Intune Plan 1 vs Plan 2 vs Intune Suite: Which Endpoint Management License You Need
Almost nobody buys Intune on its own. It arrives inside Microsoft 365 Business Premium, E3, E5 and F3, and the first Intune quote most organizations see is for the second layer: Plan 2, the Intune Suite, or a single add-on such as Remote Help or Endpoint Privilege Management. Since 1 July 2026 that second layer is also inside E3 and E5, which changed the answer for many tenants. This guide puts the October 2026 prices on one table, lists what each plan already carries, and ends with a counting method that avoids paying twice.
Intune pricing on one table
Prices are per user per month on an annual term, Commercial segment (Microsoft list price, October 2026 price list). The list carries annual figures: Microsoft Intune Plan 1 is $96.00 per user per year, and $96.00 ÷ 12 = $8.00 per user per month. Every figure below is the same division.
| Product | Per user per month (annual term) | What it is | Prerequisite |
|---|---|---|---|
| Microsoft Intune Plan 1 | $8.00 | The base: device and app management, compliance, endpoint analytics | None |
| Intune Plan 1 Device | $2.70 per device | Device-only license for user-less devices | None |
| Microsoft Intune Plan 2 | $4.00 | Tunnel for MAM, specialty and shared device management, firmware updates | Plan 1 |
| Microsoft Intune Suite | $10.00 | Plan 2 plus the five add-ons below | Plan 1 |
| Remote Help | $3.50 | Help-desk remote control with role-based access | Plan 1 |
| Endpoint Privilege Management | $3.00 | Removes local admin rights; elevation rules | Plan 1 |
| Advanced Analytics | $5.00 | Device query, anomaly detection, app and battery health | Plan 1 |
| Enterprise Application Management | $2.00 | Prepackaged third-party app catalog with updates | Plan 1 |
| Microsoft Cloud PKI | $2.00 | Cloud certificate authority for Intune-managed devices | Plan 1 |
| Intune for Education | $0.75 (Education segment, faculty or student pricing) | The same service with a simplified console for schools | None |
The contents column follows Microsoft's Intune pricing page (Microsoft, Microsoft Intune plans and pricing, opened October 5, 2026), which states that all advanced capabilities require Intune Plan 1 as the base license. Frontline-worker variants exist at lower prices.
Which Microsoft 365 plans already include Intune Plan 1
Microsoft's service plan reference (Microsoft Learn, Product names and service plan identifiers for licensing, August 2026) shows the Microsoft Intune service plan, the Plan 1 entitlement, inside Microsoft 365 Business Premium (with Entra ID P1 and Defender for Business); Microsoft 365 E3, E5 and E7; Microsoft 365 F1 and F3; Enterprise Mobility + Security E3 and E5; and Microsoft 365 A3 and A5, whose rows list both Microsoft Intune and Microsoft Intune for Education. Microsoft's Intune licensing page adds the Government G3 and G5 plans.
The Plan 1 service plan does not appear in Microsoft 365 Business Basic, Business Standard, Office 365 E1 or Office 365 E3. Those users need a standalone Intune Plan 1 license at $8.00, or a move to a plan that carries it; the Microsoft 365 Plan Optimizer prices both routes. Conditional Access on those devices also needs Entra ID P1 at $7.00, which Business Premium and E3 include and the Business Basic and Standard rows do not.
What changed on 1 July 2026: Plan 2 and Suite capabilities moved into E3 and E5
Microsoft's 2026 pricing and packaging update (Microsoft, Microsoft 365 pricing and packaging updates, February 2026; prices effective 1 July 2026, packaging rolled out by 1 August 2026) moved most of the Intune Suite into the enterprise suites. Microsoft 365 E3 gained Intune Plan 2, Remote Help and Advanced Analytics, along with Defender for Office 365 Plan 1. Microsoft 365 E5 gained those plus Endpoint Privilege Management, Microsoft Cloud PKI and Enterprise Application Management, and Microsoft's pricing FAQ states that E5's packaging changes apply to E7. Enterprise Mobility + Security E3 and E5 gained the same Intune additions as E3. Microsoft 365 F1, F3 and Business Premium gained no Intune capabilities.
Microsoft's service plan reference already lists Cloud PKI and Enterprise Application Management among the Microsoft 365 E5 extra features (August 2026). So an E5 seat now carries every component of the Intune Suite, and an E3 seat carries Plan 2, Remote Help and Advanced Analytics. If you still pay for those add-ons on top of E3 or E5, you are paying twice until someone cancels the add-on at its own renewal, which is the first thing the Microsoft 365 License Audit and Optimization service looks for. The 2026 packaging changes article covers the rest of the update.
