Microsoft Intune licensing in 2026 sits across four entitlement paths: Intune Plan 1 (the core MDM/MAM), Intune Plan 2 (advanced endpoint analytics and management), Intune Suite ($10 PUPM, bundles EPM, EAM, Cloud PKI, Remote Help, and Microsoft Tunnel), and Intune-included-in-M365 (E3, E5, F1/F3, Business Premium). The trap most enterprises walk into: paying for Intune Suite mass-assigned when the high-value components only earn out for a subset of users, or paying for standalone Intune Plan 1 on users who already have it included in their M365 seat. We map each path, the per-feature value, and the rationalisation decisions that beat the default Microsoft proposal in a 2026 EA.
The Microsoft Intune licensing map in 2026
Microsoft Intune licensing has three structural paths and a handful of edge cases. The structural paths:
- Intune included in a Microsoft 365 seat. E3 includes Intune Plan 1. E5 includes Intune Plan 1. Business Premium includes Intune Plan 1. Frontline F1 and F3 include Intune for Frontline (a constrained Plan 1 variant). EMS E3 includes Intune Plan 1. EMS E5 includes Intune Plan 1 and Plan 2 features through Defender for Endpoint integration. The implication: if you have any of the above on a user, you should not be paying for standalone Intune for that user.
- Intune Plan 1 standalone. $8 PUPM at list. The core mobile device management, mobile application management, app protection policies, configuration profiles, and basic endpoint configuration. Standalone Intune Plan 1 is for users without an M365 or EMS entitlement (rare in enterprises) or for device-only scenarios (educator devices, dedicated kiosks).
- Intune Plan 2 standalone. $4 PUPM at list, layered on Plan 1. Adds Microsoft Tunnel for MAM and specialty configuration. Used to be more meaningful pre-Intune-Suite; today it is largely a transitional SKU.
- Intune Suite. $10 PUPM at list, layered on Plan 1. Bundles Endpoint Privilege Management (EPM), Enterprise App Management (EAM), Cloud PKI, Remote Help, Microsoft Tunnel for MAM, advanced endpoint analytics, and specialty device management. Released 2023, refined through 2024–25, repriced and refeatured in early 2026.
The edge cases: Intune for Education, Intune for Government (sovereign cloud SKUs), Intune for Frontline (Frontline F SKUs only), and Intune Device licence (deviceonly, $2.50 PUPM, for shared frontline devices without per-user assignment).
What’s actually inside Intune Suite
Intune Suite is the SKU where most rationalisation decisions live in 2026. Its six premium components:
- Endpoint Privilege Management (EPM). Just-in-time elevation for standard users to run approved admin tasks without persistent local admin. The single highest-value component for most enterprises — pulls security debt off the table.
- Enterprise App Management (EAM). Pre-built first-party app catalogue with auto-update and lifecycle. Useful for organisations without a mature Configuration Manager presence.
- Cloud PKI. Microsoft-managed certificate authority for device and user certificates. Removes the on-prem PKI cost centre. Material value for organisations running NDES on Windows Server.
- Remote Help. Built-in remote assistance with role-based access control. Replaces third-party remote desktop tools in many estates.
- Microsoft Tunnel for MAM. VPN tunnel for unmanaged devices accessing line-of-business apps.
- Advanced Endpoint Analytics. Anomaly detection, app reliability scoring, and resource performance baselines.
The utilisation reality
Mass-assigned Intune Suite is the second-most-common overspend pattern we see in M365 audits (Copilot is first). The actual feature uptake across 60+ Intune Suite estates we examined in 2025:
| Intune Suite component | Median utilisation | Standalone alternative |
|---|---|---|
| EPM | 22% of assigned users | $4 PUPM standalone |
| EAM | 15% of assigned users | $2 PUPM standalone |
| Cloud PKI | 30% of assigned tenants | $1.50 PUPM standalone |
| Remote Help | 40% of assigned users (one-time/year) | $3.50 PUPM standalone |
| Microsoft Tunnel for MAM | 12% of assigned users | Included in Plan 2 |
| Advanced Endpoint Analytics | Tenant-level, low individual usage | Included in Plan 2 features |
If your enterprise sits below the median utilisation on five of six components, your Intune Suite mass-assignment is structurally inefficient. The standalone components — if Microsoft offers them on your EA — can deliver the same value for half the cost.
Intune Plan 2 became a transitional SKU after Intune Suite launched. Microsoft still sells it but rarely promotes it. If you have Plan 2 standalone on your estate, audit whether the features you actually use are now in Intune Suite or in the M365 base. In many cases the Plan 2 spend is recoverable entirely with no functional change.
The bundled-vs-standalone decision framework
The disciplined approach to Intune licensing in 2026:
- Confirm M365 inclusion first. Pull the licence assignment report. Any user with E3, E5, Business Premium, EMS E3/E5, or Frontline F1/F3 has Intune Plan 1 included. Verify the assignment is live.
- Identify standalone Intune buyers. Anyone holding Plan 1 standalone alongside an M365 seat is double-paying. Deprovision the standalone.
- Quantify EPM target population. EPM justifies its own cost. Identify users for whom EPM closes a real security gap (typically 15–30% of the estate). Buy Intune Suite for those users.
- Quantify Cloud PKI scope. Cloud PKI is tenant-level. If you can retire on-prem NDES with Cloud PKI, the saving on Windows Server, certs, and operations typically clears $200K+ for a mid-market enterprise.
- Decide on Suite vs standalone for the rest. If three or more components earn out for a user, Suite is correct. If fewer, standalone components are cheaper.
Intune at EA renewal
The negotiation levers worth pulling specifically on Intune for a 2026 renewal:
- Component-level pricing. Push Microsoft for component-level SKU pricing (EPM standalone, EAM standalone, Cloud PKI standalone). Microsoft does sell these but does not lead with them.
- Co-term Suite with E5 step-up. If you are weighing E5 step-up versus Intune Suite + add-on stack, the package conversation produces better terms than the line-by-line one.
- Step-up rights through the EA term. Negotiate the right to add Intune Suite seats at the year-one rate at any point in the EA term. Microsoft will push price escalation; reject it.
- Removal rights at anniversary. Default EA terms make it hard to reduce Intune Suite count between anniversaries. Negotiate true-down rights for Intune Suite specifically.
Anonymised case study: $390K annualised on a 6,500-seat estate
A 6,500-employee manufacturer had mass-assigned Intune Suite to all users alongside Microsoft 365 E3 for the entire estate. Annual Intune Suite cost: $780K. Utilisation telemetry across 90 days showed EPM active on 1,200 users, Cloud PKI active tenant-wide, Remote Help opened 600 times in the period (mostly the same 80 support engineers), Microsoft Tunnel for MAM active on 320 users, EAM and Advanced Endpoint Analytics negligible. We rationalised: 1,400 users on Intune Suite (covering EPM, Remote Help, and Tunnel users) and 5,100 users on M365-bundled Intune Plan 1 only. Cloud PKI retained at the Intune Suite level for the smaller group, which was sufficient for the tenant-wide deployment. Annual Intune Suite cost dropped from $780K to $168K. Saving: $612K. Net of $222K reinvested in a small EPM standalone batch for users without Suite who needed elevation, the recurring annualised saving was $390K.
Microsoft Intune licensing rewards the buyer who maps SKU to actual feature use. Mass-assignment is the default Microsoft outcome; component-level rationalisation is where the recurring saving sits. Layer this with broader M365 add-on rationalisation and the 2026 price increase response and Intune stops being a $10 PUPM line item and becomes a managed lever.