Microsoft is folding the Intune Suite components — Endpoint Privilege Management (EPM), Remote Help, Enterprise Application Management (EAM), Cloud PKI, and Advanced Endpoint Analytics — into Microsoft 365 E5 for the 2026 commercial cycle. The Intune Suite add-on, which listed at $10/user/month standalone (or $8 attached to E3/E5), effectively disappears as a discrete revenue line. E5 list price absorbs a portion of that economics. The change is a forced inclusion for E5 customers, a removed upsell path for E3 customers, and a structural blow to the third-party tools (privilege management, MDM, remote support, certificate management) that used to compete with the components piece by piece. For procurement, the practical effect is that the Intune Suite is no longer a cancellable line and the implicit E5 value story tightens. The July 2026 M365 price increase rolls underneath this change, so the two effects compound.
What got bundled into E5 in 2026
The Intune Suite was launched in March 2023 as a $10/user/month add-on (or $8 attached) that combined a set of advanced endpoint management capabilities Microsoft had been building independently for years. The original suite covered:
- Endpoint Privilege Management (EPM) — least-privilege elevation for standard users.
- Remote Help — the Microsoft alternative to TeamViewer, BeyondTrust Remote Support, and similar.
- Enterprise Application Management (EAM) — a curated catalogue of pre-packaged Win32 apps.
- Cloud PKI — certificate lifecycle management as a service.
- Advanced Endpoint Analytics — richer telemetry and anomaly detection for managed endpoints.
From the 2026 commercial cycle, all five components are inside Microsoft 365 E5 by default. They are not inside E3, they are not inside Business Premium, and they are not inside the standalone Intune Plan 1 SKU. The Intune Suite add-on continues to exist as a SKU for E3 buyers who want it bolted on, but it is no longer the only path — and for E5 buyers, the add-on is now redundant and being removed from quotes.
The price-shift inside E5
Microsoft 365 E5 lists at $57.00 per user per month going into the July 2026 price increase, with the post-increase list approximately $60. Of that uplift, several dollars are explicitly tied to the Intune Suite absorption. The "implicit value" of E5 has expanded by $8–10 in marketing terms while the actual list moves up by a smaller amount — a deliberate widening of the marketing value-to-price ratio designed to make E5 step-ups look more attractive.
The arithmetic is straightforward for E5 customers who already had Intune Suite attached: the bundle is neutral on wallet, mildly positive on contract simplicity. For E5 customers who never bought Intune Suite, the change is a forced price uplift you cannot opt out of. For E3 customers, nothing changes — the Intune Suite is still an add-on for you, with the same list price as before.
The bundle move follows the same playbook as Defender for Office 365 P1 into E3, Defender for Endpoint P1 into E5 (2023), and Power BI Pro into E5 (2017). Microsoft pulls add-ons into the suite when attach rates are healthy enough to absorb the revenue at suite price, but churn rates on the add-on threaten the long-term run rate. The bundle locks in the revenue and removes the cancellation surface.
What it kills as standalone add-on revenue
The bundle eliminates the Intune Suite as a discoverable, cancellable SKU on the E5 price sheet. For Microsoft, this trades short-term add-on revenue (you used to pay $96 per user per year for it on top of E5) for long-term lock-in (you now pay it inside E5 with no way to cut it). For buyers, three specific negotiation moves disappear:
- The "swap Intune Suite for BeyondTrust EPM" line cut. A 5,000-seat customer used to recover $400K per year by cancelling Intune Suite and keeping BeyondTrust for privilege management. That cut no longer exists; the licence is paid regardless.
- The "swap Remote Help for TeamViewer" line cut. Same dynamic. Teams of buyers who preferred TeamViewer or BeyondTrust Remote Support used to cancel Remote Help and keep the third-party tool. The cancellation is no longer possible at the EA line-item level.
- The "Cloud PKI vs DigiCert" decision. Microsoft Cloud PKI was the most aggressively-priced cloud certificate management tool in the market. With it inside E5, the decision is now "use Cloud PKI for free vs continue paying DigiCert/Sectigo," and the duplicate-spend argument moves the needle on the third party.
The third-party tool vendors that compete with these five components are the second-order losers of this bundle. Expect aggressive retention pricing from BeyondTrust, CyberArk, TeamViewer, ManageEngine, and DigiCert in 2026 as they fight to keep deployments they would have held by default in 2025.
