Intune, sized from a slide when the admin center had the answer
Plan 1 is already bought, $8.00 standalone at list and included in E3, E5, Business Premium, and EMS E3, with Microsoft Tunnel on enrolled devices sitting there and not in Plan 2: Plan 2 at $4.00 covers three things, specialty devices, Tunnel for MAM on unenrolled devices, and firmware over the air, and the Suite at $10.00 against $19.50 of parts is a real 48.7 percent discount earned only on seats that use four of the six components. In nearly every estate we reviewed, the Intune line had been sized from a proposal deck, and nobody had opened the reports that would have priced it.
Prepared by Redress Compliance · August 8, 2026 · Microsoft advisory. Based on 35 to 45 Microsoft endpoint estates reviewed 2024 to 2025.
Executive summary
The Tunnel sentence is the argument that costs the most money.
Microsoft's own prerequisites page asks for a Plan 1 subscription and nothing more for ordinary Tunnel on enrolled iOS and Android.
So a Plan 2 justified to the CFO on per app VPN for enrolled iPhones does not survive contact with that sentence: Plan 2's real scope is Tunnel for MAM on unenrolled devices, specialty device management for Vision Pro, HoloLens, Teams Rooms, and kiosks, and firmware over the air on managed Android.
And it sat on knowledge workers with no specialty device and no unenrolled Tunnel client in 25 to 40 percent of cases.
Remote Help licenses both sides, and it drove the findings.
Remote Help at $3.50 is licensed for the helper and the sharer, so a 12,000 user estate needs 12,000 licenses, not the 40 people on the service desk, and Remote Help plus Endpoint Privilege Management together accounted for roughly seven in ten of the Intune findings raised: neither is in Plan 2.
Alongside Advanced Analytics, Cloud PKI, and Enterprise Application Management, each carrying Microsoft's identical sentence that a subscription in addition to Plan 1 or Plan 2 is required.
The Suite discount is real and earned only at four components.
Six components at list total $19.50 and the Suite carries all six for $10.00, a 48.7 percent saving requiring the Plan 1 base underneath, and the arithmetic is exact: one or two components never beat the Suite the other way, the priciest pair at $9.00 staying standalone.
Four or more always favors the Suite, the four cheapest already totaling $10.50; and three is the only case needing arithmetic, swinging from $7.00 to $12.50, with ties taken as the Suite because the tie hands you the other three capabilities for nothing.
Two SKUs beat one, by $413,700 a year on the worked estate.
The persona split, the Suite on the heavy personas and standalone add ons on the rest, priced at $1,026,300 a year against the $1,440,000 single SKU proposal.
And the estate data supports the split everywhere: Suite seats exceeded the seats that had touched a Suite capability in the prior 30 days by 30 to 50 percent.
The renewal lever completes it, the Suite price locked for the full EA term against the default vendor position of an annual reprice, because the discount that floats is a discount that shrinks.
The component matrix, at published list
| Component | Standalone list per user monthly | In the Suite | What it buys |
|---|---|---|---|
| Intune Plan 1 | $8.00, or $0 inside E3, E5, BP, EMS E3 | Not included; required underneath | MDM, MAM, Autopilot, Tunnel on enrolled devices |
| Intune Plan 2 | $4.00 | Included | Specialty devices, Tunnel for MAM, firmware OTA |
| Remote Help | $3.50 | Included | Attended support, licensed helper and sharer both |
| Endpoint Privilege Management | $3.00 | Included | Standing admin removal, elevation rules |
| Advanced Analytics | $5.00 | Included | Anomalies, device query, resource performance |
| Cloud PKI and Enterprise App Management | $2.00 each | Included | Cloud certificate authority, third party patching |
The three component case is the only one that needs a calculator.
Plan 2 plus Remote Help plus EPM totals $10.50, take the Suite; Plan 2 plus Remote Help plus Cloud PKI totals $9.50, do not; Advanced Analytics plus EPM plus either $2.00 add on lands exactly on $10.00, and on the tie take the Suite because it hands you the other three capabilities free.
There is no rule of thumb, only the addition, and the addition takes a minute against the years the wrong SKU bills.
The plan scopes, from Microsoft's own pages
- Plan 1, already owned: MDM and MAM across iOS, Android, Windows, and macOS, compliance and conditional access, Autopilot, app deployment, configuration profiles, and Tunnel on enrolled devices, included in E3, E5, Business Premium, and EMS E3.
- Plan 2, three things: Tunnel for MAM inside managed apps on unenrolled devices, specialty device management, and firmware over the air, at $4.00.
- Not in Plan 2: Remote Help, EPM, Advanced Analytics, Cloud PKI, and Enterprise Application Management, each requiring its own additional subscription.
- The five Plan 2 personas: clinical staff on shared hardware, field engineers on rugged Android, retail kiosk associates, mixed reality and meeting rooms, and the contractor BYOD population on unenrolled Tunnel.
