Intune Plan 1 vs Plan 2 vs the Suite. What each covers and when to pay for it.

Most enterprises already own Plan 1. Plan 2 adds three capabilities for $4.00, and the $10.00 Suite only pays for users who need four or more of its six components.

How do Intune Plan 1 and Plan 2 differ?

Plan 1 is the core Intune product, and most enterprises already own it. Plan 2 is a $4.00 per user monthly add on that sits on top of Plan 1 and adds three capabilities: Microsoft Tunnel for MAM on unenrolled devices, specialty device management, and firmware over the air updates.

Plan 1 lists at $8.00 per user monthly on its own, but you pay $0 extra for it inside Microsoft 365 E3, E5, Business Premium and EMS E3. Microsoft's pricing page also lists it inside F1, F3 and EMS E5. If your users hold any of those plans, Plan 1 is already paid for.

What Plan 1 already covers

Plan 1 gives you MDM and MAM across iOS, Android, Windows and macOS, compliance policies tied to conditional access, Autopilot, app deployment, configuration profiles, and Microsoft Tunnel on enrolled devices. For a knowledge worker with an enrolled laptop and phone, that is the whole job.

Which users need Plan 2?

Plan 2 earns its $4.00 only where one of its three capabilities is in use. In practice that means five groups of users:

• Clinical staff on shared hardware. Devices running in Microsoft Entra shared device mode count as specialty devices, and Microsoft asks for one specialty license per user of the device, not one per device.
• Field engineers on rugged Android. Firmware over the air on managed Android, such as Microsoft's integration with Zebra LifeGuard Over the Air.
• Retail kiosk associates. Only where the kiosk hardware is a specialty or shared mode device. Standard kiosk profiles on Windows and Android dedicated devices are Plan 1 features.
• Mixed reality headsets. Apple Vision Pro, RealWear and HTC headsets need Plan 2. Microsoft's own page says HoloLens needs only Plan 1, and Teams Rooms and Surface Hub are covered by a Teams Rooms Pro license or equivalent, so neither justifies Plan 2 on its own.
• Contractors on their own phones. The BYOD population that reaches internal apps through Tunnel for MAM without enrolling the device.

Plan 2 does not include Remote Help, Endpoint Privilege Management, Advanced Analytics, Cloud PKI or Enterprise Application Management. Microsoft's documentation for each of those five carries the same sentence: a subscription in addition to Plan 1 or Plan 2 is required.

Does Microsoft Tunnel require Intune Plan 2?

No, not on enrolled devices. Microsoft's Tunnel prerequisites page lists a Plan 1 subscription as the licensing requirement for ordinary per app VPN on enrolled iOS and Android, and notes that Tunnel for MAM is the advanced capability that needs extra licensing.

This sentence decides more money than any other line in the Intune decision. We regularly see Plan 2 justified to a CFO on per app VPN for enrolled iPhones. That case falls apart once someone reads the prerequisites page. Tunnel for MAM only matters when the device is not enrolled, which in most companies means contractors and personal phones.

What changed for Microsoft 365 E3 and E5 customers in July 2026?

Microsoft moved most Intune add ons into its suites. Its December 2025 announcement added Remote Help, Advanced Analytics and Intune Plan 2 to Microsoft 365 E3 and E5, and its licensing update gives the same three to EMS E3 and, through it, EMS E5. Microsoft 365 E5 alone also gets Endpoint Privilege Management, Enterprise Application Management and Cloud PKI.

The new suite prices took effect on July 1, 2026, and customers on multi year agreements move to them at their first renewal after that date. The features do not wait for your renewal. Microsoft's FAQ says every qualifying tenant receives them, whatever price or term it is on, with rollout complete by August 1, 2026.

What a Microsoft 365 E3 or EMS E3 customer still pays for

An E3 user now lacks only three components: Endpoint Privilege Management, Cloud PKI and Enterprise Application Management. Bought standalone they total $7.00 per user monthly, below the $10.00 Suite. Microsoft still sells the Suite and every add on separately, but for these users the Suite can no longer pay for itself, so buy the components you use one by one.

Which subscriptions become duplicates at renewal?

Standalone Plan 2, Remote Help and Advanced Analytics seats on Microsoft 365 E3, E5 or EMS E3 users now duplicate what those plans include. A Suite seat on an E3 user now buys only the three components above, worth $7.00 standalone. Because the features arrive before your price changes, you may be paying twice until you act.

