I think it's a great development that this is now coming to the SMB sector. However, I'd rather see it included in Business Premium, and as an add-on to Business Standard. Reasoning: it is obvious that MS is a main player in security, and the security stack of M365 (to me) is unprecedented. Yet as security is a main driver to get customers to the cloud, where customers don't know much about security at all, this should be included in M365, and configurable in the base line with the push of a button.
Customer, wanna enable all security features? --> Yes. Boom! all security features enable with default settings: Defender for Business for endpoints (incl smartphones), Defender for Office, (looks like MS thinks that only enterprises use Windows Server Active Directory hence Defender for Identity is not in the box), Defender for Azure (tenant protection as AD lives there), Identity protection...
Then weekly an email report: 'hey customer: your security is doing great. We blocked x attacks on your identies, we cleaned x computers from the malware they were sitting on (and btw, we removed the other anti-malware freebees that gave you just one month of free usage - it only hinders your systems now), we prevented x amount of attacks over the websites your team was trying to access (for 'business' purposes), we prevented x documents from beeing leeked by your employees, we blocked x rogue saas apps that your employees wanted to connect to, and by the way, your smartphone is rooted, that is why you can't have access to your mail using your phone." The day that happens I will go and take a day off to celebrate! 🙂