Should we put contractors on Business Premium too?

I’d separate the account’s security controls from management of the device. A Premium license may make sense for contractor accounts that need the same access protections as employees, but that does not mean you should automatically enroll every personal laptop in full device management.

Set clear access requirements first: MFA, appropriate Conditional Access rules, and limits on what can be accessed from unmanaged devices. Then decide whether a contractor can use a personal device under those rules, needs a company-issued laptop, or should use a controlled remote workspace. Put the privacy and support expectations in writing before rollout.

For the 60 company laptops, Premium looks like a straightforward case if you are actually going to configure and maintain Intune, Conditional Access, and Defender. The bigger question is whether you have the time to do the setup properly. Licensing is only part of the work. Policies, device enrollment, testing, user support, and offboarding all need an owner.

I’d make a small pilot before promising a company-wide security improvement. Start with a few managed devices, verify what the policies do, and document how personal data is handled. Otherwise, you can end up paying for capabilities that are only partly deployed.

For contractors, I’d choose based on the risk and the contract, not just whether they are called contractors. If they handle sensitive company information or have broad access, the organization needs a clear way to secure that access. A contractor’s own security program may be acceptable if it meets your requirements and you can verify that. Otherwise, issue company-managed equipment.

Also check the licensing rules for the exact features you plan to use. Don’t assume one group can be left unlicensed while still receiving protections that require licenses.

If you do allow BYOD, be very explicit that full management of a personal computer is not the default. Some organizations instead restrict access from unmanaged devices or provide a remote desktop so company work stays in a controlled environment. That can reduce the amount of company data stored locally, though it adds setup and support needs.

Explain what administrators can see or control, and give contractors a choice of an approved route, such as using their own device under limited access rules or requesting company equipment. A surprise enrollment prompt is a poor way to introduce the policy.

Don’t overlook the simple option: provide company laptops to contractors who need regular or sensitive access. It costs more upfront and means managing more hardware, but it avoids asking people to accept intrusive controls on a personal computer. For short-term or lower-risk work, limited access from BYOD may be enough.