• When to cut. At the first anniversary where your agreement allows add on reductions, and at renewal at the latest. Get the date confirmed in writing.
• Who is unaffected. Business Premium, frontline F1 and F3, and standalone Plan 1 were not named in the change, so the component arithmetic below still applies to those users in full.

When is the Intune Suite worth it over standalone add ons?

The Suite is worth it for any user who needs four or more of its six components, never for one or two, and sometimes for three. The six components total $19.50 at list and the Suite carries all six for $10.00, a 48.7 percent saving, with Plan 1 still required underneath.

• One or two components. Buy standalone. The most expensive pair, Advanced Analytics plus Plan 2, reaches only $9.00.
• Four or more. Buy the Suite. The four cheapest components already total $10.50.
• Exactly three. Add them up. Three components range from $7.00 to $12.50 depending on the mix.

No rule of thumb replaces the addition for three components. It takes a minute per persona, and the wrong SKU bills for every year of the agreement.

Why we advise against one Intune SKU for everyone

Resellers and some account teams recommend the Suite for every user, because one SKU is simpler to administer and the headline discount looks generous. We disagree. A knowledge worker whose only need is Remote Help costs $3.50 standalone, and putting that user on the $10.00 Suite buys nothing they will use.

Assign licenses by persona through Entra ID groups instead. Group based licensing makes two SKUs no harder to run than one, and it gives you the per group counts you need at each anniversary.

How is Remote Help licensed, and why does it cause findings?

Remote Help at $3.50 is licensed for both the helper and the sharer. Every user who might receive an attended support session needs a license, so a company with 12,000 users needs 12,000 licenses, not one for each of the 40 people on the service desk.

Deployments scoped to the service desk are therefore under licensed from day one. In our reviews, Remote Help and Endpoint Privilege Management together accounted for roughly seven in ten of the Intune findings we raised. Neither is part of Plan 2, so a tenant that owns Plan 2 has no cover for either.

How the July 2026 change affects Remote Help

Once the rollout reaches your tenant, E3 and E5 users (including EMS E3) have Remote Help on both sides of the session, which removes this exposure. It stays live for Business Premium, frontline F1 and F3 users, and anyone on standalone Plan 1. Endpoint Privilege Management stays a paid add on for everyone below Microsoft 365 E5.

What does a two SKU approach save on a 12,000 user company?

On our worked example of 12,000 users, splitting the population by persona costs $1,026,300 a year against a single SKU proposal of $1,440,000, a saving of $413,700 a year. The single SKU figure is simply 12,000 users on the Suite at $10.00 for 12 months.

The table below shows one hypothetical split that produces that total. The heavy personas who use four or more components get the Suite. Everyone else gets only the add ons they use, and everyone keeps Remote Help because both ends of a session need it.

Every non Suite row stays at two components, which is why standalone wins there. If the frontline group also needed Endpoint Privilege Management, its cost would reach $10.50 and those users would move to the Suite. The saving comes from reading the usage reports that the proposal deck ignored.

The table uses list prices from before the July 2026 change. Put the same 12,000 users on Microsoft 365 E3 after the rollout and Plan 2 and Remote Help cost nothing extra. The 2,450 heavy users then need $7.00 of add ons ($205,800 a year), the 6,000 need EPM at $3.00 ($216,000), and the total falls to $421,800.

What the account team will say, and what to say back

• "The Suite is half the price of its parts, so it is the cheaper option." It is cheaper only for a user who needs four or more components. Show them your persona table and ask for pricing on the standalone lines.
• "You need Plan 2 for Tunnel." Point to the Tunnel prerequisites page, which asks for Plan 1 on enrolled devices.
• "Remote Help only needs licensing for your technicians." Ask them to confirm that in the contract. Microsoft's licensing covers helper and sharer, and a verbal assurance does not survive an audit.
• "Keep the add ons until renewal, when E3 picks up the new features." Microsoft's FAQ says qualifying tenants receive the features regardless of price paid or agreement term. Ask for the add on reduction at the next anniversary instead.
• "Upgrade to E5 to get Endpoint Privilege Management, Cloud PKI and app management." Price those three at $7.00 standalone first, then compare with the E5 step up for the same users.

