What Managed Security Costs Per User in Australia in 2026

A 25-user Australian business running Microsoft 365 Business Premium pays about $822.50 a month in licences before a single person is supported, a single device is enrolled or a single alert is triaged. That number is easy to find and easy to verify. The number nobody publishes is what sits on top of it, and that is where two quotes for the same business end up $2,000 a month apart.

This article builds the whole stack for one worked example — 25 users, 40 endpoints — using current Australian Microsoft pricing and published Australian MSP benchmarks, so you can line up competing proposals on the same unit of measure.

All figures below are ex GST, on annual commitment where Microsoft offers one, with the observation date stated. Market-rate ranges from third-party MSP pricing guides are benchmarks, not audited tariffs, and should be treated as a sanity check on a quote rather than a target price.

The three things you are actually paying for

Most confusion in security pricing comes from collapsing three separate purchases into one per-user figure:

1. Licences. The software entitlement. Predictable, published, and the same price for everyone buying on the same terms.
2. Configuration. The one-off work to design and deploy the controls those licences entitle you to — conditional access policies, device enrolment, baseline hardening, backup design, exception handling.
3. Continuous operation. Monitoring, patching, alert triage, incident response, evidence collection, reporting, and the periodic re-testing that keeps a control real rather than historical.

A licence that is bought and never configured delivers nothing. A configuration that is never operated decays within months as devices change, staff turn over and new applications arrive. Any quote that does not price all three is quietly leaving one of them to you.

The licence layer

Microsoft's Australian pricing page lists the following on annual commitment, with prices on that page excluding GST (observed 3 October 2026):

Microsoft's small and medium business security page lists Business Premium at $32.90 and Microsoft Intune Plan 1 at $12.00 per user per month on annual commitment, observed 22 September 2026. The additional services page lists Defender for Business at $4.50 per user per month and the Defender and Purview Suites for Business at $22.40, observed 3 October 2026. Microsoft's business plans are capped at 300 users, with the small-business security package described as supporting up to five devices per user and Intune Plan 1 used to manage Windows, macOS, iOS and Android, observed 12 March 2026.

For 25 users, that produces three plausible licence baselines depending on which SKUs a proposal assumes:

The spread between those rows is $300 a month, and it exists entirely because proposals describe their licence assumptions differently. Make every quote name the exact SKU, the commitment term, whether the price includes GST, and whether Teams is included — Microsoft's plan packaging has changed often enough that an older article or an older quote template is not a reliable guide.

Note also what the licence does not buy: tenant configuration, endpoint enrolment, policy design, user support, incident response, backup of Microsoft 365 data, compliance evidence or after-hours monitoring. "Microsoft 365 includes security" is not a statement you can price against.

The service layer, where quotes actually diverge

Australian published benchmarks for 2026 cluster in a reasonably tight band. One 2026 Australian pricing guide puts managed IT at roughly $100 to $250 per user per month ex GST, with device-based models at $50 to $150 per device and servers commonly $250 to $500 each per month. A second guide places most per-user agreements at $110 to $185 per user per month in 2026, with workstations at $55 to $95, mobile devices at $15 to $25 and servers at roughly $250 to $450. A third gives a fully managed range of $100 to $200 per user per month, with 24/7 security operations coverage adding around $20 to $30 per user.

For our 25-user business, the per-user band translates directly:

Now run the same business on a per-device model. Forty laptops and desktops at $75 each is $3,000 a month — an effective $120 per user before licences, servers, mobiles or anything else. A headline rate of $120 per user is therefore identical to a $75 per-device rate for this business, and cheaper than it if the business has fewer than 40 managed endpoints.

That is the whole trick to comparing proposals: convert everything to the same denominator. Effective per-user cost is total recurring charges divided by users, including device charges, server charges, mobile charges, backup storage and monitoring add-ons. A proposal that looks $40 per user cheaper often has two servers at $400 each sitting below the fold.

