either the Microsoft 365 E5 Security add-on or the Enterprise Mobility + Security E5 add-on.
Microsoft's own product page for Security Exposure Management states this more loosely and lists Microsoft 365 E3 without the Secure Score caveat. The technical licensing documentation is more specific and more recently updated, so that's what we rely on here. Confirm with your CSP partner (Cloud Solution Provider) if this distinction matters for you.
What Secure Now actually does differently
Secure Now is not a separate license. It's a feature inside Exposure Management that everyone with full access gets at no extra cost. According to Microsoft's blog post, it consolidates recommendations across the security fundamentals that have historically required someone to manually check several different dashboards: identity and sign-in (phishing-resistant authentication, Conditional Access, restricting device-code flow), endpoints (attack surface reduction rules, malware protection), access management (least privilege, requiring managed devices), and, new this year, AI agent governance (agent identity, execution isolation, behavioral monitoring).
You probably already know the individual capabilities. What's new for a Danish SMB without a dedicated security team is that they're gathered in one place with a recommended order. If you have Business Premium or above, trying it costs nothing extra.
How to check whether you have access
Four steps and you'll know where you stand.
Look for it in the Defender portal
Sign in to security.microsoft.com with an admin account and find Exposure Management in the left menu. If you can see more than Secure Score, you already have full access.
Check which plan is actually assigned
Assigned licenses are listed in the Microsoft 365 admin center under Billing, then Licenses. It isn't always the plan you think you bought.
Business Standard: run the numbers on the step up
The step to Business Premium costs $8/user/month, and that covers the whole plan, not just the security part.
Plain E3: compare before buying an add-on
If you're under 300 users, my advice is to price Business Premium first. You get the access included, and the base price is lower.
Sources: From guidance to action: security fundamentals that materially reduce risk (Microsoft Security Blog, September 17, 2026), Integration and licensing for Microsoft Security Exposure Management (Microsoft Learn, updated July 26, 2026), Microsoft Security Exposure Management (Microsoft.com product page), and Microsoft 365 Security Enterprise Plans pricing (Microsoft.com).
See what your plan already gives you
Business Premium already includes what's needed for full access to Security Exposure Management. See what the other plans give you in terms of security features.
See all plansFrequently asked questions
Does Security Exposure Management require Microsoft 365 E5?+
No. According to Microsoft's technical licensing documentation, Microsoft 365 Business Premium ($22/user/month) also grants full access, because it includes Defender for Business. E5 ($60/user/month) is the most expensive route to the same access.
Does Microsoft 365 Business Standard get access to Security Exposure Management?+
No. Business Standard lacks Defender for Business, which is what gives Business Premium access. If you need the feature without going all the way to E5, Business Premium is the cheapest route.
What is Secure Now?+
Secure Now is a new feature in Microsoft Security Exposure Management, announced September 17, 2026. It consolidates recommendations across identity, endpoints, access management, and, new this year, AI agent governance into one place instead of scattered dashboards. It costs nothing extra for customers who already have full access to Exposure Management.
Does plain Microsoft 365 E3 give access to Security Exposure Management?+
Only to the Secure Score portion, not the full experience, according to Microsoft's technical licensing documentation. For full access on an E3 foundation, you need to add either the Microsoft 365 E5 Security add-on or the Enterprise Mobility + Security E5 add-on. Microsoft's own marketing page states it more loosely, so confirm with your CSP partner if this matters.