Business Email & Office Suites
Microsoft 365 Business
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Microsoft Corporation · www.microsoft.com
Compare with Google Workspace → Compare with Proton for Business → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Microsoft 365 Business at a glance
- Vendor
- Microsoft Corporation
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates Microsoft 365 Business 3/5, the mean of 6 judges. Microsoft 365 Business is a hosted Exchange Online suite bundled with Word, Excel, PowerPoint, Outlook, Teams and 1 TB of OneDrive per user. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Microsoft 365 Business is a hosted Exchange Online suite bundled with Word, Excel, PowerPoint, Outlook, Teams and 1 TB of OneDrive per user. It scores strongest on calendar and office, 7 to 8; mail and deliverability sits at 7, its per-plan limits and quarantine documented while we found no public information on SPF, DKIM, DMARC, MTA-STS or custom-domain DNS set-up. Security and compliance, 6 to 7, documents retention deeply, but we found no public information on certifications with their scope. Sovereignty is the low point at 4 to 5: the EU Data Boundary names fifteen datacentre countries for tenants signing up in the EU or EFTA, yet the pages state that customer data continues to be transferred outside the boundary in limited circumstances, the vendor is a US corporation, and we found no public information on subprocessors, a data processing agreement or a contracting entity. The widest spread, migration and portability at 6 to 8, weighs documented entry paths against a thinner exit. Pricing transparency scored 5 to 6 on three published per-user tiers, with annual billing only shown.
Speaks for it
- Cutover, staged, hybrid and express migrations from Exchange, IMAP from Gmail (mail folders only), and PST import by network upload or drive shipping are documented, with FastTrack and partner help.
- Retention policies and legal holds are documented in depth, with up to 1,800 policies per tenant, 50 holds per mailbox, proof of disposition for up to seven years and archive mailboxes growing to 1.5 TB.
- Storage and message limits are published per plan, from a 35 MB default message size configurable up to 150 MB and mailbox tiers from 2 GB to 100 GB.
- Shared mailboxes and conference rooms require no user subscription, with unlicensed shared mailboxes limited to 50 GB.
- Administration runs through the Microsoft 365 and Exchange admin centres, remote PowerShell and the Graph REST API with SDKs, integrated with Microsoft Entra ID conditional access.
Held against it
- We found no public information on SPF, DKIM, DMARC, MTA-STS, custom-domain DNS set-up or the delivery reputation of the outbound infrastructure.
- We found no public information on certifications such as ISO 27001, BSI C5 or SOC 2 with their scope, enforced two-factor sign-in, encryption at rest or a transparency report on authority requests.
- Cancellation is documented to delete all associated data, and we found no public information on a data-return period or an organisation-wide export by an administrator.
- Business Standard and Premium prices appear only bundled with Copilot Business at 20,36 € and 27,73 €, and the captured pages show annual billing only.
- The EU Data Boundary pages state that customer data continues to be transferred outside the boundary in limited circumstances, and we found no public information on a subprocessor list, a data processing agreement or the contracting entity.
Best for
- You want hosted Exchange mail together with Word, Excel, PowerPoint, Outlook, Teams and 1 TB of OneDrive per user in one per-user subscription.
- You are migrating off Exchange Server (2003 through 2013) or Gmail and want documented cutover, staged or hybrid paths plus FastTrack specialists.
- Your compliance work centres on retention and legal holds with stated limits and proof of disposition for up to seven years.
Avoid if
- You require a European-controlled legal chain: the vendor is Microsoft Corporation of Redmond, Washington, and the EU Data Boundary pages themselves state that customer data continues to be transferred outside the boundary in limited circumstances.
- You must compute an exact annual cost before signing: the two higher tiers are published only bundled with Copilot Business, and the captured pages show annual billing only.
- You expect your mail data returned to you on leaving: the documented behaviour on cancellation is deletion of all associated data.
- You cannot accept a trial that converts automatically: the one-month trial requires a credit card and converts to a paid subscription, with a 7-day withdrawal right thereafter.
