Microsoft 365 Licences by Role: Who Gets Which Plan

Quick answer: do not buy one Microsoft 365 plan for everyone just because it is easier to manage. Assign plans by job role: people who only need email and Teams get Basic, people who use Word, Excel and Outlook all day get Standard, and people who approve payments, see customer data or work remotely on personal devices should be considered for Premium. Every plan needs MFA and a process to remove access when someone leaves.

This post does not repeat the feature table for the three plans; that is in the Business Basic vs Standard vs Premium comparison. Here we answer the second question most companies face once they understand the plans: in a team of 10, 25 or 60 people, who should get which plan, and how do you keep that list correct over time?

Why assign plans by role?

There are three practical reasons, and none needs a statistic:

1. Cost. If some staff only need email and Teams, giving them a plan with desktop Office means paying for software they never open. Giving the lowest plan to your accountant means they will find a workaround to run Excel macros.
2. Risk. Not every account is equally valuable. Finance, director and admin accounts are the targets of payment-fraud and mailbox-takeover attempts, so they deserve stronger protection than the average.
3. Administration. When each plan is tied to a role, adding a new hire or removing a leaver becomes a rule-based task instead of a judgement call each time.

One point to confirm with your supplier first: Microsoft allows different plans for different users in one organisation, but purchase terms, billing periods and how a plan change is charged depend on how you buy (directly or through a partner, monthly or annually). Get this in the quote.

Role-to-plan table

Use this as a starting point, not a fixed rule. Adjust it to your own data and requirements.

Role	Typical needs	Suggested plan	Reason
Director, owner	Email, approvals, sensitive data, often personal devices	Premium	High-value account, often impersonated
Accounting, finance	Heavy Excel, payment emails, banking systems	Standard or Premium	Needs desktop Office; frequent target
HR	Employee records, contracts	Standard, consider Premium	Sensitive personal data
Office and admin staff	Word, Excel, Outlook daily	Standard	Needs installed apps
Sales and customer service	Email, quotes, Teams, often mobile	Standard	Many devices, needs Outlook sync
Reception, warehouse, shared-PC staff	Email and Teams, little document work	Basic	Light needs, mostly web
Temporary staff, interns	Email and Teams for a short period	Basic	Easy to issue and revoke
IT administrator	Manages the tenant, devices and security	Separate admin account	See Admin accounts below

Two rules help when using the table. First, choose by Office need and data risk, not by job title: an admin assistant who handles HR files may need stronger protection than a department head who rarely touches sensitive data. Second, write down the reason for each choice, so the person who takes over later understands why A has Premium and B has Basic.

Example split for a 25-person company (illustration only)

This shows how to think about it. It is not a quote and not a recommendation for every company:

Group	People	Plan	Note
Directors and accounting	5	Premium	Financial data, payment approvals
Office and sales staff	14	Standard	Daily Office use
Reception, warehouse, shared PCs	6	Basic	Mostly email and Teams

Once you have a real quote, multiply each group's headcount by the price per user per year for its plan (Vietify's list price is per year; confirm whether VAT is included), then add them up. Current list prices are on the Business Basic, Business Standard and Business Premium pages.

Admin accounts: keep them separate from daily email

A common mistake in small companies is that the person in charge of IT, or the owner, uses a Global Admin account to read email every day. If that account is phished or its session is stolen, the attacker immediately has the highest level of control over the whole organisation.

Simple rules to adopt:

• Separate accounts: each admin has a normal account for daily work and a distinct admin account used only for configuration.
• Keep Global Admins few: only as many as truly needed, and record who holds the role.
• One emergency (break-glass) account: a backup admin account with a long password stored safely outside the system, for when other accounts are locked out. Have the person deploying it show you the right setup, because a wrong configuration can lock you out.
• MFA on every admin account, with no exceptions.

Centralised controls such as Conditional Access come with Premium, but the rules above do not depend on the plan and cost nothing extra.

The licence lifecycle: join, move, leave

The biggest waste with Microsoft 365 is usually not choosing the wrong plan on day one. It is that nobody removes the licence when a person's situation changes. Treat a licence as an asset with an owner and a life cycle.

When someone joins

1. The manager confirms the role and the Office and data needs.
2. IT assigns the plan from the role table, creates the account and turns on MFA at first sign-in.
3. Record the name, role, plan, date issued and approver.

