What Changed in Microsoft 365 Nonprofit Licensing and When It Reaches You

Microsoft's nonprofit program now has one free tier and one discounted tier. The Business Basic grant provides up to 300 licenses at no cost to eligible organizations. The Business Premium nonprofit discount cuts the commercial price by 75 percent, and Microsoft also offers nonprofit discounts on Business Standard, Office 365 E1, and the enterprise plans, though the small-organization decision almost always comes down to Basic versus Premium.

The discontinued grants did not vanish on a single date. Each organization's Business Premium or E1 grant licenses expired at its next renewal on or after July 1, 2025, so an organization that renewed in June 2025 kept its free Premium seats until June 2026, while one that renewed in August 2025 lost them that month. That is why the change felt sudden to organizations that had never heard about it: the announcement was a year before the impact.

A second change arrived on July 1, 2026, when Microsoft's commercial price update took effect. Business Basic moved from $6 to $7 per user per month and Business Standard from $12.50 to $14, while Business Premium stayed at $22. Nonprofit discounts apply to the updated base prices, so the free Basic grant was unaffected and discounted Premium remains at $5.50 because its list price did not move. The same update added 50 GB of mailbox storage to the business plans and a time-of-click link check to Basic and Standard, rolling out to tenants through August 1, 2026. Our comparison of the Microsoft 365 business plans covers the commercial pricing and the renewal rule that decides when increases reach an invoice.

Who Is Eligible for the Grant Versus the Discount

The eligibility rules are stricter than most organizations realize, and they matter during a transition because the grant and the discount cover different people. Microsoft permits granted licenses only for paid nonprofit employees and for unpaid executive staff who act as the organization's leadership. Discounted licenses may be used by staff and by volunteers. Program participants, members, and donors are not eligible for either, and volunteers who only need occasional access can be invited as external guests using a personal Microsoft account rather than consuming a license at all.

Eligibility itself is validated by Microsoft's third-party supplier against its published criteria, and an organization that has not completed that validation cannot buy the discounted Premium SKU no matter how many free Basic seats it holds. The validation is worth confirming before the renewal date arrives, not after.

The Renewal Trap

Microsoft's own guidance warns that the expiring grant licenses will not renew and that users must be moved to Business Basic or another nonprofit offer before the old subscription is canceled, and the transition has to be completed manually in the admin center. An organization that lets the Premium grant lapse without reassigning licenses finds its users locked out of email and OneDrive at renewal, which is the outage that sent many administrators searching for answers in early 2026.

The data is not lost immediately, because Microsoft's subscription expiration process provides a period during which access continues, followed by a period during which administrators can still retrieve data before it is deleted. But the recovery path is slow and stressful, and it is entirely avoidable by reassigning licenses before the date rather than after, which is a short task for outside Microsoft 365 support and a long one for a volunteer learning the admin center on renewal day.

What Business Basic Includes and What It Leaves Out

Business Basic is a capable productivity plan, and for a large share of nonprofit staff it is the right license. It includes business email with a mailbox that the 2026 packaging update grew from 50 GB to 100 GB, Teams, 1 TB of OneDrive per user, SharePoint, the web and mobile versions of Word, Excel, PowerPoint, and Outlook, a time-of-click link check added in the same update, and Microsoft's baseline identity protection. What it does not include is everything that made the old Premium grant a security program in disguise.

The two plans share a solid core. Both include business email, Teams, 1 TB of OneDrive per user, SharePoint, and Copilot Chat, and both enforce multi-factor authentication, though Basic does it through security defaults while Premium does it through Conditional Access policies. Basic also received a lighter time-of-click link check in the 2026 packaging update, which is worth having but is not the same as full phishing protection.

Everything that made the old grant a security program sits on the Premium side only. Premium adds the desktop Office applications, Conditional Access through the Entra ID P1 license, Intune device management, Defender for Business endpoint detection and response, Defender for Office 365 Plan 1 with Safe Links and Safe Attachments, sensitivity labels with encryption and data loss prevention, Exchange Online Archiving, and Windows Autopilot device provisioning. None of those eight capabilities is available on the free Basic grant, and the next four sections explain what losing each of the important ones means for a small nonprofit.

Intune: The Tool That Managed the Laptops

Intune is the device management service that let an organization require a passcode on every phone, enforce disk encryption on every laptop, push applications and updates, confirm that a device was compliant before it could open email, and wipe a lost device remotely. Under the old grant, many nonprofits had all of that configured by whichever volunteer or consultant set up the tenant, and it ran silently for years.