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 3.5 of 5 |
| Calendar, contacts & office apps | 4 of 5 |
| Security, encryption & compliance archiving | 3.5 of 5 |
| Administration, identity & partner management | 3 of 5 |
| Migration, open standards & exit | 3.5 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 3 of 5 |
Mail, domains & deliverability
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
The mailbox side is strong for our firm: Exchange Online brings quarantine that admins and users manage, multi-engine anti-spam and anti-malware on all plans, Exchange ActiveSync policies for the phones, shared mailboxes with their stated sizes and licensing, out-of-office replies and server-side rules, and message, attachment and storage limits spelled out per client, with S/MIME signing and encryption available. For mail on our own domain, however, we found no public information on custom-domain DNS set-up, SPF, DKIM, DMARC, MTA-STS or DANE, catch-all or plus addressing, or the delivery reputation of the outbound infrastructure. 3 4 7 1
The IT Administrator
Exchange Online is documented as a full hosted mailbox platform: quotas of 50 GB and 100 GB per plan (2 GB for Kiosk), default message sizes of 35 MB sending and 36 MB receiving with administrator-configurable limits up to 150 MB, anti-spam and anti-malware with multiple engines across all plans, quarantine an administrator manages, shared mailboxes up to 50 GB without a license, ActiveSync policies, and custom outbound routing with SMTP relay. That covers the working set for my three hundred mailboxes. We found no public information on SPF, DKIM, DMARC or MTA-STS, catch-all or plus addressing, or the delivery reputation of the outbound infrastructure, so it stays below the top level. 2 3 4
The Public Sector IT Lead
Exchange Online is documented as a full hosted mail platform: mailbox sizes per plan from 2 GB to 100 GB, multi-engine anti-malware and phishing protection on all plans, quarantine an administrator can review, server-side rules and out-of-office replies, ActiveSync device policies, S/MIME signing and encryption, and stated limits for messages, attachments and sending down to transport rules and journal rules. What the captured pages do not show is the domain side — custom-domain DNS set-up, SPF, DKIM, DMARC, MTA-STS — or any statement on the delivery reputation of the outbound infrastructure, which for an authority sending official notices matters as much as the limits. 1 3 4 7
The IT Service Provider
The Exchange Online service description and limits pages show a platform I could run clients on: ActiveSync with device policies and limits, native Outlook on desktop, web and mobile, a quarantine the admin manages, inbox and transport rules with hard numbers, shared mailboxes up to 100 GB, multi-engine anti-malware and custom outbound routing. But we found no public information on custom-domain DNS set-up, DKIM, DMARC, SPF or MTA-STS, nor on the outbound delivery reputation — the parts I touch every Monday — so I stop short of the top band. 3 4 7 1
The Data Protection Officer
The service description and limits pages document shared mailboxes reached by delegation, a quarantine with administrator and end-user management, server-side transport and inbox rules, journal rules up to 300, per-plan mailbox storage from 2 GB to 100 GB, and message sizes from a 35 MB default up to 150 MB in Outlook, behind multi-engine anti-spam and anti-malware scanning. For sending referral letters I still found no public information on custom-domain DNS set-up, DKIM or DMARC signing, catch-all, or the delivery reputation of the outbound infrastructure. 3 4
The Skeptic
A hosted Exchange service with anti-spam and anti-malware across all plans, quarantine an administrator can review, transport and inbox rules, out-of-office replies, distribution groups up to 100,000 members, unlicensed shared and resource mailboxes, and per-plan storage and message limits stated to the megabyte. What I cannot find is the sending side of the story: no custom-domain DNS set-up and no SPF, DKIM, DMARC or MTA-STS documentation on any captured page. The plumbing is documented; the authentication and delivery reputation a sender is judged by is not. 3 4
Calendar, contacts & office apps
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
This is the office our twelve people already live in: conference room management and calendar sharing, federated sharing with calendar publishing, the global address list and offline address book, Word, Excel, PowerPoint and Outlook for desktop, web and mobile, 1 TB of OneDrive per user, Teams and more than ten further apps in the bundle. Room-booking approval, delegated calendar access and co-editing in the browser are not spelled out on the pages we read, which keeps it a notch below the top mark. 1 2 3 4
The IT Administrator
