Support Microsoft 365 Business Premium tenants in Monkey365 findings

[Schurik97]

Monkey365’s analytics baseline currently assumes an E3/E5 license footprint. When a tenant operates solely on Business Premium subscriptions, the scanner flags “missing feature” alerts that are not actionable. First-class Business Premium support will eliminate this noise and improve report fidelity.

Problem Statement

• False positives – Controls dependent on E5-exclusive capabilities (Defender for Office P2, Purview DLP, MCAS, etc.) are reported as gaps, even though they’re out of scope.
• Operational overhead – Security teams waste cycles triaging findings that cannot be remediated.
• Customer confidence – License-mismatch alarms erode trust and hinder adoption among SMB customers.

Proposed Enhancement

1. SKU-aware rule sets

   • Add a configuration flag (E5, E3, BusinessPremium) consumable via CLI/JSON.
   • Dynamically load or skip checks based on the selected SKU.

2. Automatic SKU detection (optional)

   • Query Graph /subscribedSkus at runtime to infer the dominant license and apply the appropriate rule set.

3. Reporting updates

   • Display detected SKU in the executive summary.
   • Clearly tag any residual findings that remain license-dependent.

Acceptance Criteria

ID	Condition	Success Metric
AC-1	Scan against a tenant licensed only with Business Premium	Zero “E5/E3-only feature missing” alerts
AC-2	Regression test E3/E5 paths	Existing findings remain unchanged
AC-3	Documentation & CLI help updated	Users can configure the new flag in ≤ 2 steps

Business Value

Business Premium awareness broadens Monkey365’s addressable market, reduces false-positive churn for SMB customers, and aligns the toolset with real-world licensing patterns.

Additional Context

Early telemetry indicates ~35 % of Monkey365 users operate on Business Premium. Feedback highlights license-mismatch noise as the primary barrier to wider rollout.

Thank you for considering this enhancement. We’re happy to collaborate on design or provide tenant samples for testing.

[silverhack]

Hi @Schurik97, thanks for using Monkey365.

Just to clarify how Monkey365 works. Some rules are executed conditionally depending on the tenant's license. Apart from those checks, Monkey365 does not assume an E3, E5 Business Premium, P1, P2, or any other specific license, and it does not enforcing any license‑based expectations by default.

To understand the situation better, I'll need more information, such as which rules are generating false positives, or which rules are being flagged incorrectly, or whether you're seeing false positives, false negatives, or any unexpected behaviour. With that information I will be able to reproduce the issue and determine whether it's a bug or something else.

Also, I have to admit that your line Early telemetry indicates ~35% of Monkey365 users operate on Business Premium made me smile. I’m curious about how you arrived at that percentage, considering that Monkey365 doesn't include any telemetry at all. If you've got a secret analytics tool, I’d love to hear about it! :D

Finally, I’m more than happy to test this on a dedicated tenant you can provide. Thanks!

[Schurik97]

Hi @tony,

thanks again for the clarification around conditional rule execution.

First of all, apologies for the earlier wording around “telemetry.” That was a miscommunication on my side and not meant to imply that Monkey365 includes any tracking or analytics component. It was more meant data that we have collected so far.

---

Scope of the issue

The behaviour we’re observing primarily affects E5 and Entra ID P2–related controls, especially those tied to risk-based and advanced security configurations.

In tenants licensed exclusively with Microsoft 365 Business Premium, findings are raised in areas such as:

• Risk-based Conditional Access policies
• User risk / sign-in risk policies
• Automated risk remediation settings
• Identity Protection configuration
• Advanced Defender capabilities
• Advanced compliance / Purview controls

Based on Microsoft’s licensing documentation and our validation against Business Premium tenants, these capabilities typically require:

• Entra ID P2, or
• Microsoft 365 E5 (Security / Compliance) add-ons

We have revalidated the affected controls against current Microsoft licensing matrices to ensure that these features are indeed outside the Business Premium entitlement.

---

Observed Impact

When these findings are triggered in a Business Premium–only tenant:

• The configuration surface for the control does not exist, or
• The feature cannot be activated without an upgraded license

However, the report classifies them as standard security gaps rather than license-bound limitations. This creates the perception of misconfiguration instead of missing entitlement.

---

Classification of the behaviour

From our perspective, this may be one of the following:

1. License-context false positives – rules execute although prerequisite capabilities (E5 / Entra ID P2) are not present.
2. Missing license annotation – rules execute intentionally but lack explicit indication that they require a higher-tier SKU.

In both cases, Business Premium customers are presented with findings that are not technically remediable within their current contract scope.

---

Reproduction approach

1. Use a tenant with Business Premium only (no Entra ID P2, no E5 Security/Compliance add-ons).
2. Execute a full O365 / Entra workload scan.
3. Review findings referencing:
   • Identity Protection
   • Risk-based Conditional Access
   • Advanced Defender / compliance controls

---

Desired outcome

From a reporting-quality and governance standpoint, one of the following would address the issue:

• Conditional suppression of rules requiring Entra ID P2 / E5,
• Automatic SKU detection with rule scoping, or
• Explicit tagging in the report (e.g. “Requires Entra ID P2 / E5”) to avoid misinterpretation.

The objective is not to reduce coverage, but to strengthen signal integrity and ensure findings reflect actual misconfiguration rather than license constraints.

Thanks again for the collaboration — happy to provide the exact rule IDs in a follow-up so we can analyse them case by case.

Best regards,
Schurik97

[silverhack]

Hi @Schurik97, now I understand. You're getting those false positives because the default ruleset for Microsoft 365 is the CIS Microsoft 365 Foundations 5.0, which was designed for E3/E5 environments.

You have two options. The first one would be to disable rules that target E3/E5 environments. The second one would be to create your own ruleset tailored to your specific environment.

I was initially confused since the whole issue looked 100% AI‑generated, including some hallucinated sentences (Who is Tony? xP).

Next time, I’d recommend going through the Monkey365 docs first and try to be as precise as possible.

Thanks for using Monkey365