Intune Licensing Explained: Plan 1 vs Plan 2 vs Intune Suite, What Business Premium, E3, E5 and F3 Already Include, and the Remote Help and EPM Add-ons

Microsoft's Intune licensing article describes three plans and is careful with the word "additive":

• Microsoft Intune Plan 1 is the base service: cloud-based unified endpoint management for devices and apps.
• Microsoft Intune Plan 2 is additive to Plan 1. Microsoft describes it as advanced endpoint management capabilities, including Remote Help and Advanced Analytics.
• Microsoft Intune Suite is additive to Plan 1 and includes Plan 2. It unifies the advanced endpoint management and security capabilities.

The service plan reference spells out what the Suite carries: Intune Plan 2, Remote Help, Endpoint Privilege Management, Intune Advanced endpoint analytics and Microsoft Tunnel for Mobile Application Management. Microsoft's advanced capabilities page lists the wider set those plans and add-ons draw from: Firmware Over-the-Air updates for Android, specialty device management, Microsoft Tunnel for MAM, Advanced Analytics, Remote Help, Microsoft Cloud PKI, Endpoint Privilege Management and Enterprise Application Management.

Two rules follow. Plan 2 and the Suite never stand alone; our Microsoft Intune Plan 2 page says so plainly: it is an add-on for users who already hold a qualifying Intune base entitlement. And the exact split of capabilities between Plan 2 and the Suite lives on Microsoft's Intune plans and pricing page, not in the licensing article, so read that page before you quote a Plan 2 seat for a capability that turns out to be Suite-only. The Microsoft Intune Suite page lists monthly and annual terms and a frontline-worker variant.

Microsoft's licensing article says most organizations get Intune through a Microsoft 365 bundle, and the service plan reference lets you check which. The Microsoft Intune service plan, the Plan 1 entitlement, appears in:

• Microsoft 365 Business Premium, alongside Entra ID P1 and Defender for Business.
• Microsoft 365 E3 and E5, alongside Entra ID P1 (E5 adds P2).
• Microsoft 365 F1 and F3, again with Entra ID P1.
• Enterprise Mobility + Security E3 and E5.

It does not appear in Microsoft 365 Business Basic, Business Standard, Office 365 E1 or Office 365 E3. Those users need a Microsoft Intune Plan 1 license added, or a move to a plan that carries it; our Business Premium vs E3 comparison covers the second route, and the Microsoft 365 Plan Optimizer treats device management as a need and prices both.

Equally important is what those bundles do not carry. None of the Business Premium, E3, E5 or F3 rows lists the Intune Plan 2, Remote Help or Endpoint Privilege Management service plans. An E5 seat is not a Suite seat. If a help desk is already using Remote Help on an E5 tenant, it is running on a trial, an add-on, or a Suite subscription someone bought and forgot.

Both capabilities are sold on their own and both are in the Suite, so the question is whether you need one of them or several.

Remote Help is the help-desk tool. Microsoft's documentation describes role-based access control over what a helper may do, elevation support on Windows, and an unattended remote sign-in mode in which an authorized helper signs in to a corporate Windows device with their own credentials without a user present; unattended control is limited to physical, corporate-owned, Intune-managed Windows devices. Help for unenrolled devices is off by default. Conditional Access can require MFA for helpers, macOS is supported, and Android supports unattended control on Android Enterprise dedicated devices. Our Microsoft Intune - Remote Help page lists it as an add-on to an existing Intune plan, with monthly and annual terms.

Endpoint Privilege Management removes local administrator rights. Users run as standard users; an elevation settings policy turns the client on and an elevation rules policy defines which binaries or scripts may run elevated, automatically or on request. Most elevation types run through an isolated virtual account rather than adding anyone to the local Administrators group, and every elevation is logged. It applies to Windows. Microsoft's overview is explicit that EPM must be licensed in the tenant before the policies work. The Microsoft Intune Endpoint Privilege Management page lists a standard SKU and a frontline-worker SKU. Our Intune Endpoint Privilege Management Implementation service does the rule design and the audit-mode rollout.

The buying rule is arithmetic. One capability: buy that add-on. Two or more, or anything that turns out to be Plan 2 or Suite-only: price the Suite on our page against the sum of the add-ons. Microsoft also offers trials of each advanced capability from the Intune admin center: 90 days, up to 250 users per tenant, one trial per capability, then a 30-day grace period before the capability disappears from the admin center.

