There is a page inside Microsoft 365 that is supposed to show you how your computers are doing. Plenty of owners have opened it, seen a calm screen with nothing on it, and closed it feeling reassured.
The screen was empty because nothing was reporting to it. That is a different thing from nothing being wrong.
Business Premium is three tools, not one
If you pay for Microsoft 365 Business Premium, the plan includes Microsoft Defender for Business, Intune, and Entra ID P1. Microsoft's own documentation confirms all three and puts the ceiling at 300 users.
Translated: Defender for Business watches each computer for ransomware, malware, and phishing. Intune is what puts rules on each computer, things like disk encryption and screen locks. Entra ID P1 is what decides who is allowed to sign in, and from where.
Most businesses on this plan use the email, the calendar, Teams, and Word. The other three sit unused. Not because anyone decided against them. Because nobody was told the plan included them.
The license is not a switch
This is the part that gets missed. A license gives you the right to use something. It does not reach out and touch the computer.
Every device has to be onboarded. Microsoft lists three ways: run a local script on the machine, push it out with Group Policy if you already have that, or do it through Intune. The script alone creates a trust with Entra ID, enrolls the device in Intune, and onboards it to Defender for Business. That is a small piece of work per machine, not a checkbox in a billing portal.
Microsoft states the consequence plainly in their Business Premium security FAQ: the security and management benefits are available only to users with devices managed under a Business Premium subscription.
Read that twice. The license sitting on a user account does nothing for a laptop nobody enrolled.
What an empty inventory actually means
In the Defender portal, under Assets, there is a Device inventory page. Microsoft's guidance for that page includes a short line for the case where no devices are listed: go onboard some devices.
So when you open it and see four machines and you own eleven, the number you are looking at is not a security score. It is a headcount of the machines someone remembered.
The ones that get missed are predictable. The desktop at the front counter. The PC in the shop office that runs the label printer. The owner's laptop, which holds more than any of them. Nobody runs an onboarding script on the computer they use every day.
The antivirus detail that surprises people
Microsoft documents three states for Defender Antivirus. Active mode, where it is the only antivirus on an onboarded machine and it scans and cleans. Passive mode, where another antivirus is present on an onboarded machine. And disabled mode, where a non-Microsoft antivirus is installed on a device that was never onboarded. In that last state Defender Antivirus is not running. It cannot detect or clean anything.
Which means "we have Defender, it came with the license" and "nothing is scanning this machine" can both be true, on the same computer, at the same time.
The server in the back room
One limit worth saying out loud. Business Premium's device protection covers the computers people use. Microsoft's FAQ says server protection is a different plan.
A shop with a server holding QuickBooks files and fifteen years of job history has a gap the license does not fill. Most owners assume the server is covered because the computers are. It is worth asking the question directly rather than assuming either way.
What I would check first
Open the Defender portal and go to Assets, then Devices. Count what is there. Then count the machines you actually own, including the one under the counter and the one at somebody's house.
Compare the names. If there are names on the list you do not recognize, that is worth understanding too. A machine nobody claims is its own problem.
Then ask who enrolled them, and when. If nobody knows, you have your answer. It is not a crisis. It is a task with a finite end.
Last, look at which licenses are assigned to people who no longer work there. That is a different kind of quiet waste, and it takes about as long to find.
What an empty page is not
An empty dashboard is not proof you are unprotected. Some businesses run a different tool, bought separately, and somebody actually watches it. If that is you, you may not need any of this.
An empty dashboard is proof of something narrower. Nothing is reporting. And a full one is not proof of safety either, because a screen full of alerts only helps if a person reads it and acts.
You do not need a new product for most of this. You need to know whether the one you already pay for is switched on.
Call us at (906) 662-4481, or contact us for a free assessment.