Four controls do most of the work in a small or mid-sized business: identity, endpoint, email and the network edge. These are the four we actually deploy, reviewed honestly, including where each one will let you down if you install it and walk away.
We have put them in the order we would defend them if a budget conversation forced us to choose.
Entra ID conditional access: the one we would keep
Microsoft renamed Azure AD to Entra ID in 2023, but the star feature is older: conditional access, the policy engine deciding who gets in, from what device, from where.
It is the single biggest lever against account takeover we deploy. The catch is that policy design is unforgiving. One careless rule locks out the chief executive at the airport. Test in report-only mode first. We learned that one properly.
Verdict: the control we would keep if we could keep only one.
Defender for Office 365: the inbox bodyguard
Email is still where attacks start, and a decade of this product, back when it was called ATP, has made one thing clear: Safe Links and Safe Attachments catch the things users click before users can click them.
Out of the box it is mediocre. The preset security policies fixed most of that, but impersonation protection still needs per-tenant tuning, because every executive and supplier list is different.
Verdict: non-negotiable on every tenant we manage. Tuned, it is the highest-value control in the stack.
Defender for Business: four years in
When Microsoft shipped an SMB endpoint detection and response product in 2022, the security industry rolled its eyes. Four years of running it across client fleets later: it detects well, the automated investigation genuinely reduces noise, and it is already included in Business Premium.
The gripe is the portal, which still assumes you have a security team's patience. That is partly why clients have us.
Verdict: real EDR at SMB economics. With tuning, a serious baseline.
FortiGate: our firewall of record
We are a Fortinet partner because the boxes keep earning it: serious throughput at SMB prices, SD-WAN built in, and one operating system from the 40-series desktop units up to datacentre kit.
The honest caveats: licensing tiers take a map to navigate, and FortiOS releases deserve a cautious upgrade policy. We stay one stable step behind the bleeding edge on purpose.
Verdict: the default at the client edge, deployed with discipline.
What we would tell you
Identity first, always. If conditional access is not designed and enforced, everything downstream is optional from an attacker's point of view. Email next, because that is where the attempt arrives. Endpoint third, because it is the net that catches what the first two miss. The firewall matters, but it is no longer the perimeter that most compromises cross.
Three of these four are already included in Microsoft 365 Business Premium, which is the uncomfortable finding in most security reviews we run: the controls were bought years ago and never switched on. The gap is rarely budget. It is configuration and ownership.
Reviewed from live fleet experience · published August 2026 · we earn a fair margin on some products we supply; reviews are not sponsored.