- Everyone else: the knowledge worker with an enrolled laptop and phone is fully served by the Plan 1 already inside their E3 or E5.
The Microsoft EA renewal playbook
The Intune line inside the wider renewal: the persona split, the Suite lock, and the SKU arithmetic worked end to end.
Get the white paper →The two SKU strategy, priced
The worked estate makes the persona split concrete: the Suite at $10.00 goes to the heavy personas who genuinely touch four or more components, the standalone add ons cover the narrower needs elsewhere, and the blended total lands at $1,026,300 a year against the $1,440,000 single SKU proposal.
A $413,700 saving from opening the usage reports the proposal deck ignored.
The Remote Help licensing model deserves its own audit line, both helper and sharer licensed, so the deployment scoped to the service desk is mis-scoped by construction, and it drove seven in ten findings alongside EPM.
The endpoint security tier decision next door runs in the Defender P1 versus P2 analysis, the SKU layer above in the license types comparison, the five category overspend frame in the Microsoft overspending report, and the renewal structure it all negotiates inside in the Enterprise Agreement guide.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across endpoint estates, 2024 to 2025
We reviewed roughly 35 to 45 Microsoft endpoint estates between 2024 and 2025, and in nearly all of them the Intune line had been sized from a proposal deck, with nobody having opened the reports that would have priced it:
Suite seats above the seats that touched any Suite capability in the prior 30 days.
Of cases with Plan 2 on knowledge workers holding no specialty device and no unenrolled client.
The file's lesson is that every number in this decision is checkable: Microsoft publishes the list price of every SKU, documents the plan boundaries on its own pages including the Tunnel sentence that settles the most expensive argument.
And exposes the component usage in the admin center reports nobody opened, which makes the Intune line the rare renewal item where the entire buyer case assembles from the vendor's own sources.
The renewal lever caps it, the Suite price locked for the full EA term against the default annual reprice, because the 48.7 percent discount that floats year to year is a discount being reclaimed.
Your first five moves
- Open the component usage reports before any proposal review, where 30 to 50 percent of Suite seats touched nothing.
- Test every Plan 2 seat against the three things it actually covers, since 25 to 40 percent sat on plain knowledge workers.
- Count Remote Help at both ends, the helper and sharer model that made 12,000 licenses of a 40 person desk.
- Run the component arithmetic per persona: one or two standalone, four or more Suite, three cases added by hand.
- Lock the Suite price for the full EA term, against the default annual reprice. The Microsoft practice runs the sizing with you.
Frequently asked questions
What is the difference between Intune Plan 1 and Plan 2?
Plan 1 is the core product most estates already own inside E3, E5, Business Premium, or EMS E3: MDM, MAM, compliance, Autopilot, app deployment, and Microsoft Tunnel on enrolled devices.
Plan 2 at $4.00 adds exactly three things, Tunnel for MAM on unenrolled devices, specialty device management for hardware like HoloLens and Teams Rooms, and firmware over the air updates, and nothing else the sales conversation implies.
Does Microsoft Tunnel require Intune Plan 2?
Not on enrolled devices: Microsoft's own prerequisites page asks for a Plan 1 subscription and nothing more for ordinary per app VPN on enrolled iOS and Android, and only Tunnel for MAM inside managed apps on unenrolled devices requires Plan 2.
A Plan 2 purchase justified on VPN for enrolled iPhones does not survive that sentence, and it was the misplacement in 25 to 40 percent of the cases we reviewed.
Is the Intune Suite worth it?
At four or more components, always: the six components list at $19.50 and the Suite carries them for $10.00, a 48.7 percent discount with Plan 1 still required underneath.
One or two components always buy standalone, the priciest pair reaching only $9.00, and the three component case needs actual addition, swinging from $7.00 to $12.50 depending on the mix, with ties going to the Suite.
How is Remote Help licensed?
For both the helper and the sharer: every user who can receive attended support needs the license, not just the service desk, so a 12,000 user estate is 12,000 Remote Help licenses rather than the 40 technicians.
Remote Help and Endpoint Privilege Management together drove roughly seven in ten of the Intune findings we raised, and neither is included in Plan 2.
How should a large estate license Intune?
With two SKUs, not one: the Suite on the heavy personas who measurably use four or more components, and standalone add ons on the narrower needs elsewhere, which priced at $1,026,300 a year against the $1,440,000 single SKU proposal on our worked 12,000 user estate.
The sizing input is the admin center usage reports, where Suite seats exceeded actual capability usage by 30 to 50 percent.
What Intune terms matter at the EA renewal?
The price lock: the vendor default is an annual reprice on the Suite, and the buyer position locks the Suite rate for the full EA term, because a floating 48.7 percent discount is a discount being reclaimed year by year.
The persona mapping travels with it, the Suite population revalidated against measured component usage at each anniversary rather than renewed as signed.