Three rules from the licensing article change the count.

Device-only licenses. Intune has a device-only subscription for devices not tied to a person: kiosks, dedicated devices, phone-room devices, IoT. It applies when a device enrolls through Windows Autopilot self-deploying mode, Apple Automated Device Enrollment, Apple School Manager or Apple Configurator without user affinity, Android Enterprise dedicated enrollment, or a device enrollment manager account. The trade-off: devices on a device license get no app protection policies, no Conditional Access and no user-based features such as email. A signed-in user without an Intune license does not stop device-targeted policies from applying. Our Windows Autopilot setup service covers the self-deploying scenario.

Unlicensed administrators. Tenants created after July 2021 let administrators sign in to the Intune admin center without an Intune license by default. Older tenants have to turn on "Allow access to unlicensed admins" under Tenant administration > Roles > Administrator Licensing, and the setting cannot be undone. Two limits: up to 1,000 unlicensed admins per security group, and members of nested groups still need a license. Changes can take up to 48 hours to apply.

Co-management with Configuration Manager. Enrolling existing Configuration Manager devices through auto-enrollment requires Microsoft Entra ID P1 or P2 for each user plus Intune Plan 1; Microsoft notes you no longer assign individual Intune licenses for that scenario, but still do for every other enrollment path. The Entra ID P1 dependency matters for Business Basic and Standard tenants, whose rows carry neither.

Work down the tenant, not up the price list.

1. Pull the license report and count seats carrying the Microsoft Intune service plan: every Business Premium, E3, E5, F1 and F3 seat. Those users are done at Plan 1.
2. Count Business Basic, Business Standard, Office 365 E1 and E3 users who need managed devices. Add Intune Plan 1, or compare a plan move; remember that Conditional Access on those devices also needs Entra ID P1, which Business Premium and E3 include and the Business Basic and Standard rows do not.
3. Count shared and user-less devices and put them on device licenses, accepting the loss of Conditional Access on those devices.
4. Confirm the number under Tenant administration > Tenant status, where the admin center shows total licensed users and total Intune licenses.
5. Only then list the advanced capabilities you will actually use in the next twelve months, and price the standalone add-ons against the Suite.

Our Microsoft Intune Initial Setup for Windows Device Management service starts from that count, and the Managed Microsoft Intune Service keeps the compliance and app policies current afterwards. If the tenant has grown by acquisition, the Microsoft 365 License Audit and Optimization service finds the Intune add-ons nobody remembers buying.

Does Microsoft 365 Business Premium include Intune?

Yes. The service plan reference lists the Microsoft Intune service plan in Business Premium, with Entra ID P1 and Defender for Business. Business Basic and Business Standard do not include it.

Is Intune Plan 2 included in Microsoft 365 E5?

No. The E5 row carries the Intune Plan 1 service plan only. Plan 2, Remote Help and Endpoint Privilege Management are add-ons, or arrive with the Intune Suite.

Can I buy Remote Help without the Suite?

Yes. Our page lists it as a standalone add-on to an existing Intune plan, and it is also one of the five components of the Intune Suite.

Do administrators need an Intune license?

Not to sign in to the admin center on tenants created after July 2021; older tenants enable the unlicensed-admin setting once, irreversibly. Features that depend on Entra ID P1 or P2 still need those licenses.

Do kiosks and shared devices need a user license?

No. Intune's device-only subscription covers them when they enroll through the listed user-less methods, but those devices lose Conditional Access, app protection policies and user-based features.

• Microsoft Learn: Microsoft Intune licensing
• Microsoft Learn: Microsoft Intune advanced capabilities
• Microsoft Learn: Use Endpoint Privilege Management with Microsoft Intune
• Microsoft Learn: Remote Help in Microsoft Intune (product overview page)
• Microsoft Learn: Product names and service plan identifiers for licensing (Microsoft Entra ID)
• IT Partner: subscription pages for Microsoft Intune Plan 1, Plan 2, Intune Suite, Remote Help and Endpoint Privilege Management

Microsoft's Intune plans and pricing page, which it cites for the Plan 2 versus Suite split, was not reproduced; the text says where to check.