What E3 buyers lose
For E3 customers, the immediate change is small — the Intune Suite remains an $8–10 add-on. The hidden change is that the E5 step-up just became more attractive in marketing terms, which is the lever Microsoft sales will pull harder in 2026. Expect "you're already buying the Intune Suite as an add-on, why not just step up to E5 where you get all of it plus the rest of the security stack" framing on every renewal call.
The counter-argument is unchanged: the residual delta between E3+Intune Suite and E5 is still $19–21 per user per month, which buys MDO P2, Defender for Identity, Defender for Cloud Apps, Defender for Endpoint P2, Power BI Pro, Audio Conferencing, and the compliance stack. Whether those components warrant the step-up is independent of the Intune Suite question. The packaging change is a sales lever, not a value argument. Treat it as such. Our E5/E7 buy-or-skip framework walks through the analysis for both step-ups in the same exercise.
What it does to the competitive tooling market
The strategic effect of the bundle is to push Microsoft's endpoint management stack from "best of breed in some areas" to "good enough in all of them, included in E5." This is the same posture that killed standalone email security as a healthy market over 2018–2023 (Exchange Online Protection plus MDO ate Proofpoint's growth rate). The same compression is now coming to:
- Privilege management (BeyondTrust, CyberArk Endpoint Privilege Manager, Heimdal). Intune EPM was already cheaper. Now it is functionally free for E5 customers.
- Remote support (TeamViewer, BeyondTrust Remote Support, AnyDesk). Microsoft Remote Help inside E5 with no add-on cost makes the competing tools harder to defend.
- Certificate management (DigiCert CertCentral, Sectigo Certificate Manager). Cloud PKI inside E5 takes the certificate management revenue line away.
- Application packaging (ManageEngine, Patch My PC, Chocolatey for Business). Enterprise Application Management inside E5 reduces the third-party patching/packaging spend.
For procurement teams, the immediate implication is that any contract with these third-party vendors renewing in 2026 should be opened with a hard exit-analysis. If the third-party tool is materially better, keep it on its merits. If it is not, the bundle gives you cost-justified cover to drop it.
Negotiation moves that still work
The bundle removes line items but does not remove leverage. Three moves remain effective in 2026:
1. Refuse a bundled "value" justification for the E5 list rise. Microsoft will frame the E5 list rise as "you're getting Intune Suite included." Insist on a price arithmetic that separates the bundling absorption from the broader July 2026 E5 price increase. The bundling absorption is more negotiable than the headline rate, because Microsoft has more room to credit it back as a renewal goodwill.
2. Use the third-party tool overlap as a transition trigger. If you carry BeyondTrust, TeamViewer, or DigiCert today, your in-flight contracts with those vendors give you a real negotiating event in 2026. Microsoft's sales motion expects you to terminate the third party once you have Intune Suite inside E5. Use the timing — the moment Intune Suite is inside E5, the third party knows their revenue is at risk and will discount aggressively. Capture that discount before committing.
3. Demand operational maturity time before paying for it. Intune EPM, Cloud PKI, and EAM all require non-trivial deployment investment to use well. If you cannot deploy them in year one of the renewal, ask for a phased credit — you should not pay full E5 list in year one for components you will only stand up in year two. This is a soft-money credit that Microsoft will sometimes give, particularly on large renewals or when an LSP competitive bid is in play.
Action plan before your renewal
- Inventory your third-party endpoint tools. List every product that competes with the five Intune Suite components. Pull the annual spend on each.
- Get exit terms from each third-party vendor in writing. Many have hard exit clauses or co-term dates that will determine when the saving actually materialises.
- Force the bundle absorption as a separate line on the renewal quote. Make Microsoft show the dollar value of the Intune Suite absorption inside the E5 list change. That number is the floor of your "soft money" goodwill ask.
- Stage the deployment plan. Decide which components you will actually deploy in year one and which can wait. Negotiate the renewal as if you are deploying everything; deploy strategically.
- Coordinate with the EA tier-collapse strategy. The bundle effect interacts with the volume tier change. Both should be negotiated in the same cycle.
The Intune Suite bundle is not a buyer-friendly move. It is a structural pricing change that locks in revenue Microsoft was at risk of losing and narrows the buyer's choice surface. The defensive posture is documentation: line-item separation, third-party exit timing, and phased value capture. Done well, the renewal is roughly cost-neutral. Done badly, you absorb the absorption and the price increase as one undifferentiated lump.