Plan 2: Tunnel for MAM, specialty devices and firmware updates
Microsoft's Intune pricing page describes Plan 2 as everything in Plan 1 plus Microsoft Tunnel for Mobile Application Management, specialty and shared device management, and firmware-over-the-air updates (opened October 5, 2026). Tunnel for MAM lets a personally owned, unenrolled phone reach an internal web app from a managed Outlook or Edge; the other two cover headsets, conference-room devices and Android Enterprise firmware.
Plan 2 is $4.00 as an add-on to Plan 1 and, since July 2026, comes with E3 and E5. For a Business Premium or F3 tenant the question is whether any of the three scenarios exists; most 20-to-500-seat tenants manage personal phones with app protection policies instead, which is Plan 1 and the subject of our BYOD app protection article and the Intune App Protection for BYOD service. If none of the three applies, skip Plan 2.
The Intune Suite: what $10.00 buys, and when a single add-on costs less
The Microsoft Intune Suite is $10.00 and contains Plan 2 plus Remote Help, Endpoint Privilege Management, Advanced Analytics, Enterprise Application Management and Microsoft Cloud PKI (Microsoft, Intune plans and pricing, opened October 5, 2026). Bought one at a time, those six items add up to $4.00 + $3.50 + $3.00 + $5.00 + $2.00 + $2.00 = $19.50. The buying rule is arithmetic: one capability, buy that add-on; two or more, the Suite costs less once the pair passes $10.00, which happens with Remote Help plus Advanced Analytics, or Advanced Analytics plus EPM plus anything.
Remote Help ($3.50) is the help-desk tool: role-based control over what a helper may do, elevation on Windows, an unattended mode for corporate-owned Intune-managed Windows devices, and Conditional Access on the helper. Our Remote Help page lists it as an add-on to an existing Intune plan.
Endpoint Privilege Management ($3.00) removes local administrator rights: users run as standard users, an elevation rules policy defines which binaries may run elevated, automatically or on request, and every elevation is logged. It applies to Windows, and Microsoft's overview is explicit that EPM must be licensed in the tenant before the policies work. The Intune Endpoint Privilege Management Implementation service does the rule design and the audit-mode rollout.
Intune for Education and the A3 and A5 inclusion
Intune for Education is not a different service. Microsoft's documentation describes it as a simplified console on top of Microsoft Intune, built for schools that manage student and classroom devices in bulk: the same tenant and enrollment, with a smaller set of settings grouped by what a teacher or school IT lead needs.
Licensing has two paths. Microsoft 365 A3 and A5 include it: the service plan reference lists both Microsoft Intune and Microsoft Intune for Education in the A3 and A5 rows (Microsoft Learn, August 2026), so a school on A3 or A5 buys nothing more. Schools on Office 365 A1, or with devices no licensed user signs in to, buy the standalone product: on the Education segment of the October 2026 price list, Microsoft Intune for Education is $9.00 per user per year at both faculty and student pricing, or $0.75 per month, and the list also carries a Microsoft Intune Students use benefit SKU at $0.00, which Microsoft sponsors and which is subject to eligibility. Our Microsoft Intune Plan 1 for Education page lists the SKUs.
Device licenses, unlicensed admins and a counting method
Three rules from Microsoft's Intune licensing documentation change the count. The device-only license, $2.70 per device, covers user-less devices enrolled through Windows Autopilot self-deploying mode, Apple Automated Device Enrollment without user affinity, Android Enterprise dedicated enrollment or a device enrollment manager account, and those devices get no app protection policies or Conditional Access. Administrators on tenants created after July 2021 need no Intune license to use the admin center. Co-management with Configuration Manager requires Entra ID P1 or P2 for each user plus Intune Plan 1.
Work down the tenant, not up the price list:
- Count seats carrying the Microsoft Intune service plan: every Business Premium, E3, E5, F1 and F3 seat is done at Plan 1.
- Count E3 and E5 seats separately: since July 2026 they also carry Plan 2, Remote Help and Advanced Analytics, and E5 carries EPM, Cloud PKI and Enterprise Application Management. Cancel duplicate add-ons at renewal.
- Count Business Basic, Business Standard, Office 365 E1 and E3 users who need managed devices. Add Intune Plan 1 at $8.00, or compare a plan move.
- Put shared and user-less devices on device licenses at $2.70; the Windows Autopilot setup service covers the self-deploying scenario.
- Only then list the advanced capabilities you will use in the next twelve months, and price the standalone add-ons against the $10.00 Suite.
