# Microsoft 365 Business — Business Email & Office Suites

Microsoft 365 Business by Microsoft Corporation holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Microsoft Corporation (https://www.microsoft.com/de-de/microsoft-365/business)
- Category: [Business Email & Office Suites](https://whats-best.ai/software/business-email.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-email/microsoft-365-business
- Alternatives: https://whats-best.ai/software/business-email/microsoft-365-business/alternatives ([markdown](https://whats-best.ai/software/business-email/microsoft-365-business/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Microsoft Corporation
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 5 Nov 2026

## The panel's verdict

Microsoft 365 Business is a hosted Exchange Online suite bundled with Word, Excel, PowerPoint, Outlook, Teams and 1 TB of OneDrive per user. It scores strongest on calendar and office, 7 to 8; mail and deliverability sits at 7, its per-plan limits and quarantine documented while we found no public information on SPF, DKIM, DMARC, MTA-STS or custom-domain DNS set-up. Security and compliance, 6 to 7, documents retention deeply, but we found no public information on certifications with their scope. Sovereignty is the low point at 4 to 5: the EU Data Boundary names fifteen datacentre countries for tenants signing up in the EU or EFTA, yet the pages state that customer data continues to be transferred outside the boundary in limited circumstances, the vendor is a US corporation, and we found no public information on subprocessors, a data processing agreement or a contracting entity. The widest spread, migration and portability at 6 to 8, weighs documented entry paths against a thinner exit. Pricing transparency scored 5 to 6 on three published per-user tiers, with annual billing only shown.

**Speaks for it:**
- Cutover, staged, hybrid and express migrations from Exchange, IMAP from Gmail (mail folders only), and PST import by network upload or drive shipping are documented, with FastTrack and partner help.
- Retention policies and legal holds are documented in depth, with up to 1,800 policies per tenant, 50 holds per mailbox, proof of disposition for up to seven years and archive mailboxes growing to 1.5 TB.
- Storage and message limits are published per plan, from a 35 MB default message size configurable up to 150 MB and mailbox tiers from 2 GB to 100 GB.
- Shared mailboxes and conference rooms require no user subscription, with unlicensed shared mailboxes limited to 50 GB.
- Administration runs through the Microsoft 365 and Exchange admin centres, remote PowerShell and the Graph REST API with SDKs, integrated with Microsoft Entra ID conditional access.

**Held against it:**
- We found no public information on SPF, DKIM, DMARC, MTA-STS, custom-domain DNS set-up or the delivery reputation of the outbound infrastructure.
- We found no public information on certifications such as ISO 27001, BSI C5 or SOC 2 with their scope, enforced two-factor sign-in, encryption at rest or a transparency report on authority requests.
- Cancellation is documented to delete all associated data, and we found no public information on a data-return period or an organisation-wide export by an administrator.
- Business Standard and Premium prices appear only bundled with Copilot Business at 20,36 € and 27,73 €, and the captured pages show annual billing only.
- The EU Data Boundary pages state that customer data continues to be transferred outside the boundary in limited circumstances, and we found no public information on a subprocessor list, a data processing agreement or the contracting entity.

**Best for:**
- You want hosted Exchange mail together with Word, Excel, PowerPoint, Outlook, Teams and 1 TB of OneDrive per user in one per-user subscription.
- You are migrating off Exchange Server (2003 through 2013) or Gmail and want documented cutover, staged or hybrid paths plus FastTrack specialists.
- Your compliance work centres on retention and legal holds with stated limits and proof of disposition for up to seven years.