Conference room management, resource mailboxes, calendar sharing and federated sharing are documented, and the API reaches calendar data in shared as well as primary mailboxes, which covers the delegation model I run today. Word, Excel, PowerPoint and Outlook ship for desktop, web and mobile in the same plans, with Teams, 1 TB OneDrive per user, and global address lists and offline address books for the company directory. We found no public information on browser co-editing, video meetings, cross-organisation free/busy or accessibility conformance, so I cannot place it at the top level. 1 2 3 7 9
The Public Sector IT Lead
The breadth is documented: conference room management and calendar sharing with federated publishing, global address lists and address book policies, Word, Excel, PowerPoint and Outlook for desktop, web and mobile, 1 TB of OneDrive storage per user, Teams and more than ten further apps, with add-ins across Windows, Mac, Android, iOS and the web. Browser co-editing, free/busy across organisations, delegated calendar access and any statement against an accessibility standard are not documented on the captured pages, so I cannot place it at the top level despite the breadth. 1 2 3 4 9
The IT Service Provider
Calendar, contacts and tasks ship with the hosted service, with conference-room management, resource mailboxes and federated calendar sharing, and the business plans bundle Word, Excel, PowerPoint and Outlook for desktop, web and mobile, Teams, and 1 TB of OneDrive per user. We found no public information on room-booking approval, delegated calendar access or in-browser co-editing, so I hold it just under the top band. 1 3 2
The Data Protection Officer
The business plans bundle Word, Excel, PowerPoint and Outlook for desktop, web and mobile with Teams calling and 1 TB of OneDrive storage per user, and Exchange brings resource and conference-room mailboxes, calendar sharing and federated sharing, plus an add-in platform across Windows, Mac, Android, iOS and the web. We found no public information on browser co-editing or an interface stated against an accessibility standard. 1 3 9
The Skeptic
Rooms, resource mailboxes, calendar sharing and federated publishing, a global address list with offline address books, and shared mailboxes reachable through the calendar and contacts APIs sit next to Word, Excel, PowerPoint and Outlook for desktop, web and mobile, 1 TB of OneDrive storage, Teams, and ten-plus extra apps in the same plans; add-ins run across Windows, Mac, Android, iOS and the web. We found no public information on browser co-editing, CalDAV or CardDAV, or free/busy lookups across providers — phones here sync through ActiveSync, which is documented. 1 3 9
Security, encryption & compliance archiving
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
The compliance side is what I would want behind a Kanzlei: retention labels and policies across Exchange, SharePoint, OneDrive and Teams, legal holds with stated limits, records with proof of disposition for up to seven years, data loss prevention, S/MIME and Purview message encryption, phishing, spam and malware protection, deleted-item recovery, and archives growing to 1.5 TB. But we found no public information on certifications such as ISO 27001 or BSI C5, GoBD-compliant archiving, statements on TLS or encryption at rest, enforced two-factor sign-in or passkeys, or a transparency report on authority requests. 1 3 4 6 7
The IT Administrator
S/MIME signing and encryption, message encryption with a 100 MB limit, and single item and deleted mailbox recovery are documented, and the retention side is unusually deep: retention policies across Exchange, SharePoint, OneDrive, Teams and Copilot locations, up to 1,800 policies per tenant, 50 holds per mailbox, record declaration with proof of disposition for up to seven years, and content search with label conditions. We found no public information on two-factor enforcement, encryption at rest, certifications such as ISO 27001 or BSI C5, GoBD-compliant archiving, or a transparency report on authority requests, so the compliance archiving is better evidenced than the security attestations. 3 4 6 7
The Public Sector IT Lead
Retention and archiving are documented to audit-grade depth — retain, delete and combined modes, event-based retention, legal holds with stated per-mailbox limits, proof of disposition for up to seven years, record declaration, archive mailboxes growing to 1.5 TB, deleted-item recovery — alongside S/MIME and multi-engine anti-malware. No certification appears on the captured pages — I found no public information there on ISO 27001, BSI C5 or SOC 2 — and encryption in transit and at rest, enforced two-factor sign-in and a transparency report on authority requests are equally undocumented; a council that demands C5 on paper cannot get it from these pages. 1 3 4 6 7
The IT Service Provider
