The Subscription Nobody Looked at Closely

How a Microsoft 365 License Review Uncovered a Compliance Time Bomb — and a Path Forward A GDS Technology Case Study | Licensing Strategy & Compliance Industry: Commercial Real Estate | Services: M365 Licensing Audit, Security Architecture, Compliance Advisory

Paying for Software Is Not the Same as Being Protected by It

Most organizations assume that if they're paying for Microsoft 365, they have what they need. They pay the bill, people can use Outlook and Teams, and that's considered "covered." The problem is what's missing — and most organizations don't find out until something goes wrong.

Following a cybersecurity incident that GDS Technology investigated and remediated, a multi-state commercial real estate and professional services organization asked GDS to conduct a full review of their Microsoft 365 environment. The question they needed answered: what would it actually take to make sure this doesn't happen again?

The answer started with understanding what they actually had.

What We Found

The organization's Microsoft 365 environment had grown organically over several years. At the time of the review, it included a large number of active subscriptions across a distributed user base — a fragmented mix of licensing tiers, add-on products, and legacy holdovers that had accumulated without a coherent security strategy underneath them.

The core license was Microsoft 365 Business Standard — a solid productivity platform that covers email, Office apps, Teams, and SharePoint. What it does not include is the security stack that modern organizations need: advanced email filtering, identity risk protection, comprehensive audit logs, endpoint management, or phishing-resistant authentication.

After the incident, we knew exactly which gaps in that stack the attacker had used. The question now was whether the organization could see those gaps before the next one.

They couldn't.

The Compliance Dimension

The organization operates across multiple states. Each of those states has its own breach notification law — different thresholds, different timelines, different notification requirements, different penalties for non-compliance.

The incident investigation had already identified that the organization's audit licensing did not support complete reconstruction of what data was accessed during the compromise window. That finding has a direct regulatory consequence: without a defensible evidence record establishing what was accessed and what was not, an organization must notify under the most conservative possible interpretation across all 12 jurisdictions simultaneously.

In practical terms: the cost of that notification — legal review, credit monitoring obligations, multi-state AG filings, reputational management — significantly exceeded the cost of the licensing upgrade that would have prevented the gap in the first place.

GDS built a full state-by-state breach notification matrix documenting each jurisdiction's requirements, exposure window, and notification obligations — giving the client's outside counsel a defensible framework to evaluate their options.

Dozens	Multi-State	Fragmented	3
Subscriptions reviewed and rationalized	Breach notification exposure at time of review	Starting licensing posture — no unified security layer	Structured options presented with full cost comparison

The Options

GDS presented the organization with three structured options — not a recommendation in search of a justification, but a genuine analysis of what each tier delivered and what it left exposed:

Option C — Targeted Add-Ons (Lowest Cost)

Add individual security add-ons to the existing Business Standard foundation. Covers the most critical immediate gaps at the lowest monthly cost. Leaves long-term complexity from managing multiple SKUs with different renewal dates.

Option A — Business Premium + Add-Ons

Move to Microsoft 365 Business Premium — the security-enhanced mid-tier — and layer targeted add-ons for the remaining gaps. Better integrated security posture, reasonable cost, but still requires managing supplemental SKUs.

Option B — Microsoft 365 E5 (Recommended)

Full Microsoft 365 E5 deployment. Addresses all three failure points identified in the incident — email security (Defender for Office 365 Plan 2), identity protection (Entra ID P2), and audit visibility (Purview Advanced Audit) — through a single integrated platform. Eliminates the subscription fragmentation entirely and provides the most defensible compliance posture.

E5 was recommended because it is the only option that closes all three gaps simultaneously, eliminates the audit reconstruction problem for future incidents, and provides the identity risk protection that stops token theft attacks at the sign-in layer rather than after the fact.

The Implementation Plan

GDS produced a phased implementation roadmap covering the transition from the existing fragmented environment to the E5 baseline — organized to avoid productivity disruption, sequence security controls in order of risk reduction priority, and establish clear milestones for ownership review.

The plan also addressed two adjacent capabilities the organization had interest in: Microsoft Copilot (AI assistant for M365 apps, available as a separate add-on) and Teams Premium — both of which were documented as optional additions that could be layered on the E5 foundation at the organization's discretion.

The existing subscription landscape was mapped to a dramatically simplified target state — fewer SKUs, reduced administrative overhead, no more renewal date fragmentation, and a single coherent licensing structure that IT and finance could both understand.

The Real Question This Case Asks

Most Microsoft 365 subscriptions were never designed as a security strategy. They were purchased to get people into email and collaboration tools, and the security layer was either never added or was added piecemeal without a coherent plan underneath it.

The question isn't whether your organization is paying for Microsoft 365. The question is whether what you're paying for actually protects you — and whether you'd know the difference before something goes wrong.

GDS Technology conducts Microsoft 365 licensing and security assessments that answer that question directly: what do you have, what does it leave exposed, what does it cost to fix it, and what does it cost not to.

"Your Microsoft license is not your security plan. For most organizations, there's a meaningful gap between the two — and it's exactly the gap an attacker will find first."

— Jonathan Fitzgerald, Managing Partner, GDS Technology

Industry	Commercial Real Estate / Professional Services
Client Type	Multi-state organization with distributed user base and multi-jurisdiction regulatory exposure
Services	M365 Licensing Audit, Security Gap Analysis, Compliance Advisory, Implementation Planning
Starting Point	Fragmented subscription environment, Business Standard base, post-incident gaps identified
Recommended Outcome	Microsoft 365 E5 with phased deployment plan

Is your Microsoft 365 license a security strategy — or just an email bill? GDS Technology can tell you the difference. gdstech.tech | 404-719-5222