**Avoid if:**
- You require a European-controlled legal chain: the vendor is Microsoft Corporation of Redmond, Washington, and the EU Data Boundary pages themselves state that customer data continues to be transferred outside the boundary in limited circumstances.
- You must compute an exact annual cost before signing: the two higher tiers are published only bundled with Copilot Business, and the captured pages show annual billing only.
- You expect your mail data returned to you on leaving: the documented behaviour on cancellation is deletion of all associated data.
- You cannot accept a trial that converts automatically: the one-month trial requires a credit card and converts to a paid subscription, with a 7-day withdrawal right thereafter.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Small Firm Owner | The IT Administrator | The Public Sector IT Lead | The IT Service Provider | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Mail, domains & deliverability | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Calendar, contacts & office apps | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 | 4/5 | 4/5 |
| Security, encryption & compliance archiving | 3.5/5 | 3/5 | 3/5 | 3.5/5 | 3/5 | 3.5/5 |
| Administration, identity & partner management | 3/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | 3.5/5 |
| Migration, open standards & exit | 3.5/5 | 3.5/5 | 3/5 | 4/5 | 3.5/5 | 3.5/5 |
| European sovereignty | 2/5 | 2.5/5 | 2/5 | 2.5/5 | 2.5/5 | 2/5 |
| Pricing transparency | 3/5 | 3/5 | 3/5 | 2.5/5 | 3/5 | 3/5 |
| **Weighted verdict** | **3.5/5** | **3/5** | **3/5** | **3.5/5** | **3/5** | **3.5/5** |

### The judges

- **The Small Firm Owner** (v1.0): Runs a tax and accounting firm of twelve in Lower Saxony. Every member of staff lives in Outlook, the shared "kanzlei@" mailbox is the busiest address in the office, and the meeting room is booked by shouting across the corridor. Wants mail on the firm's own domain that arrives, a shared calendar and address book on every phone, a move from the old provider that does not lose a single client thread, and a per-user price that is still the price in the second year.
- **The IT Administrator** (v1.0): IT administrator at a machine builder in Baden-Württemberg with three hundred mailboxes, an on-premises Exchange that reaches end of support, and Active Directory as the source of every account. Wants Outlook to keep working without a plug-in nobody maintains, shared mailboxes and room booking, single sign-on and directory sync, mobile devices that can be wiped, an API for provisioning, and a migration that moves calendars and permissions, not only mail.
- **The Public Sector IT Lead** (v1.0): Head of IT at a district administration in Bavaria with eleven hundred staff, told by the council to leave Microsoft within three years. Has read what Schleswig-Holstein did and what it cost. Needs mail, calendars and documents that a whole administration can work in, open formats and open source where possible, BSI C5 or ISO 27001 on paper, a provider whose owners answer to European law only, and an exit plan before the contract is signed.
- **The IT Service Provider** (v1.0): Runs a six-person IT service company in Austria that looks after mail for forty client firms, from a two-person architect's office to a hotel group. Spends Mondays on mails that landed in spam and phones that stopped syncing. Wants one partner console for every client, DKIM and DMARC set up without a ticket, migrations it can run itself, support that answers within the hour, and margins it can calculate before it quotes.
- **The Data Protection Officer** (v1.0): Data protection officer for a group of nine medical practices in North Rhine-Westphalia, where a referral letter sent by mail is patient data under professional secrecy. Reads the subprocessor list and the transparency report before the feature page, asks who at the provider can open a mailbox and under which law, and wants encryption the practices can actually use with outside doctors, archiving that satisfies the tax office, and a data processing agreement that names every server.
- **The Skeptic** (v1.0): Has seen "hosted in Germany" from a provider whose spam filter and support desk sit in the United States, "Exchange-compatible" that meant IMAP with a calendar plug-in, and a first-year price of one euro that became seven. Asks which protocols Outlook really uses, whether the archive would survive a tax audit, what the certification actually covers — and how ten years of mail, calendars and contacts would leave.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Pseudonymized logs: yes [S8]
- Reidentification controls: yes [S8]

**Data**
- Deletion on cancellation: yes [S1]
- Log scrubbing: regular checks and scrubbing of system-generated logs [S8]
- Retention minimization: retention policies set at minimum retention time per log type [S8]

**Hosting**
- Countries: Austria · Belgium · Bulgaria · Croatia · Cyprus · Czechia · Denmark · Estonia · Finland · France · Germany · Greece · Hungary · Ireland · Italy · Latvia · Lithuania · Luxembourg · Malta · Netherlands · Poland · Portugal · Romania · Slovaki… [S8]
- Datacenter countries: Austria · Belgium · Denmark · Finland · France · Germany · Greece · Ireland · Italy · Netherlands · Norway · Poland · Spain · Sweden · Switzerland [S8]
- Multitenant datacenters: Microsoft datacenters · yes [S3]
- Service model: yes [S2]

