If your team runs on Microsoft 365 Business Premium, E3, or E5, you almost certainly already own Microsoft Intune, and many businesses pay for it a second time without realizing. Here is the Intune licensing landscape in plain language, how to pick the right plan, and where the money leaks.
Intune is Microsoft's tool for managing and securing company laptops and phones: enforcing settings, pushing apps, requiring encryption and a PIN, and wiping a lost device. The confusion is never about what it does. It is about which plan you need, which ones you already have, and what you should stop paying for. (Licensing details here are current as of mid-2026; Microsoft adjusts these regularly, so treat the plan names as the stable part and confirm exact inclusions before you buy.)
The three Intune plans
Microsoft organizes Intune into three plans. Each one builds on the one before it:
- Intune Plan 1 is the base service, and it is what most small businesses need. Cross-platform device management (Windows, macOS, iOS, Android, Linux), mobile app management, app protection policies, conditional access, and basic analytics.
- Intune Plan 2 is an add-on to Plan 1. It layers on more advanced management, including Remote Help, Advanced Analytics, Microsoft Tunnel for mobile app access, and management of specialized or rugged devices.
- Intune Suite is the full bundle. It includes everything in Plan 2 and adds Endpoint Privilege Management (granting admin rights per approved app instead of leaving people as local admins), Enterprise Application Management (a curated app catalog with packaging and updates), and Microsoft Cloud PKI (certificate management without running your own on-premises servers).
You probably already have Intune
This is the part that saves the most money. Intune Plan 1 is bundled into the plans small businesses most commonly buy:
- Microsoft 365 Business Premium includes Intune Plan 1. If you are on Business Premium, you already have full device management, and you do not need to buy Intune separately.
- Microsoft 365 E3 and Enterprise Mobility + Security (EMS) E3 include Intune Plan 1.
- Microsoft 365 E5 and EMS E5 include Intune Plan 1.
The higher tiers are also changing. As of July 2026, Microsoft is folding advanced Intune Suite capabilities into E3 and E5, which we covered in our note on the Intune Suite bundling into Microsoft 365. If you do not have any of these bundles, Intune Plan 1, Plan 2, and the Suite can also be bought as standalone subscriptions.
Per user or per device?
By default, Intune is licensed per user, which covers all of that person's enrolled devices, laptop, phone, and tablet alike. That is the right model for staff who have their own assigned equipment.
There is also a cheaper device-only subscription for endpoints that are not tied to one person: shared kiosks, front-desk tablets, dedicated single-purpose devices, and the like. The trade-off is that device licenses do not support user-based features such as conditional access, app protection policies, or email and calendar management. Used in the right place, though, a handful of device licenses for shared hardware can be noticeably cheaper than assigning a full user license to a machine nobody logs into personally.
How to pick the right plan
For most small businesses the decision is simpler than the option list suggests:
- A typical 1 to 50 person team managing staff laptops and phones with normal security needs is well served by Intune Plan 1, which you already get with Business Premium. Do not overthink it.
- If you need remote support at scale, deeper device-health analytics, secure mobile app access, or you manage rugged or specialized devices, add Plan 2 for the users who need it.
- If you are security-forward or face compliance pressure and want to remove standing local-admin rights, manage certificates cleanly, or run a governed app catalog, the Intune Suite (or Microsoft 365 E5, which now includes it) is the fit.
Notice that the advanced tiers are usually needed by some users, not everyone. You rarely have to license the whole company at the top tier.
Where the money leaks: cost-saving opportunities
- Do not buy Intune you already own. The most common waste is a standalone Intune subscription sitting on top of Business Premium or E3, which already include Plan 1. Check before you renew.
- Do not double-buy the Suite add-on. With the Suite now folding into E3 and E5, a separately purchased Intune Suite add-on may become redundant once the bundled version reaches your tenant. Review it and drop it if so.
- Right-size the advanced tiers. Assign Plan 2 or the Suite only to the users who actually use those features, rather than blanket-licensing everyone at the higher price.
- Use device licenses for shared hardware. Kiosks, shared tablets, and single-purpose devices can run on cheaper device-only licenses instead of full per-user ones.
- Do not stack overlapping bundles. Carrying EMS E3 alongside a Microsoft 365 plan that already includes Intune, or mixing plans across the team without a map, quietly pays for the same capability twice.