MICROSOFT LICENSING · MODULE 3 · INTUNE
Microsoft Intune:
Which licence do you need for device management and security?
Microsoft Intune manages laptops, phones, tablets, and apps centrally. The right licence depends on existing Microsoft 365 entitlements, required capabilities, and whether a named user or dedicated device is managed.
The short answer
Plan 1 provides the foundation. Plan 2 and Intune Suite add advanced capabilities.
Check existing Microsoft 365 service plans first. Intune Plan 1 may already be included; advanced add-ons still require their appropriate base entitlement.
- 01Intune Plan 1 provides core device and application management.
- 02Intune Plan 2 and Intune Suite are add-ons to Plan 1.
- 03Device-only licences can cover eligible kiosks and shared devices without user affinity.
- 04Device-only management does not support Conditional Access or user-based app protection.
- 05An administrator does not always need a separate Intune licence merely to access the admin centre.
Start with the basics
What does Microsoft Intune actually do?
Intune enrols devices, applies settings, distributes apps, and supports security and compliance decisions.
Manage laptops and mobile devices
Enrol corporate devices, deploy configuration, and monitor device health.
Deploy and protect applications
Manage applications and, where supported, protect company data on personal devices.
Apply device policies
Check encryption, operating-system versions, and other compliance requirements.
Combine device signals with Entra
Conditional Access has separate Entra licensing requirements even when it uses Intune device information.
Compare licensing models
Plan 1, Plan 2, Intune Suite, or device-only?
Advanced plans extend the existing Plan 1 entitlement rather than replacing it.
| Capability or product | Typical licence | What to check |
|---|---|---|
| Intune Plan 1 | Base licence or included Microsoft 365 entitlement | Core cloud-based device and application management. |
| Intune Plan 2 | Add-on to Plan 1 | Advanced capabilities including Remote Help and Advanced Analytics under current Microsoft guidance. |
| Intune Suite | Add-on to Plan 1; includes Plan 2 | Combines advanced endpoint management and security, including eligible premium capabilities. |
| Device-only subscription | Per eligible device | Dedicated, kiosk, meeting-room, or shared-device scenarios without user affinity. |
Check before buying
Which subscriptions may already include Intune?
Microsoft lists bundles such as Microsoft 365 E3, E5, and E7. Verify Business Premium, EMS, Frontline, Education, or Government rights against the exact SKU.
Microsoft 365 E3, E5, and E7
Check the actual Intune service plan before buying duplicate base licences.
Microsoft 365 Business Premium
Check existing device-management rights before purchasing an additional standalone entitlement.
EMS, Frontline, Education, and Government
Eligibility and included rights differ by bundle, user type, and agreement.
Plan 2 or Suite only when needed
Basic device enrolment does not automatically justify a premium add-on.
Who actually needs a licence?
When is a user or device licence required?
Microsoft requires an appropriate licence for each user or device directly or indirectly benefiting from Intune.
Named users
User-based management, app protection, and personal device scenarios require the appropriate user entitlement.
Eligible shared devices
A device-only subscription can fit supported enrolment methods without user affinity.
Device-only restrictions
Device-only licences do not support Intune app protection policies, Conditional Access, or user-based management.
Unlicensed administrator access
The Intune admin centre can support unlicensed administrators under documented conditions; other product requirements still apply.
A practical example
200 employees and 15 shared tablets
An organisation already has 200 Microsoft 365 E3 subscriptions and also operates 15 dedicated shared tablets.
Check existing E3 rights
If Intune Plan 1 is already included, avoid buying the same core entitlement twice.
Assess device-only licensing
Eligible dedicated tablets may be covered per device when no unsupported user-based capabilities are required.
Add only required functionality
Evaluate Remote Help, advanced analytics, or other premium capabilities for their actual users and prerequisites.
Practical checklist
Practical checklist
- 01Which devices and operating systems must be managed?
- 02Does an existing Microsoft 365 or EMS subscription already include Intune Plan 1?
- 03Are devices assigned to named users or eligible shared-device scenarios?
- 04Are Conditional Access, app protection, or other user-based capabilities required?
- 05Which premium capability is genuinely needed?
- 06Does every add-on have its required Plan 1 base entitlement?
- 07Which administrators actually require a licence?
LizenzFrau principle
Check existing entitlements first. Then assess users, devices, and premium features separately.
The right Intune decision depends on device ownership, enrolment method, existing base rights, and the actual management requirement.
Official Microsoft sources
Official Microsoft sources
Product capabilities, prerequisites, and usage rights can change. The current Microsoft Product Terms and the actual agreement are authoritative.
Note: This article provides practical guidance and does not replace an individual agreement, licensing, or legal assessment.