The Microsoft Intune Initial Setup for Windows Device Management service starts from that count, and the Managed Microsoft Intune Service keeps the policies current afterwards.
Frequently asked questions
Does Microsoft 365 Business Premium include Intune?
Yes. The service plan reference lists the Microsoft Intune service plan in Business Premium, with Entra ID P1 and Defender for Business. Business Basic and Business Standard do not include it.
Is Intune Plan 2 included in Microsoft 365 E5?
Yes, since the July 2026 packaging update. E3 and E5 carry Plan 2, Remote Help and Advanced Analytics; E5 also carries Endpoint Privilege Management, Cloud PKI and Enterprise Application Management. Business Premium, F1 and F3 carry Plan 1 only.
What is the difference between Intune Plan 1 and Plan 2?
Plan 1 is the full device and app management service. Plan 2 is a $4.00 add-on that brings Tunnel for MAM, specialty and shared device management and firmware-over-the-air updates; nothing in it is needed for ordinary Windows, macOS, iOS or Android management.
Is Intune for Education a different product?
No. It is a simplified console on the same Intune service, included in Microsoft 365 A3 and A5 and sold standalone at Education pricing for schools on A1.
Sources
- Commercial and Education price lists, October 2026: Intune Plan 1 (user and device), Plan 2, Intune Suite, Remote Help, Endpoint Privilege Management, Advanced Analytics, Enterprise Application Management, Cloud PKI, Intune for Education
- Microsoft, Microsoft Intune plans and pricing page (opened October 5, 2026); Microsoft 365 pricing and packaging updates (February 2026)
- Microsoft Learn, Product names and service plan identifiers for licensing (August 2026)
- Microsoft Learn, Microsoft Intune licensing, Endpoint Privilege Management, Remote Help and What is Intune for Education (cited without a date; the pages could not be opened on the day of writing)
- IT Partner subscription pages for Intune Plan 1, Plan 2, Intune Suite, Remote Help, Endpoint Privilege Management and Intune Plan 1 for Education
| Your tenant | Intune you already hold | Next layer | Per user per month (annual term) |
|---|---|---|---|
| Microsoft 365 E5 or E7 | Plan 1, Plan 2 and every Suite component since July 2026 | Nothing; cancel duplicate add-ons at renewal | $0.00 |
| Microsoft 365 E3, EMS E3 or E5 | Plan 1, Plan 2, Remote Help, Advanced Analytics | EPM, Cloud PKI or Enterprise App Management singly, or the Suite | $3.00, $2.00, $2.00, or $10.00 |
| Business Premium, F1 or F3 | Plan 1 | One add-on, or the Suite when two or more pass $10.00 | $2.00 to $5.00 each, or $10.00 |
| Business Basic, Business Standard, Office 365 E1 or E3 | None | Intune Plan 1, plus Entra ID P1 for Conditional Access | $8.00, plus $7.00 |
| Kiosks and user-less devices | n/a | Intune Plan 1 Device | $2.70 per device |
| School on A3 or A5 | Intune and Intune for Education | Nothing for Plan 1; Education-priced add-ons for the rest | $0.00 |
Key takeaways
- On the October 2026 price list Intune Plan 1 is $8.00, Plan 2 $4.00, the Intune Suite $10.00 and the device license $2.70, per user or device per month on an annual term.
- Business Premium, E3, E5, E7, F1, F3, EMS E3 and E5, and A3 and A5 already carry Intune Plan 1; Business Basic, Business Standard and the Office 365 plans do not.
- Since 1 July 2026 Microsoft 365 E3 includes Plan 2, Remote Help and Advanced Analytics, and E5 adds Endpoint Privilege Management, Cloud PKI and Enterprise Application Management; cancel duplicate add-ons at renewal.
- For Business Premium and F3 tenants the Suite remains a separate $10.00 purchase: buy one capability as its own add-on, and price the Suite once two or more pass $10.00.
- Intune for Education is the same service with a simplified console, included in A3 and A5 and sold standalone at $0.75 per user per month on the Education price list.
Count the Intune seats you already hold before you buy a single add-on, and recount the E3 and E5 seats against the July 2026 change. Subscriptions are at Microsoft's list price on our Intune Plan 1, Intune Plan 2, Intune Suite and Intune Plan 1 for Education pages, each with a quote button. The Microsoft Intune Initial Setup for Windows Device Management service builds the tenant from that count at a fixed price, and the Managed Microsoft Intune Service runs it afterwards. Not sure which layer your tenant needs? Book 30 minutes with Mike.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.