**Integrations**
- API references: API reference available in Graph v1.0 and beta [S7]
- Appsource publishing: Office apps can be published to Microsoft AppSource [S10]
- Code samples: Single-page app · Web app · Web API · Desktop app · Mobile app · Background service, daemon, or script [S11]
- Msal: Microsoft Authentication Library (MSAL) for authentication integration [S11]
- Msal interoperability: yes · yes [S11]

**Pricing**
- Basic price: Microsoft 365 Business Basic · yes · annual with auto-renewal · 6.07 [S1]
- Cancellation refund: 7 · Microsoft 365 Admin Center [S1]
- Developer program free subscription: yes · yes [S12]
- F1 no mailbox: Microsoft 365 F1 does not include rights to an Exchange mailbox [S3]
- Free trial: yes · 1 · yes [S1]
- Premium copilot price: Microsoft 365 Business Premium und Microsoft 365 Copilot Business · yes · annual with auto-renewal · yes · 27.73 [S1]
- Shared mailboxes no subscription: Conference rooms and shared mailboxes do not require user subscriptions [S3]
- Standard copilot price: Microsoft 365 Business Standard und Microsoft 365 Copilot Business · yes · annual with auto-renewal · yes · 20.36 [S1]
- Subscription required per user: yes · yes [S3]
- Trial conditions: yes · yes · yes · yes [S1]

