Microsoft Intune now ships as a base plan inside Microsoft 365 and a set of paid add ons. The buyer question is rarely Plan 1 or Plan 2. It is whether you already own what you are about to buy again.
Intune Plan 1 is included in Microsoft 365 E3 and E5, so most enterprises already own it. Plan 2 and the Suite add ons solve narrow problems most estates do not have.
Microsoft renamed and repackaged Intune several times. The plan names changed, the licensing logic did not. The base service does the work most enterprises need.
The buyer mistake is treating Plan 2 and the Suite as upgrades everyone needs. They are targeted add ons. Read what each tier contains before the renewal quote arrives.
Plan 1 is the complete mobile device and mobile application management service. It covers enrollment, configuration, compliance policy, conditional access integration, and application deployment across Windows, macOS, iOS, and Android.
Microsoft documents Plan 1 as the included tier within Microsoft 365 E3 and E5. If you hold those suites, you hold Plan 1. The Microsoft Intune licensing guidance sets out the exact suite mapping.
Intune tiers and where the value lands (2026)
| Tier | Included in | Adds | Typical right fit |
|---|---|---|---|
| Plan 1 | M365 E3, E5, F1, F3, EMS | Core MDM and MAM | All managed users |
| Plan 2 | Add on to Plan 1 | Tunnel, advanced analytics, specialty devices | Frontline and specialty teams |
| Intune Suite | Add on bundle | Plan 2 plus Remote Help, EPM, Cloud PKI | Service desk and security teams |
| Standalone P1 | Sold per user | Base service for non suite estates | Estates without E3 or E5 |
Plan 2 is an add on, not a replacement. It layers three capabilities on top of the base service. None of them change how core device management works.
Microsoft positions these features against specific scenarios. The endpoint security documentation describes where each fits. If those scenarios do not apply, Plan 2 buys you nothing you will use.
The Suite bundles Plan 2 with Remote Help, Endpoint Privilege Management, Microsoft Cloud PKI, and advanced analytics at one per user price. It is the most oversold line in the endpoint stack.
The Suite earns its price only where multiple premium features land on the same user group. For a service desk running Remote Help daily, or a team removing local admin rights through Endpoint Privilege Management, the math works. Across a whole tenant it rarely does. Confirm the exact rights in the Microsoft Product Terms before you sign.
Intune add ons license per user. You can assign the Suite to 300 service desk and security staff and leave the other 9,700 on Plan 1. Microsoft sales motion pushes tenant wide. The buyer move is to scope tight.
Start from what you already own. If E3 or E5 covers the population, Plan 1 cost is zero incremental. Model add ons only against the users who will use the feature.
Microsoft publishes plan and feature comparisons on its Intune pricing page. Use it to separate base from add on, then map each add on to a named group before you accept a quote.
The benchmark we apply is simple. Premium add on spend should track adoption, not headcount. If a feature reaches under a third of the seats it is licensed on, it is shelfware.
The standard reseller pitch is that Plan 2 or the Intune Suite is the modern baseline every estate should adopt at renewal. We disagree. In roughly 7 of 10 Microsoft estates we reviewed, Plan 1 was already paid for inside E3 or E5, and premium add on adoption never crossed 20 percent of the seats it was sold against. Buying the Suite tenant wide converts a per user upgrade into estate wide shelfware. The buyer side move is to license add ons by named group, pilot for a quarter, and expand only where measured adoption justifies the line. Scope beats bundle every time.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
The Intune question is almost never which plan to buy. It is whether you are about to buy a plan you already own.
Yes. Intune Plan 1 is included in Microsoft 365 E3 and E5 for every licensed user. If you hold those suites you already own the full base device and application management service.
Plan 1 is the complete base service for device and application management. Plan 2 is an add on that layers Microsoft Tunnel for mobile, advanced endpoint analytics, and specialty device management on top.
No. Plan 2 features serve narrow scenarios such as frontline and specialty device teams. Most users get full value from Plan 1, which is already included in E3 and E5.
The Intune Suite is an add on bundle that combines Plan 2 with Remote Help, Endpoint Privilege Management, Microsoft Cloud PKI, and advanced analytics at a single per user price.
Yes. Intune add ons license per user, so you can assign the Suite to a service desk or security team and leave everyone else on Plan 1. Buy by group, not tenant wide.
Confirm your Microsoft 365 suite entitlements first. Many estates carry a separate Intune line while already owning Plan 1 through E3 or E5, which is a duplicate purchase.
No. Plan 2 is purchased in addition to Plan 1 rights. It does not replace the base service and it does not change how core device management functions.
Track spend against adoption, not headcount. If a premium add on reaches under a third of the seats it is licensed on, treat it as shelfware and cut it at the next true up.
Microsoft renewal moves, the EA framework, the M365 SKU framework, the Copilot framework, and the buyer side moves across the full Microsoft estate.
Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.
Buyer side advisory across the full Microsoft estate.
Read →Guides, playbooks, and benchmarks for Microsoft licensing.
Read →Model your suite mix and find duplicate entitlements.
Read →We sit on your side when you negotiate with the major software publishers. Independent, benchmarked, and built for the renewal in front of you.
Contact Us