The retention and legal-hold side is audit-grade: retention labels and policies across mailboxes, Teams and SharePoint, up to 50 holds per mailbox, records with proof of disposition for up to seven years, content search, plus S/MIME signing and encryption, multi-engine anti-malware and deleted mailbox and item recovery. We found no public information on certifications such as ISO 27001 or BSI C5 with their scope, enforced two-factor sign-in, encryption at rest, GoBD archiving or a transparency report on authority requests. 3 4 6 7
The Data Protection Officer
Retention labels and policies across Exchange, SharePoint and Teams, holds up to 50 per mailbox, record declaration with proof of disposition for up to seven years, single-item recovery, S/MIME through the Graph API, Purview message encryption and multi-engine malware scanning are documented — archiving a tax auditor can work with. But the captured pages say nothing about enforced TLS, encryption at rest, enforced two-factor sign-in, a transparency report on authority requests, or any certification with its scope, and nowhere is stated who at Microsoft may open a mailbox and under which law. 3 4 6 7
The Skeptic
The archive would likely survive an audit: auto-expanding archive mailboxes to 1.5 TB, retention labels and policies across Exchange, SharePoint and Teams, legal holds per mailbox, records with proof of disposition for up to seven years, eDiscovery, S/MIME signing and encryption, and deleted-item recovery. But we found no public information on certifications — no ISO 27001, BSI C5 or SOC 2 with scope and auditor — nor on TLS in transit, encryption at rest, enforced two-factor, or a transparency report on authority requests. The compliance tooling is documented; the provider's own audit paper trail is not on these pages. 3 4 6 7
Administration, identity & partner management
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
Whoever runs our IT gets the Microsoft 365 admin center, the Exchange admin center and remote PowerShell, provisioning of users, groups and teams by script or through the Graph REST API, full integration with Microsoft Entra ID with group policies and conditional access, ActiveSync device policies, usage reports and a Message Center for announcements. We found no public information on single sign-on explicitly, SCIM provisioning, remote wipe, exportable audit logs or partner accounts managing several customers, and no support response times — only sales phone and chat hours and developer forums. 1 3 4 11 12 2
The IT Administrator
The Microsoft 365 admin center, Exchange admin center and remote PowerShell are documented, Exchange Online integrates fully with Microsoft Entra ID with group-policy management, and API provisioning is strong: Microsoft Graph with SDKs, and PowerShell to provision users, groups and teams, pull usage reports and send security alerts. Mobile devices run under ActiveSync policies with documented device and deletion limits. We found no public information on directory synchronisation with Active Directory, SCIM, exportable audit logs, reseller accounts managing several customers, or support response times, which is what I would still need to run this for a machine builder. 1 3 4 11 12
The Public Sector IT Lead
Administration runs through the Microsoft admin centre, the Exchange admin centre and remote PowerShell, with the Graph API and SDKs for provisioning, usage reports and security alerts, Entra ID integration with group policies, conditional access, identity protection and advanced device management, plus ActiveSync device policies. I found no public information on the captured pages about single sign-on protocols, directory synchronisation, SCIM provisioning, exportable audit logs, reseller accounts managing several customers, or support response times — for eleven hundred accounts across remote sites, that is the part I would have to see before signing. 1 3 4 11 12
The IT Service Provider
For my own tooling this is strong: the Microsoft 365 and Exchange admin centres, remote PowerShell, the Graph API with SDKs to provision users, groups and Teams, usage reports and security alerts, and full Microsoft Entra ID integration with conditional access, identity protection and access-lifecycle governance. We found no public information on reseller or multi-tenant partner accounts for managing several customer organisations, audit-log export, SCIM provisioning or support response times — exactly the gaps that hurt a six-person shop with forty clients. 3 12 11 1
The Data Protection Officer
Administration runs through the Microsoft admin center, the Exchange admin center, remote PowerShell and the Graph REST API with SDKs, integrated with Entra ID for conditional access, identity protection and group policies, alongside ActiveSync device policies with a documented device-deletion limit, usage reports and a message centre. We found no public information on single sign-on protocols such as SAML or OpenID Connect, directory synchronisation, SCIM provisioning, exportable audit logs, or reseller accounts managing several customers. 3 4 11 12