When someone changes role

Moving from reception to accounting is the easiest moment to forget. Require every role change to include a review of the plan and the data access. If you upgrade, ask your supplier how the price difference is charged; if you downgrade, check whether the person still holds data that needs handing over.

When someone leaves

This is the most important step for both cost and safety:

1. Block sign-in on the last working day, before deleting anything.
2. Transfer data: email, OneDrive files and key documents go to the successor or manager.
3. Forward the mailbox if needed so customer emails are not missed.
4. Reclaim the licence only after the hand-over is done, so you stop paying for an unused account.
5. Recover devices and wipe company data from personal phones where device management is set up.
6. Record the date it was done, as evidence if needed.

Do not delete the account on the day someone leaves before the data is moved; that can destroy email and files the company needs to keep.

A 30-minute quarterly licence review

A short, regular review works better than a big audit every few years. Each quarter, the owner does four things:

1. Export the list of licensed users from the Microsoft 365 admin centre.
2. Compare it with current HR records. Accounts of people who have left are the first to reclaim.
3. Find inactive accounts: licensed users who have not signed in for months. Ask the manager before reclaiming, because the person may be on long leave.
4. Check each plan still fits the role. If a Standard user has never opened an installed Office app, consider moving them to Basic.

Save the result in a shared file so next quarter you can compare. If the company has many products beyond Microsoft 365, tracking them in one place saves effort; see IT asset and licence management.

Pilot before changing the whole company

Do not change everyone's plan in one day. A small pilot finds problems more cheaply:

1. Pick 3 to 5 pilot users across the main roles (an accountant, an office user, someone who travels, a receptionist).
2. Assign the intended plan and let them work normally for one to two weeks.
3. Check the usual trouble spots: Outlook sync, Office activation on the PC, Teams, OneDrive, phone sign-in.
4. Collect feedback and adjust the role table.
5. Roll out in groups, one at a time, with a short guide for users.

This matters most if you are moving from unlicensed Office to a licensed product. Before you switch, check the Office you already have so you know which PCs need attention.

Five common mistakes when assigning plans

1. Choosing only on the lowest price. If a person needs desktop Office but only has Basic, they will find another way, including installing unlicensed Office, and the company is still in breach. The total cost rarely ends up lower.
2. Giving everyone the top plan "to be safe". It is safe on features but expensive, and many Premium security features only help when they are configured, not merely purchased.
3. Treating Premium as a substitute for other controls. Premium does not replace data backup, staff phishing awareness or a payment-verification process. See Microsoft 365 does not back up your data.
4. Keeping licences for people who left. It is wasted spend and a forgotten account that can become an attacker's way in.
5. Having no owner. Without a named owner, the licence list goes stale within months. Appoint one person and a backup.

Frequently asked questions

Do I have to assign plans by role?

No. In a very small company (under about 5 people) with similar needs, one shared plan can be simpler. Role-based assignment pays off when needs and risk differ clearly between groups.

Do Basic users need MFA?

Yes. MFA is needed on every business email account, whatever the plan. It is the cheapest and most effective single control. See MFA and passkeys for small business.

Does changing a person's plan lose their data?

In general mailbox and file data are kept when moving between Business plans, but the exact process and charging depend on your purchase terms. Test on one account first and ask your supplier.

What plan should shared reception or warehouse PCs have?

Usually Basic if they only use email, Teams and Office on the web. If several people share one account on one PC, consider giving each person their own account so access can be controlled and traced instead of sharing a password.

Do temporary staff need their own licence?

They need their own account if they access company email or data, and it should be removed as soon as the contract ends. Put an end date in the licence list so it is not missed.

How often should licences be reviewed?

Quarterly suits most small and mid-sized companies, plus a review after any large hiring round or reduction.

How do I work out the total Microsoft 365 budget?

Multiply the number of people in each group by the price per user per year of that plan, add them up, then add VAT. Ask the supplier to state the billing period, the commitment term and the rules for adding or removing users mid-term.

Next step

To get a role table based on your real headcount and roles, request a free IT assessment. An engineer will review your email, devices and access and propose a plan split and a licence-removal process. You can also see the Microsoft 365 deployment service or contact Vietify for a quote that states the unit, term and VAT. For the feature comparison itself, read Microsoft 365 Business Basic vs Standard vs Premium.

Vietify IT Services — Microsoft 365 advice and deployment for small and mid-sized businesses in Da Nang. Updated: 14 October 2026.