For years, one of the biggest conversations around Microsoft Intune has not been about its capabilities, but about licensing.
Many organizations knew that features such as Remote Help, Endpoint Privilege Management, Enterprise App Management, Cloud PKI, and Advanced Analytics could solve real-world IT challenges. The problem was that many of these capabilities required separate Intune Suite or individual add-on licenses, making them difficult to justify from a budget perspective.
That is now changing.
Beginning July 1, 2026, Microsoft is significantly expanded what is included with Microsoft 365 E3 and Microsoft 365 E5. Instead of purchasing many of these capabilities separately, organizations will now receive them as part of their existing Microsoft 365 licensing, depending on their subscription level. Eligible tenants are expected to receive these capabilities automatically over the following weeks.
This is one of the biggest licensing improvements Intune has seen in years and has the potential to simplify licensing decisions while helping organizations get much more value from the Microsoft ecosystem.
Why This Matters
Many organizations today rely on a mixture of Microsoft technologies alongside third-party tools for:
- Remote support
- Endpoint analytics
- Application management
- Certificate management
- Privilege management
- Mobile device management
Over time this often leads to:
- Multiple vendors
- Multiple contracts
- Different management consoles
- Higher licensing costs
- More administrative overhead
Microsoft’s latest licensing change is clearly focused on reducing that complexity by bringing many advanced endpoint management capabilities directly into Microsoft 365.
Rather than asking customers to purchase another add-on, Microsoft is making several premium Intune capabilities part of the core enterprise licensing experience.
What’s Included in Microsoft 365 E3?
Organizations licensed with Microsoft 365 E3 (or EMS E3) now gain access to:
- Intune Plan 2
- Intune Remote Help
- Intune Advanced Analytics
Let’s look at what each one provides.
Intune Plan 2
Many administrators think of Intune Plan 2 as simply “more Intune.”
In reality, Plan 2 unlocks several advanced management scenarios beyond the standard Intune capabilities.
These include support for:
- Microsoft Tunnel for Mobile Application Management
- Firmware Over-the-Air updates
- Specialty device management
- Expanded endpoint management capabilities
For organizations managing rugged devices, frontline workers, warehouse equipment, healthcare devices, kiosks, or shared endpoints, these capabilities can make a significant difference. Instead of relying on multiple management products, administrators can manage more device types directly from Intune.
Intune Remote Help
Remote support has become essential in today’s hybrid workplace.
Intune Remote Help allows help desk technicians to securely connect to managed Windows devices directly from Intune.
Key benefits include:
- Secure remote assistance
- Role-based permissions
- UAC elevation during support sessions
- Session auditing
- Integration with Microsoft Entra ID
- Support for zero trust principles
Instead of purchasing a third-party remote support solution, organizations may now find that Remote Help satisfies many of their day-to-day support requirements.
For many IT teams, this alone could eliminate another licensing expense.
Intune Advanced Analytics
Endpoint Analytics has been available for several years, but Advanced Analytics takes things much further. IT admins gain much deeper visibility into device health and user experience.
Capabilities include:
- Device Query
- Battery health reporting
- Performance trends
- Fleet-wide visibility
- Anomaly detection
- Faster troubleshooting
Rather than waiting for users to report problems, administrators can proactively identify devices showing abnormal behavior before they become widespread issues.
This shifts endpoint management from being reactive to proactive.
What Additional Features Does Microsoft 365 E5 Receive?
Organizations running Microsoft 365 E5 receive everything included in E3, plus several additional enterprise-grade security and management capabilities:
- Endpoint Privilege Management
- Microsoft Cloud PKI
- Enterprise App Management
- Microsoft Security Copilot
These are some of the most requested capabilities from the original Intune Suite.
Endpoint Privilege Management (EPM)
One of the biggest security challenges organizations face is balancing security with user productivity. Many users still require administrator rights for specific applications or tasks.
Historically, organizations often solved this by giving users permanent local administrator privileges, creating unnecessary security risks. Endpoint Privilege Management changes that approach.
Instead of granting full administrator rights, IT can:
- Elevate only approved applications
- Elevate only approved installers
- Control elevation through policies
- Require business justification
- Audit every elevation event
This supports a least-privilege security model while allowing users to remain productive.
For organizations adopting Zero Trust security principles, EPM is a major step forward.