Without Intune, none of it runs. A Business Basic tenant has no way to know whether a staff laptop is encrypted, whether a board member's phone has a passcode, or whether a departed employee's device still holds the donor database export, and no way to wipe it if it does. For an organization whose staff work from personal devices, which describes most small nonprofits, this is the single largest loss in the downgrade.

Defender for Business: The Endpoint Protection That Went Away

Defender for Business is endpoint detection and response, the class of protection that watches device behavior for signs of an attack in progress, isolates a compromised machine, and gives someone a console to investigate. It is different from the free Defender Antivirus built into Windows, which still runs on a Business Basic organization's computers but reports to nobody and cannot coordinate a response across devices. A ransomware intrusion on a downgraded tenant proceeds with no central alarm.

Insurance underwriters have noticed. Endpoint detection and response is now a standard question on cyber insurance applications, and an organization that answers no may face higher premiums or a declined policy. Our guide to Microsoft 365 Defender explains what each Defender component actually protects, which helps an organization decide which users need it.

Conditional Access: Who Can Sign In From Where

Security defaults, which Business Basic includes, require multi-factor authentication for everyone and block some legacy sign-in methods, and for a small organization that is a meaningful baseline. Conditional Access, which comes with the Entra ID P1 license inside Business Premium, is the policy engine underneath: it can require a compliant device to open finance data, block sign-ins from countries the organization never works in, demand a stronger factor for administrators, and respond to risky sign-in patterns. A downgraded tenant keeps the blunt version and loses the precise one.

The practical consequence shows up in the controls an organization can promise to a funder or an insurer. "Everyone has MFA" is still true on Basic. "Only managed, encrypted devices can reach our donor records" is not, and that is increasingly the sentence grant compliance reviews want to hear.

Archiving, Advanced Phishing Protection, and the Desktop Apps

Three smaller losses add up. Exchange Online Archiving gave each mailbox an archive with its own storage and the retention tooling that keeps records for the years a funder or a regulator requires, and without it the primary mailbox is the whole story, even at the 100 GB size the 2026 update brought. Defender for Office 365 Plan 1 supplied Safe Links and Safe Attachments, the layer that detonates suspicious files and rewrites malicious links before a development director clicks them; the 2026 update gave Basic a lighter time-of-click link check, but not the attachment detonation or the impersonation policies that stop the targeted phishing nonprofits actually receive. The desktop Office applications matter less for security and more for the finance and grants staff who live in complex spreadsheets that the web version handles poorly.

What Losing These Tools Means for a Nonprofit's Actual Risk

A nonprofit's data is often more sensitive than a comparable for-profit's: donor financial details, beneficiary records that may include health, immigration, or domestic violence history, employee and volunteer personal information, and grant documentation with compliance strings attached. Our guide to nonprofit technology on a tight budget covers that data picture in depth; the point here is that the downgrade removed protection from exactly the records that make a nonprofit breach so damaging to the trust relationship that funds the mission.

The risk is also contractual. Government and foundation grants increasingly attach data security requirements to funding, cyber insurance applications ask about device management and endpoint detection by name, and a nonprofit handling health information carries HIPAA obligations that assume encryption and access controls exist. An organization that could honestly check those boxes in 2024 may be unable to check them in 2026, and the change happened because of a licensing decision rather than a security one.

Insurance is the place this surfaces first. The questions carriers now ask mirror the Premium feature list almost exactly, and our overview of cyber insurance for small businesses explains why underwriters treat those controls as conditions of coverage rather than preferences.

Who Should Be on Premium and Who Can Stay on Basic

The organizations that handled the change well did not choose between all-Basic and all-Premium. They licensed by role, and the arithmetic is forgiving. At $5.50 per user per month, a Premium seat costs $66 per year, so an organization of forty people that puts twelve of them on Premium and keeps twenty-eight on the free Basic grant spends $792 a year to restore the security layer where it matters.

The roles that belong on Premium are the ones whose accounts and devices would hurt most if compromised: the executive director, finance and bookkeeping staff, anyone who administers payroll or HR, development staff with access to the donor database, program managers handling beneficiary records, and every administrator of the tenant itself. Front-desk roles, part-time program staff working from shared computers, and seasonal workers are usually fine on Basic, and volunteers who need only occasional access should be guests rather than licensed users.

