Is your Small Business Getting Enough from Business Premium in 2026?
October 20, 2026
Business email compromise is accelerating, and threat actors are moving faster than most security teams can monitor. Host Nathan Taylor and Sourcepass Client Success Manager Tracy Harper break down the attack techniques driving the surge, including device code flow phishing and adversary-in-the-middle token theft, and explain how Microsoft 365 tenant hardening and identity threat detection and response (ITDR) close the after-hours gap. They also cover retiring on-premises Active Directory, modernizing legacy SMTP relays, and why Microsoft 365 Copilot Business is the smarter AI investment for organizations under 300 users.
Business email compromise is accelerating, and threat actors are moving faster than most security teams can monitor. Host Nathan Taylor and Sourcepass Client Success Manager Tracy Harper break down the attack techniques driving the surge, including device code flow phishing and adversary-in-the-middle token theft, and explain how Microsoft 365 tenant hardening and identity threat detection and response (ITDR) close the after-hours gap. They also cover retiring on-premises Active Directory, modernizing legacy SMTP relays, and why Microsoft 365 Copilot Business is the smarter AI investment for organizations under 300 users.
What You’ll Learn:
- Why device code flow phishing and token theft are fueling the rise in business email compromise
- Which Microsoft 365 tenant hardening controls stop the most phishing attacks
- How ITDR with Petra provides 24/7 mailbox monitoring and automated response
- How to retire on-premises Active Directory without breaking legacy dependencies
- How to modernize an SMTP relay to meet Microsoft's SPF, DKIM, and DMARC requirements
- Why Microsoft 365 Copilot Business delivers enterprise Copilot capabilities at roughly 30% less
About the Guest:
Tracy Harper is a Client Success Manager at Sourcepass, where she has spent the past five years advocating for clients and guiding them through technical and business challenges. Working daily with small and mid-sized organizations, Tracy sees firsthand the issues IT leaders are prioritizing, from Microsoft 365 Copilot licensing decisions to the aftermath of business email compromise.
About the Host:
Nathan Taylor is the Senior Vice President and Global Microsoft Practice Leader at the Sourcepass Center of Excellence for Microsoft. With more than 20 years of experience supporting small and mid-sized organizations, Nathan brings a pragmatic perspective shaped by real-world deployments, Microsoft 365 security strategy, and close collaboration with Microsoft. He helps IT leaders cut through the noise of an ever-evolving Microsoft ecosystem so they can make informed, defensible decisions with confidence.
Episode Highlights:
- 01:07 Why Organizations Are Leaving On-Premises Active Directory
As you know, on-premises Active Directory carries ongoing server, backup, and security overhead, and domain controllers come with a well-documented attack playbook. Moving to cloud-only with Intune, Entra ID join, and Windows Autopilot simplifies management and shrinks the attack surface.
- 03:01 Untangling Okta, Entra ID, and Active Directory Dependencies
Disconnecting Entra Connect is often a single PowerShell command. The real work is mapping everything else tied to Active Directory. Nathan walks through phasing a migration for a customer with both Okta and Entra ID synced to on-premises infrastructure.
- 04:24 Migration Pitfalls and the Hybrid Middle Ground
Line-of-business apps and authentication flows like RADIUS for Wi-Fi are the dependencies that stall migrations. When a legacy system still needs Active Directory, endpoints can move to Entra ID join while a reduced Active Directory footprint runs in Azure for only the users who need it.
- 05:33 Modernizing a Legacy SMTP Relay with Postfix
Stricter SPF, DKIM, and DMARC enforcement, along with tighter Microsoft requirements, have broken many legacy SMTP relays. Nathan compares third-party relay services for high-volume senders with a Postfix relay for lower-volume scenarios, and flags the encryption, port, and alignment details that commonly cause failures.
- 08:32 Microsoft 365 Copilot Business vs. Enterprise
Microsoft 365 Copilot Business offers effectively the same capabilities as the enterpise SKU for organizations under 300 users at roughly 30% less. Tracy shares how clients have responded, and Nathan explains why small business SKUs like Business Premium often outperform enterprise options such as E3.
- 16:22 Device Code Flow Phishing, Token Theft, and Tenant Hardening
Adversary-in-the-middle token theft and device code flow phishing have exploded in recent months. Tracy and Nathan outline the hardening baseline the Sourcepass Center of Excellence for Microsoft starts with: SPF, DKIM, and DMARC, Direct Send and device code flow restrictions, phishing-resistant MFA with FIDO2 passkeys, and device compliance policies.
Episode Resources:
Concerned about how quickly a stolen token could turn into a fraudulent payment in your environment? Connect with the Sourcepass Center of Excellence for Microsoft to assess your Microsoft 365 tenant, close common business email compromise gaps, and put round-the-clock identity threat detection in place.
Quotes:
- “I love advocating for clients, helping clients, and working through problems. Whatever a client needs, I'm here for them. And if I don't know the answer, I definitely know people who can help.”
- “It's wonderful when you can go to a client and say, ‘Hey, I can save you some money.’”
- “When threat actors get into a client's environment, they can do something as simple as changing one letter in an email address so the recipient doesn't notice.”
- “Microsoft 365 Copilot Business is perfect for clients with under 300 business users, and it's about 30% less than the enterprise version.”
Demystifying Microsoft is handcrafted by our friends over at: fame.so