The Skeptic
Administration runs through the Microsoft 365 admin center, the Exchange admin center and remote Windows PowerShell, with full Microsoft Entra ID integration, conditional access and identity protection, Graph REST APIs with SDKs, and PowerShell provisioning of users, groups and teams. Mobile device policies come via ActiveSync, with device and device-deletion limits stated. We found no public information on single sign-on protocols, SCIM provisioning, exportable audit logs, reseller accounts managing several customer organisations, or support response times per plan. 3 4 11 12
Migration, open standards & exit
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
Getting our old mail across is documented properly: cutover, staged and hybrid Exchange migrations, IMAP migration from Gmail, Exchange and Outlook.com, a PST import service by network upload or drive shipping, self-import of contacts, FastTrack specialists and partner help, plus deletion of all associated data when the subscription is cancelled. Two honest cautions for a firm that cannot lose a single client thread: with IMAP only mail folders move and contacts, calendar items and tasks must be handled another way, and mail arriving at the source after migration is not migrated; we also found no public information on open document formats, an organisation-wide export by the admin, or a stated data-return period. 5 1 7 3
The IT Administrator
Migration from my on-premises Exchange is documented three ways — cutover for up to 2,000 mailboxes (realistically 150), staged for Exchange 2003/2007 beyond 2,000, and hybrid for gradual moves keeping both on-premises and online mailboxes — plus IMAP from Gmail and Exchange, a PST import service by network upload or drive shipping, cross-tenant migration, Express migration and FastTrack specialists. The IMAP path is explicitly limited to mail folders, with contacts, calendar items and tasks left to the user. We found no public information on permissions or free/busy moving during coexistence or on a data return period after cancellation; deletion of all associated data on cancellation is stated. 1 3 5 7
The Public Sector IT Lead
The way in is documented thoroughly — cutover, staged, hybrid and express migrations from Exchange, IMAP migration from Gmail and other systems (though IMAP carries only mail folders, not contacts, calendars or tasks), a PST import service by network upload or drive shipping, FastTrack specialists and partners — and an on-premises Exchange Server edition exists for those keeping mail in their own racks. The way out is thinner: the Graph API offers mailbox import and export and cancellation deletes the data with a seven-day withdrawal right, but an organisation-wide export in open formats, open document formats, open-source code and a contractual data return period are not documented — and Schleswig-Holstein taught us the exit is the expensive half. 1 2 5 7
The IT Service Provider
Getting mail in is documented end to end: cutover up to 2,000 mailboxes, staged and hybrid migration with coexistence for gradual moves, IMAP from Gmail and other systems (mail folders only), a PST import service by network upload or drive shipping, cross-tenant moves, plus FastTrack and partner options. Exit is stated too — cancellation via the admin centre deletes all associated data, with a 7-day right of withdrawal — and Exchange Server remains available as a self-hosted edition; we found no public information on organisation-wide export by the admin in open formats. 5 3 1 7
The Data Protection Officer
Migration is documented in depth — cutover for up to 2,000 mailboxes, staged and hybrid moves that keep on-premises and online mailboxes alongside each other, IMAP and Gmail migration, cross-tenant moves, PST import by network upload or drive shipping, FastTrack and partner migration — with the IMAP path carrying mail folders only and Exchange Web Services retiring in 2027 in favour of Graph. Deletion of all associated data on cancellation is stated; we found no public information on whole-organisation export in standard formats or a data-return period after cancellation. 1 3 5 7
The Skeptic
Getting in is documented as well as anything I have seen: cutover, staged and hybrid migrations from named Exchange versions, hybrid keeping on-premises and online mailboxes side by side while users move over gradually, IMAP from Gmail and other systems, a PST import service by network upload or drive shipping, Gmail and cross-tenant paths, plus FastTrack and partner help. The way out is one API line on mailbox import and export and the statement that all associated data is deleted when the subscription is cancelled — no data-return period, organisation-wide export format or deletion confirmation documented. And the IMAP route moves mail folders only; contacts and calendar items are left to the user. 1 5 7
