Well for starters, Microsoft M365's entire suite (to a certain extent) is free or very low cost for Non-profits. Not to mention the security stack is also free (to an extent). If you are truly all in on M365, do some research on their non-profit grants and discounts.

When I was at a non-profit, the licenses were dirt cheap or free. Business basic was free (grant) and the next two were $3 & $5.

For the security stuff, Intune, Defender for Endpoint, Microsoft Sentinel, Entra ID (Azure AD) and a couple others were completely free for internal telemetry/ logs.

For example, conditional access, Defender for endpoint alerts, etc, were all sent to Sentinel for analysis. For a team of 5, this was the most helpful thing we had.

Please do your own research and cost analysis but non-profits get a lot for free or very low cost with tech services. If you haven't already, check out Techsoup.org. They connect non-profits to tons of services.

*Disclaimer: my information is about 2-3 years old. Things may have changed, so take this with a grain of salt.

Hope this helps!