**Product**
- Abp limit: 250 [S4]
- Activesync device deletion limit: 20 [S4]
- Activesync device limit: 100 [S4]
- Activesync policies: yes [S3]
- Adaptive protection retention: preview · Adaptive Protection with Insider Risk Management · SharePoint · OneDrive · Exchange · 120 [S6]
- Add ins: yes [S2]
- Addin platforms: Windows · Mac · Android · iOS · web [S9]
- Addins dev kit: Visual Studio Code · Office Add-ins Development Kit · yes [S10]
- Addins js API: Office JavaScript API for building add-ins for Word, Excel, PowerPoint, and Outlook [S10]
- Address list limit: 1000 [S4]
- Administration tools: Administration via Microsoft 365 portal, admin center, Exchange admin center, remote Windows PowerShell [S3]
- Antispam antimalware all plans: Built-in anti-spam and anti-malware protection using multiple anti-malware engines, all plans [S3]
- App data storage: App data storable as Internet message headers; also schema extensions with custom properties, discoverable and shareable [S7]
- Archive mailbox quota standalone: 50 · 1.5 · no · 100 [S4]
- Archive mailbox unsupported: no [S7]
- Attachment content scanning: 1 MB [S4]
- Auto apply conditions: cloud attachments · sensitive information types · keywords/query · trainable classifier patterns [S6]
- Auto expanding archiving: 100 · 1.5 [S4]
- Azure arm configuration: configure Azure Resource Manager to the EU Data Boundary [S8]
- Azure regional services: Azure regional services deployed in EU Data Boundary regions are in-scope [S8]
- Bicep templates: yes [S12]
- Calendar: yes [S2]
- Capacity alerts prohibit send: 99 · 99 · 99 · 49.5 · 99 · 1.98 [S4]
- Capacity alerts prohibit send receive: 100 · 100 · 100 · 50 · 100 · 2 [S4]
- Capacity alerts warning: 98 · 98 · 98 · 49 · 98 · 1.96 [S4]
- Categories API: Apps can access and define master category list, shared across messages, events, contacts, tasks, group posts [S7]
- Change notifications: yes [S7]
- Change notifications event hubs: Solution pattern combining Graph Change Notifications with Azure Event Hubs [S12]
- Code samples: yes [S12]
- Community calls: Office developer community calls [S10]
- Conditional access: yes [S11]
- Conference room management: Conference room management and calendar sharing (Kiosk via OWA only) [S3]
- Content search label condition: yes [S6]
- Copilot chat web grounding: yes [S1]
- CRM integration: yes [S9]
- Current version: Subscription Edition ist die aktuelle Version [S2]
- Customer data definition: All data provided to Microsoft by or on behalf of Customer through use of the Online Service; excludes Professional Services Data and configuration information [S8]
- Cutover limit: 2000 · 150 [S5]
- Cutover supported versions: Exchange 2003 · Exchange 2007 · Exchange 2010 · Exchange 2013 · 2000 [S5]
- Data location assignment: Region selection sometimes direct, otherwise auto-assigned based on customer location, billing address, or customer decision [S8]
- Ddg limit: 3000 [S4]
- Definition: Geographically defined boundary for storing and processing Customer Data and personal data for Azure, Dynamics 365, Power Platform, and Microsoft 365 [S8]
- Deleted mailbox recovery: yes [S3]
- Description: identity management for employees and partners [S11]
- Distribution group members: 100000 [S4]
- Distribution group owners: 100 [S4]
- Distribution group send limit: 5000 [S4]
- Dlp condition: SharePoint documents · yes [S6]
- Doc last updated: 2025-02-26 [S8]
- Docs: Identity fundamentals · Authentication vs. authorization · Identity and access management [S11]
- Dynamics power platform requirements: tenant and all environments in EU/EFTA Macro Region Geography · billing address in an EU Data Boundary country [S8]
- Education storage limits: Storage allocations in Education tenants may be limited [S3]
- Embedded message depth limit: 30 [S4]
- Entra integration: Integrates fully with Microsoft Entra ID; administrators can use group policies to manage Exchange Online [S3]
- Event based activation: event-based activation for signatures across multiple Exchange accounts [S9]
- Ews deprecation: Microsoft Graph · 2027-04-01 · 2026-10-01 [S3]
- Express migration: yes [S5]
- Features overview: 1 [S1]
- Federated sharing: yes [S3]
- File attachments limit: 250 [S4]
- Flagging preview: yes · yes [S7]
- Fluent UI: Fluent UI - official front-end framework for Microsoft 365 experiences [S10]
- Focus: Exchange ist E-Mail- und Kalenderdienst für Unternehmen [S2]
- Focused inbox: yes [S2]
- Focused inbox mentions preview: yes · yes [S7]
- Folder hierarchy depth: 300 [S4]
- Forwardee limit: 10 [S4]
- Gal limit: 250 [S4]
- Governance: yes [S11]
- Graph explorer: Graph Explorer allows trying the API in browser without code [S12]
- Graph toolkit: Microsoft Graph Toolkit offers controls: login, people picker, person card [S12]
- Groups user can create: 300000 [S4]
- Hold limits: 50 · 25 · 1800 [S4]
- Hold tenant maximum: 10000 [S4]
- Hosted messaging: Exchange Online is a hosted messaging solution delivering email, calendar, contacts, and tasks from PCs, the web, and mobile devices [S3]
- Hybrid conditions: Exchange 2010 with more than 150-2,000 mailboxes · Exchange 2010 with small batches over time · Exchange 2013 or later [S5]
- Hybrid deployment: Hybrid deployment supported; IMAP, cutover, and staged migration supported [S3]
- Hybrid use case: maintains on-premises and online mailboxes, gradual migration [S5]
- Identity protection: yes [S11]
- Imap mailbox creation: no [S5]
- Imap scope: email folders · contacts · calendar items · tasks [S5]
- Imap sources: Gmail, Exchange, Outlook.com, other IMAP-enabled systems [S5]
- Immutable ids: yes [S7]
- Inbox rule quota: 256 KB [S4]
- Inbox rule redirect limit: 1 [S4]
- Interoperability: Skype for Business presence, SharePoint interoperability, EWS connectivity and SMTP relay support [S3]
- Item multi select: yes [S9]
- Javascript API: yes [S9]
- Journal rules limit: 300 [S4]
- Known issue inline images: known issue: delays loading inline images in email signatures in new Outlook for Windows and Outlook for the web [S9]
- Label application methods: manual · auto-apply policy · Microsoft Syntex model · default label · Outlook rules · Power Automate compliance action [S6]
- Label capabilities: yes · yes · yes · yes [S6]
- Label end of retention actions: yes · yes [S6]
- Labels no workloads: Exchange public folders · Skype · Teams · Viva Engage messages [S6]
- Labels travel with content: Microsoft 365 tenant · yes [S6]
- Large file attachments: yes [S7]
- Limit categories: limits grouped into categories including address book, capacity alerts, distribution group, ActiveSync, hold, journal/transport/inbox rule, mailbox folder, mailbox storage, message, moderation, receiving/sending, reporting and message trac… [S4]
- Limited transfers outside: yes [S8]
- Limits reference: Storage and recipient limits documented separately in Exchange Online limits [S3]
- M365 dev program subscription: 0 · yes · yes [S9]
- M365 multi geo exclusion: no [S8]
- M365 signup location scope: M365 tenants with EU/EFTA sign-up location are in scope [S8]
- Mail API change notifications: yes · yes [S12]
- Mail flow features: Custom outbound routing, secure partner messaging, conditional/hybrid email routing [S3]
- Mail tips: Mail tips API for recipient status during composing [S7]
- Mailbox import export: yes [S7]