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
The EU Data Boundary is documented in real detail — mailboxes on named Microsoft datacentres in Germany, the Netherlands, Austria and other EU and EFTA countries, with sign-up location and billing address deciding whether the tenant is in scope — and the captured pages acknowledge limited transfers outside the boundary. But the chain beyond hosting stays dark: we found no public information on the contracting entity or an EU representative, a data processing agreement, the subprocessors or any certifications, and the vendor itself is Microsoft Corporation of Redmond, Washington. 8 3
The IT Administrator
The EU Data Boundary documentation commits Microsoft to store and process customer data for Microsoft 365 tenants with an EU or EFTA sign-up location, in datacenter countries including Germany, France, the Netherlands and Ireland, with pseudonymised system logs and minimum-retention policies for each log type. The parent is a US company, the same documentation states customer data will continue to be transferred outside the boundary in limited circumstances, and Multi-Geo customers are out of scope. We found no public information on a data processing agreement, an EU contracting entity, or a subprocessor list with locations. 3 8
The Public Sector IT Lead
The EU Data Boundary is documented with named datacentre countries including Germany, and Microsoft 365 tenants with an EU or EFTA sign-up location fall in scope — that is real. But the same pages state that data continues to be transferred outside the boundary in limited circumstances, that Multi-Geo customers are excluded from it entirely, and I found no public information on the captured pages about an EU contracting entity, a subprocessor list, a data processing agreement or any certification — an American parent offering an EU region is part of the chain, not the sovereignty my council asked for. 3 8
The IT Service Provider
The EU Data Boundary pages commit Microsoft to storing and processing Customer Data for Microsoft 365 tenants signed up in the EU or EFTA inside a boundary with named datacentre countries including Austria, Germany and Switzerland. But the parent company sits in Redmond, Washington, limited transfers outside the boundary continue in stated circumstances, and we found no public information on subprocessors, a published data processing agreement or an EU contracting entity — for my Austrian clients that is a boundary, not full sovereignty. 8 3
The Data Protection Officer
The EU Data Boundary pages commit to storing and processing customer data in named Microsoft datacenters across fifteen EU and EFTA countries for tenants with an EU or EFTA sign-up location, while stating that customer data continues to be transferred outside the boundary in limited circumstances and that Multi-Geo customers are out of scope entirely. Beyond a data protection addendum named in passing, we found no public information on a subprocessor list with locations, an EU contracting entity, or certification scope — so for practices under professional secrecy the chain is only partly evidenced. 3 8
The Skeptic
The EU Data Boundary is documented with Microsoft datacentres named in fifteen European countries, in scope for tenants that sign up in the EU or EFTA — but the same pages concede that Customer Data, personal data and Professional Services Data will continue to be transferred outside the boundary in limited circumstances, the vendor is a US corporation, and we found no public information on the contracting entity, subprocessors and their locations, a data processing agreement, or security certifications. An on-premises Exchange Server edition is documented too, but that is a separate product, not this cloud suite. European hosting under an American parent with an unnamed chain is part of the chain, not the whole of it. 2 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
Prices are public per user with VAT treatment stated — Business Basic at 6,07 € Benutzer/Monat on annual billing with auto-renewal and prices zzgl. MwSt., the Standard and Premium offerings shown at 20,36 € and 27,73 € bundled with Copilot Business — and shared mailboxes and conference rooms need no subscription at all, with mailbox and OneDrive storage stated per plan and a 7-day withdrawal right. We found no public information on monthly versus annual billing differences, minimum users or term, or the price of a Standard or Premium seat without the Copilot bundle, so the exact second-year cost of what we need is not computable from these pages alone. 1 3 4
The IT Administrator