Mixing Plans in One Tenant

Microsoft allows Basic and Premium licenses to coexist in one tenant, subject to the 300-seat cap across the business plan family. The detail that trips organizations is that the security features are licensed per user, not per tenant. Intune manages the devices of licensed users, Defender for Business protects the devices of licensed users, and Conditional Access policies may only be applied to users who hold an Entra ID P1 license. A policy scoped to "all users" in a mixed tenant is a licensing problem, so policies and device enrollment have to be scoped to the Premium group, which is a configuration task rather than a purchase.

Where a Basic user genuinely needs Conditional Access but nothing else from Premium, Entra ID P1 is available as a standalone license at nonprofit pricing, and it is sometimes the cheaper way to cover a handful of edge cases. The same logic applies to Intune as a standalone plan for an organization that needs device management broadly but desktop Office nowhere.

What a Properly Configured Premium Seat Requires

Buying Premium restores the entitlement, not the protection. The old grant tenants that were secure were secure because someone configured Intune compliance policies, enrolled the devices, turned on Defender for Business, built Conditional Access rules, and reviewed the alerts. An organization that downgraded and is now buying Premium back should expect the same configuration work, and the checklist in our guide to Microsoft 365 security settings is a reasonable picture of what "turned on" actually means.

How to Make the Transition Without Losing Data or Access

The sequence below is the one that avoids both the renewal outage and the silent loss of security. Done in order, it takes a few hours of administrative work rather than a weekend of recovery:

1. Find the renewal date of every nonprofit subscription in the admin center and note which ones are expiring grants.
2. Confirm the organization's nonprofit eligibility validation is current, because the discounted Premium SKU cannot be purchased without it.
3. Inventory every licensed user, the role each one holds, the data each one touches, and whether each one has an organization-managed device.
4. Decide the Premium roster by role, and decide whether any Basic users need a standalone Entra ID P1 or Intune license instead.
5. Purchase the Business Premium nonprofit licenses and the Business Basic grant licenses before the expiring subscription's renewal date.
6. Reassign each user's license from the expiring subscription to the new one, user by user, and confirm that mailboxes, OneDrive, and Intune enrollment remain intact.
7. Scope Conditional Access policies, Intune compliance policies, and Defender for Business onboarding to the Premium group so the mixed tenant stays within its licensing.
8. Cancel the expired grant subscription only after every user has been moved, and keep a dated record of the change for the next audit, funder review, or insurance application.

Organizations that lack an administrator comfortable with license reassignment should not attempt step six alone on the renewal date. A short outside engagement for a transition like this costs far less than the recovery work after a lockout, and it leaves the organization with documentation it will need again at the next renewal.

What This Looks Like for a Los Angeles Nonprofit

Los Angeles has an unusually dense nonprofit sector, from community health clinics and legal aid organizations to arts groups and faith-based service providers, and a large share of them built their technology on the old grant during the pandemic. Many have boards asking about cybersecurity for the first time, funders adding security language to grant agreements, and a single staff member or volunteer acting as the entire IT function. The licensing change arrived in the middle of that, and it is the situation our overview of IT and cybersecurity for nonprofits is written for.

GlobeVM works with nonprofits in the Woodland Hills area and across the region on exactly this transition: the license inventory, the role-based roster, the reassignment on the renewal date, and the configuration that makes a Premium seat actually protect something. That work fits naturally with the grant compliance, donor data, and volunteer access questions a board is likely to raise, because the same controls answer all three.

Cost is usually the first objection and the easiest to answer. For most organizations under fifty people, the full security layer restored for the roles that need it costs less per year than one fundraising dinner's catering. That comparison tends to move a board from "we cannot afford Premium" to "we cannot afford to be the organization that lost its donor list." Local organizations looking for help with the rest of their environment can start with our managed IT support in Los Angeles page.

License by Role, Configure What You Buy, and Document the Change

The end of the Business Premium grant was a budget change that many nonprofits experienced as a security change without realizing it, and Microsoft 365 nonprofit licensing now rewards the organizations that think in roles rather than in tiers. The free Business Basic grant remains generous and is the right license for a large share of staff, but the organization's executive, finance, development, and administrative roles need the device management, endpoint detection, Conditional Access, and archiving that only Premium provides, and at $66 per seat per year the cost of restoring it is small.

License by role, scope the security policies to the people who hold the license, configure what you buy, and write the whole thing down for the next funder or insurer who asks. If your organization moved everyone to Business Basic at renewal and has not looked at the security settings since, a short licensing and configuration review with GlobeVM will show you what was lost and what it costs to put back.