**Support**
- Admin center management: Management of apps, services, data, devices and users via Microsoft Admin Center [S1]
- Code samples: Downloadable code samples [S10]
- Community: Stack Overflow · Microsoft Q&A [S11]
- Developer options: yes [S11]
- Docs: Office developer documentation [S10]
- Docs: yes [S2]
- Fasttrack: yes [S5]
- Message center: Feature and maintenance announcements via Message Center [S3]
- Partner support: Partner ecosystem support for setup, onboarding and deployment [S1]
- Qa forum: Microsoft Q&A forum for asking questions [S10]
- Resources: Bereitstellungs-Assistent für Exchange Server verfügbar [S2]
- Sales chat: Mo-Fr 9-17:00 · yes [S2]
- Sales phone: Mo-Fr 9-17:00 · (0)800 8088014 [S2]
- Training resources: Training on setup, security and optimal use of Microsoft 365 and Copilot Chat [S1]

86 more facts on the canonical page: https://whats-best.ai/software/business-email/microsoft-365-business

## Questions

### Is Microsoft 365 Business European?

No. whats-best.ai classifies Microsoft 365 Business as Rest of world.

### Where does Microsoft 365 Business store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does Microsoft 365 Business have a free plan?

Not stated on the vendor’s pages as of 5 Nov 2026.

### What are the best alternatives to Microsoft 365 Business?

As of 6 Nov 2026, the panel rates [grommunio (3.5/5)](https://whats-best.ai/software/business-email/grommunio), [Infomaniak kSuite (3.5/5)](https://whats-best.ai/software/business-email/infomaniak-ksuite) and [Nextcloud Hub (Groupware & Office) (3.5/5)](https://whats-best.ai/software/business-email/nextcloud-hub) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [grommunio](https://whats-best.ai/software/business-email/grommunio) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Microsoft 365 Business alternatives](https://whats-best.ai/software/business-email/microsoft-365-business/alternatives).

## Head-to-head

- [Microsoft 365 Business vs Google Workspace](https://whats-best.ai/compare/google-workspace-vs-microsoft-365-business.md)
- [Microsoft 365 Business vs Proton for Business](https://whats-best.ai/compare/microsoft-365-business-vs-proton-business.md)

## What this page leaves out

- 25 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage (Microsoft 365 Business): https://www.microsoft.com/de-de/microsoft-365/business (checked 2026-11-05)
- [S2] Features page (Exchange Online): https://www.microsoft.com/de-de/microsoft-365/exchange/email (checked 2026-11-05)
- [S3] Service description (Exchange Online): https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-service-description (checked 2026-11-05)
- [S4] Service description (limits): https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits (checked 2026-11-05)
- [S5] Product documentation (migration): https://learn.microsoft.com/en-us/exchange/mailbox-migration/mailbox-migration (checked 2026-11-05)
- [S6] Product documentation (retention): https://learn.microsoft.com/en-us/purview/retention (checked 2026-11-05)
- [S7] API documentation: https://learn.microsoft.com/en-us/graph/outlook-mail-concept-overview (checked 2026-11-05)
- [S8] EU Data Boundary documentation: https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn (checked 2026-11-05)
- [S9] Mail, domains & deliverability — found from sitemap: https://developer.microsoft.com/en-us/outlook (checked 2026-11-05)
- [S10] Calendar, contacts & office apps — found from sitemap: https://developer.microsoft.com/en-us/office (checked 2026-11-05)
- [S11] Administration, identity & partner management — found from sitemap: https://developer.microsoft.com/en-us/identity/entra-id (checked 2026-11-05)
- [S12] Administration, identity & partner management — found from sitemap: https://developer.microsoft.com/en-us/graph/rest-api (checked 2026-11-05)

---

Cite as: whats-best.ai, "Microsoft 365 Business — Business Email & Office Suites", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-email/microsoft-365-business

Corrections: https://whats-best.ai/correct/1556?target=page