M365 Business Premium has been the right SKU for most Australian SMBs for several years now, and the gap between what it includes and what most tenants actually use is widening. Per-user it includes the Office apps, Exchange and SharePoint as expected — but also Intune for device management, Defender for Business for endpoint protection, Conditional Access for identity-based policy, and Azure Information Protection for sensitivity labels.
The practical effect is that most SMBs are already paying for the core of a credible security baseline. They just haven't configured it. Enrolling devices in Intune, setting Conditional Access policies that require compliant devices, enabling Defender for Business protection profiles, turning on auto-labelling for sensitive content — none of this requires a new licence purchase. It requires the time of someone who knows where the settings are.
For any business already on Business Premium, a configuration audit pays for itself fast. You're paying for the platform. The question is whether it's earning its keep.