Licensing¶
Intune licensing changed in 2026. Several capabilities that used to need the paid Intune Suite add-on are now part of Microsoft 365 E3 and E5. Check what you already own before you buy anything.
Not legal or purchasing advice
This page summarizes Microsoft's published documentation as of October 2026. Your agreement and Microsoft's plans and pricing page are the final word.
The three Intune plans¶
| Plan | What it is |
|---|---|
| Microsoft Intune Plan 1 | The base service: device and app management for all supported platforms. |
| Microsoft Intune Plan 2 | Adds advanced endpoint management on top of Plan 1, including Remote Help and Advanced Analytics, Microsoft Tunnel for MAM, specialty device management and firmware over-the-air updates. |
| Microsoft Intune Suite | Adds advanced management and security capabilities on top of Plan 1 and includes Plan 2. |
Most organizations get Plan 1 through a bundle rather than buying it on its own. Bundles that include Intune Plan 1 include Microsoft 365 E3, E5 and E7, Microsoft 365 Business Premium, Microsoft 365 F1 and F3, Enterprise Mobility + Security E3 and E5, and Microsoft 365 A3 and A5 for education.
What's included from July 2026¶
Microsoft is adding Intune Suite capabilities to commercial Microsoft 365 E3 and E5:
| Capability | What it does | Microsoft 365 E3 | Microsoft 365 E5 and E7 |
|---|---|---|---|
| Intune Plan 2 (Tunnel for MAM, specialty devices, firmware over-the-air) | Advanced management features | ||
| Remote Help | Secure, role-based help desk remote control | ||
| Advanced Analytics | Device query, battery health, anomalies, resource performance | ||
| Endpoint Privilege Management | Lets standard users run approved tasks as administrator | ||
| Enterprise App Management | Microsoft-hosted catalog of prepackaged Win32 apps | ||
| Microsoft Cloud PKI | Cloud-hosted certificate authority for Intune devices |
Things to know about the change:
- It rolls out gradually. Eligible tenants are provisioned automatically, and Microsoft posts a notice in the Microsoft 365 admin center 30 days before your tenant changes.
- It applies to commercial Microsoft 365 E3 and E5. Education and frontline (F1/F3) plans haven't changed. Government clouds follow later, subject to compliance requirements.
- Customers on other plans can still buy the Intune Suite or individual add-ons.
Check before you renew add-ons
If you bought Remote Help, Endpoint Privilege Management or Cloud PKI as standalone add-ons and you're on Microsoft 365 E3 or E5, raise it with your licensing partner before the next renewal. You may be paying twice.
Other licenses Intune features depend on¶
Intune features often need a license from another product too.
| Feature | Also requires |
|---|---|
| Conditional Access, Windows automatic enrollment, dynamic groups | Microsoft Entra ID P1 (P2 for risk-based policies and PIM) |
| Remediations (Windows scripts) | Windows Enterprise E3 or E5, Windows Education A3 or A5, or Windows VDA per user |
| Hotpatch for Windows quality updates | Windows 11 Enterprise E3 or E5, Microsoft 365 F3, Windows 11 Education A3 or A5, Microsoft 365 Business Premium, or Windows 365 Enterprise, on Windows 11 24H2 or later |
| Windows Autopatch features | Business Premium, A3+, E3+ or F3 (some features need E3+ or F3) |
| Microsoft Defender for Endpoint integration and device risk | Defender for Endpoint Plan 1 or Plan 2 (or Defender for Business) |
| Copilot in Intune | Microsoft Security Copilot |
| Microsoft 365 Apps deployment | A Microsoft 365 Apps license for the user |
Admin licensing¶
- Admin accounts created after June 2021 can manage Intune without an Intune license.
- Older admin accounts, and admins who get their role through a nested group, still need a license.
- Shared or userless devices (kiosks, shared tablets) can be licensed with the per-device Intune Device license when per-user licensing doesn't fit.
How to check what you have¶
- In the Microsoft 365 admin center, go to Billing > Licenses to see your subscriptions and assigned counts.
- In the Intune admin center, go to Tenant administration > Intune add-ons. Each add-on shows Active or Available for trial or purchase.
- Check the Message center for the 30-day notice about the July 2026 changes.