Exact figures are public — Business Basic at 6,07 € per user per month with annual billing, Standard and Premium at 20,36 € and 27,73 € (both shown bundled with Copilot Business), all excluding VAT — with the one-month trial conditions, a 7-day withdrawal right, cancellation through the admin center, mailbox quotas per plan, 1 TB OneDrive per user, and shared mailboxes and conference rooms without a subscription. We found no public information on monthly versus annual billing comparison, the plan prices without Copilot, or add-on prices such as the 100 GB shared mailbox upgrade, extra storage or additional domains, so I cannot fully compute the annual cost for three hundred mailboxes. 1 3 4
The Public Sector IT Lead
Three business tiers carry public per-user monthly prices on annual billing — 6,07 €, 20,36 € and 27,73 € excluding VAT — with trial and cancellation terms stated, the per-user licensing model explicit, and the useful detail that shared mailboxes and conference rooms require no subscription. Monthly versus annual comparison, add-on prices for archiving or extra storage, minimum user counts, migration and support fees and the rate for the usage-based AI functions are not published, so I cannot compute our real annual cost from these pages alone. 1 3 4
The IT Service Provider
Business Basic at 6,07 € per user per month with annual billing, Business Standard with Copilot Business at 20,36 € and Business Premium with Copilot Business at 27,73 € are published with storage per plan, VAT treatment ("Preise zzgl. MwSt."), trial conditions and a 7-day withdrawal right, and shared and room mailboxes need no subscription. We found no public information on add-on prices for archiving or extra storage, a monthly-billing price for comparison, or minimum users — so I cannot compute a client's full year cost from these pages alone before quoting. 1 3 4
The Data Protection Officer
Three business tiers are publicly priced — 6,07 €, 20,36 € and 27,73 € per user per month with annual billing and automatic renewal, stated excluding VAT — with a one-month trial requiring a credit card, a seven-day withdrawal right, cancellation through the admin centre, and shared mailboxes and conference rooms requiring no subscription. We found no public information on a monthly-versus-annual billing comparison, prices for archiving, extra storage or single sign-on, or minimum user counts, and the two higher prices are quoted for plans bundled with Copilot. 1 3 4
The Skeptic
Business Basic is published at 6,07 € per user per month with annual billing, Standard and Premium appear only bundled with Copilot at 20,36 € and 27,73 €, all excluding VAT, with a one-month credit-card trial that auto-converts and a 7-day withdrawal right. Mailbox storage per plan, the 50 GB ceiling for unlicensed shared mailboxes, and the fact that rooms and shared mailboxes need no subscription are public, so much of a bill is computable. We found no price for the usage-based advanced AI billing, for extra storage, or for any monthly-payment alternative — the captured pages show annual billing only. 1 3 4
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Microsoft 365 Business
Is Microsoft 365 Business European?
No. whats-best.ai classifies Microsoft 365 Business as Rest of world.
Where does Microsoft 365 Business store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does Microsoft 365 Business have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to Microsoft 365 Business?
As of 6 Nov 2026, the panel rates grommunio (3.5/5), Infomaniak kSuite (3.5/5) and Nextcloud Hub (Groupware & Office) (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is grommunio (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Microsoft 365 Business alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 25 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (12)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (Microsoft 365 Business) www.microsoft.com Checked 5 Nov 2026 Details →
- 2 Features page (Exchange Online) www.microsoft.com Checked 5 Nov 2026 Details →
- 3 Service description (Exchange Online) learn.microsoft.com Checked 5 Nov 2026 Details →
- 4 Service description (limits) learn.microsoft.com Checked 5 Nov 2026 Details →
- 5 Product documentation (migration) learn.microsoft.com Checked 5 Nov 2026 Details →
- 6 Product documentation (retention) learn.microsoft.com Checked 5 Nov 2026 Details →
- 7 API documentation learn.microsoft.com Checked 5 Nov 2026 Details →
- 8 EU Data Boundary documentation learn.microsoft.com Checked 5 Nov 2026 Details →
- 9 Mail, domains & deliverability — found from sitemap developer.microsoft.com Checked 5 Nov 2026 Details →
- 10 Calendar, contacts & office apps — found from sitemap developer.microsoft.com Checked 5 Nov 2026 Details →
- 11 Administration, identity & partner management — found from sitemap developer.microsoft.com Checked 5 Nov 2026 Details →
- 12 Administration, identity & partner management — found from sitemap developer.microsoft.com Checked 5 Nov 2026 Details →