What have we seen in recent Intune renewals?

We reviewed roughly 35 to 45 Microsoft endpoint environments between 2024 and 2025. In nearly all of them the Intune line had been sized from a proposal deck, and the admin center reports that would have priced it had never been opened.

• Suite oversizing. Suite seats exceeded the seats that had touched any Suite capability in the prior 30 days by 30 to 50 percent.
• Misplaced Plan 2. In 25 to 40 percent of cases, Plan 2 sat on knowledge workers with no specialty device and no unenrolled Tunnel client.
• Remote Help and EPM. These two drove roughly seven in ten findings, mostly through service desk scoping.

Every number in the Intune decision is on a Microsoft page or in a Microsoft report, so the buyer's case can be built entirely from the vendor's own sources.

Microsoft publishes the list price of every SKU and documents the plan boundaries on its own pages, including the Tunnel sentence above. The usage data sits in the admin centers, as the next section shows.

How do you check which Intune components your users actually use?

Use the Intune admin center and the Microsoft 365 admin center, and pull 30 days of data per component before any proposal review. Map the results to Entra ID groups so each persona has a measured component count.

1. Licenses assigned. Microsoft 365 admin center, Billing, Licenses: seats bought and assigned per SKU, including Suite, Plan 2 and each add on.
2. Remote Help sessions. Intune admin center, Tenant administration, Remote Help, Monitor: who gave and received sessions.
3. Endpoint Privilege Management. Endpoint security, Endpoint Privilege Management, Reports: elevation activity by user and device.
4. Advanced Analytics. Reports, Endpoint analytics, plus device query use: whether anyone outside IT looks at them.
5. Tunnel for MAM and specialty devices. Tunnel Gateway health and connected users, plus device inventory filtered by platform and ownership, to find unenrolled clients and specialty hardware.
6. Cloud PKI and Enterprise Application Management. Tenant administration, Cloud PKI, and the Enterprise App Catalog under Apps: whether any certificate authority or catalog app is in production.

Common sizing mistakes and what they cost

• Licensing Remote Help for the service desk only. The sharers are unlicensed, which becomes an audit finding priced at list.
• Buying Plan 2 for enrolled Tunnel. $4.00 per user monthly for a capability Plan 1 already provides.
• Renewing Suite seats as signed. Without the 30 day check, unused Suite seats carry into the next term.
• Keeping add ons after the rollout reaches your E3 and E5 users. You pay twice for Remote Help, Advanced Analytics and Plan 2.

What Intune terms should you ask for at the EA renewal?

Ask for the Suite price to be locked for the full EA term. Microsoft's default position is an annual reprice on the Suite, and a Suite discount that floats from year to year shrinks as Microsoft takes it back.

• Price hold for the term. Fixes the Suite and each add on at the signed rate for all years of the agreement.
• Annual persona revalidation. The right to move users between the Suite and standalone add ons at each anniversary based on measured usage, rather than renewing the Suite population as signed.
• Reduction rights on add ons. The right to drop standalone Plan 2, Remote Help and Advanced Analytics as users move onto a suite that includes them.
• Written Remote Help scope. States that both helper and sharer are covered for the licensed population, so an auditor and your contract read the same way.

The endpoint security tier decision next door runs in our Defender P1 versus P2 analysis. The SKU layer above sits in the license types comparison and the E3 versus E5 versus F3 guide.

For the wider picture, the Microsoft overspending report covers five categories of overspend, the E5 shelfware guide covers unused suite capability, and the Enterprise Agreement guide covers the renewal structure the Intune line is negotiated inside.

What to do next

1. Before any proposal review. Export 30 days of component usage from the Intune admin center and map it to persona groups.
2. Test every Plan 2 seat. Keep it only where a specialty device, an unenrolled Tunnel client or firmware over the air is in use.
3. Count Remote Help at both ends. Every user who can receive a session needs a license unless their suite now includes it.
4. Run the component addition per persona. One or two components standalone, four or more on the Suite, three added by hand.
5. Remove duplicates. Cancel add ons that your E3 or E5 plans now include at the first anniversary your agreement allows, or at renewal.
6. Lock the price. Ask for the Suite and add on rates held for the full EA term. Our Microsoft practice runs the sizing with you.

Frequently asked questions