Microsoft Cloud PKI
Managing certificates has traditionally required on-premises certificate authorities and significant infrastructure.
Cloud PKI modernizes this experience.
Organizations can issue and manage certificates directly through Microsoft’s cloud services for:
- Wi-Fi authentication
- VPN authentication
- Device authentication
- Certificate-based authentication
Benefits include:
- Reduced on-premises infrastructure
- Simplified certificate lifecycle management
- Better cloud integration
- Easier deployment for remote users
For cloud-first organizations, this removes another dependency on traditional infrastructure.
Enterprise App Management
Application management is one of the most time-consuming tasks for IT administrators.
Packaging.
Testing.
Updating.
Monitoring.
Repeating the process every month.
Enterprise App Management helps reduce this workload by providing Microsoft-maintained application packages for many common third-party applications.
Administrators can:
- Deploy applications
- Keep applications updated
- Reduce packaging effort
- Improve application compliance
Organizations already using automated application management solutions will recognize the value immediately.
Microsoft Security Copilot
Microsoft is also bringing Security Copilot into Microsoft 365 E5.
Rather than replacing administrators, Security Copilot acts as an AI assistant for security operations.
It can help with:
- Threat investigations
- Security analysis
- Incident response
- Summarizing security events
- Guided troubleshooting
As organizations continue adopting AI-powered security workflows, this becomes another valuable capability included with E5 licensing.
Feature Comparison
| Capability | Microsoft 365 E3 | Microsoft 365 E5 |
|---|---|---|
| Intune Plan 2 | ✅ | ✅ |
| Remote Help | ✅ | ✅ |
| Advanced Analytics | ✅ | ✅ |
| Endpoint Privilege Management | ❌ | ✅ |
| Cloud PKI | ❌ | ✅ |
| Enterprise App Management | ❌ | ✅ |
| Microsoft Security Copilot | ❌ | ✅ |
What About Existing Intune Suite Customers?
Organizations that already purchased Intune Suite are not losing functionality.
Instead, Microsoft is moving many of these capabilities into the Microsoft 365 licensing bundles.
Customers using other Microsoft licensing plans outside Microsoft 365 E3 or E5 can still purchase these capabilities separately through Intune Suite or individual add-ons if needed.
What This Means for IT Organizations
This licensing update has several practical implications.
Lower Licensing Costs
Many organizations may no longer need separate licensing for capabilities they were already paying for independently.
Fewer Third-Party Products
Remote support, certificate management, analytics, privilege management, and application management can increasingly be handled within Microsoft’s ecosystem.
That means:
- fewer vendors
- fewer contracts
- fewer support portals
- simpler procurement
Better Security
Capabilities like Endpoint Privilege Management and Cloud PKI help organizations strengthen their security posture while supporting Zero Trust initiatives.
Improved Operational Efficiency
Having these capabilities integrated into Intune means administrators spend less time switching between different products and more time managing endpoints from a single console.
Are There Any Downsides?
While this announcement is overwhelmingly positive, there are a few considerations.
Organizations already invested in mature third-party products should evaluate whether Microsoft’s integrated capabilities meet all of their operational requirements before replacing existing tools.
In addition, Microsoft introduced these licensing enhancements alongside broader Microsoft 365 pricing changes that took effect on July 1, 2026. Organizations should evaluate both the additional capabilities and the updated subscription costs when assessing overall value.
Final Thoughts
This is one of the most significant Intune licensing announcements Microsoft has made in recent years.
For many organizations, advanced endpoint management is no longer something reserved for customers willing to purchase additional Intune Suite licenses. Instead, many of these capabilities are becoming part of the Microsoft 365 experience that enterprises already use every day.
If your organization is running Microsoft 365 E3, you’ll gain powerful tools like Remote Help, Advanced Analytics, and Intune Plan 2 without additional licensing complexity.
If you’re on Microsoft 365 E5, the value proposition becomes even stronger with Endpoint Privilege Management, Microsoft Cloud PKI, Enterprise App Management, and Microsoft Security Copilot included.
For IT administrators, this means more capabilities, better security, simplified licensing, and a stronger case for consolidating endpoint management within the Microsoft ecosystem. It also presents a good opportunity to revisit your current licensing strategy, evaluate any overlapping third-party tools, and ensure you’re taking full advantage of the capabilities that are now included in your Microsoft 365 subscription.