Essential Eight uplift as a separate line

Security uplift is the layer most commonly left out of a base managed IT quote and then invoiced later. Indicative Australian ranges published in 2026 put patch management tooling at $2 to $5 per device per month at maturity level 1 and $5 to $10 at maturity level 2, advanced application control at $3 to $8 per device, and ongoing MSP management at $20 to $50 per user at maturity level 1 or $40 to $80 at maturity level 2, observed 31 August 2026 and updated 22 September 2026.

For 25 users and 40 endpoints, maturity level 1 management lands between $500 and $1,250 a month, with patch tooling adding $80 to $200 and application control $120 to $320. Maturity level 2 management moves to $1,000 to $2,000 a month with higher tooling costs behind it.

Those numbers cover tooling and management. They do not cover the preliminary work that makes the controls achievable: asset discovery, privileged-account cleanup, MFA rollout across legacy applications, macro policy, backup redesign, vulnerability remediation, documentation and the testing that produces evidence. The gap between buying a product that supports a control, deploying it, operating it, proving it operates and remediating the exceptions is where budgets break. The last three are labour, not licence.

Stacking the layers for the worked example gives a realistic total:

That is a defensible range for a 25-user business with a real control set, Australian support and evidence it can hand to a customer or insurer. A $3,000 a month quote for the same headcount is not necessarily wrong — it is a different scope, and the difference should be visible on the page.

Co-managed, in-house, or both

The comparison that matters is not the MSP fee against one IT salary. Internal cost includes superannuation, leave, recruitment, training, tooling, security licences, backup, after-hours cover and the specialist contractors a generalist still needs for Microsoft security design, network architecture, incident response and compliance.

A single internal person also means single-person dependency: no leave cover, no weekend escalation, and no second opinion on a control that was configured once and never reviewed. Co-managed arrangements work well where there is already an internal IT lead who owns applications and users, with an external team carrying the specialist security load and out-of-hours monitoring. The contract needs to name who owns each control, because the common failure is both teams assuming the other has it.

Designing, deploying and operating the control set across identity, endpoints and email is the part we scope as managed security and compliance work, and it is the line we would expect any serious proposal to itemise rather than fold into a round per-user number.

Make every quote state these explicitly

• Whether the price includes Microsoft licences, and which SKUs at which commitment term.
• What counts as a supported device: laptops, desktops, mobiles, servers, network gear, shared and kiosk devices, contractor accounts.
• Server and mobile charges as separate line items.
• Priority-one response target, and whether it is a response or a resolution commitment.
• Weekend and public holiday coverage, and after-hours rates if not included.
• Whether a security incident is treated as included support or a chargeable project.
• Backup scope, retention, and how often a restore is actually tested.
• Where primary data, backups, support access and telemetry each reside, and whether any subprocessor is offshore.
• What reporting and compliance evidence you receive, and on what cadence.
• Exit obligations: whether you can export documentation, configurations and logs, and at what cost.

Regulated buyers have an extra layer. APRA's CPS 234 requires information security capability proportionate to the threat and notification to APRA as soon as possible and no later than 10 business days after becoming aware of a material control weakness that cannot be remediated in a timely manner, observed 2 October 2026. That is not a general SME requirement, but if you supply a financial-sector customer it may arrive via their contract, and your provider should be able to explain control ownership, subcontractors, access management, testing and evidence retention without a pause.

Start by counting

Before you compare anything, produce two numbers: how many devices you actually manage, and how many identities exist in your tenant including shared mailboxes, service accounts and dormant contractors. Nearly every pricing dispute between a business and a provider traces back to a device or account list that neither party verified before signing. With those two numbers you can convert every quote on your desk to an effective per-user cost and compare like with like.

If you would rather not do the arithmetic alone, we will build the model for your environment: current licence position against Microsoft's Australian pricing, a device and identity count, what the service layer should cost at your size, and where your current spend is buying a licence you are not operating. You get a scoped number and a plain answer on whether the uplift is worth doing — request a consultation and we will put it in writing.