Intune Advanced Analytics is sold as one feature and licensed three different ways, and the obvious purchase is the wrong one. It is a standalone add-on, it is inside the Intune Suite, and since 1 July 2026 it is included in Microsoft 365 E3 and E5. Buying Intune Plan 2 because the name sounds like the advanced tier grants none of it. This page sets out which routes actually carry the entitlement, where Microsoft’s own pages contradict each other, and why a correctly licensed tenant can still show empty reports.
If the problem is a device that is not reporting at all rather than a report that is not there, the symptom index in Intune troubleshooting is the faster route. Everything below assumes the licence is the question.
What Intune Advanced Analytics includes
It is not a separate console. It extends the existing Reports then Endpoint analytics section, extends some single device views, and adds one node under Devices. The Microsoft Learn Advanced Analytics overview, last updated 21 May 2026, lists seven capabilities and one baseline:
- Resource performance report, CPU and RAM issues broken down by device, model and manufacturer.
- Battery health report, Windows devices only.
- Anomalies report, regressions in user experience after a configuration change.
- Device timeline report, which replaces the application reliability report.
- Device query, near real time state for one Windows device.
- Device query for multiple devices, fleet wide and cross platform.
- Device scopes, which filter the reports and the scores by scope tag.
- STIG audit baseline, for United States Department of Defense requirements.
Two of those have been covered here already. The single device and the fleet paths behave differently enough that Intune Device Query licence, limits and failure modes is worth reading before you promise anybody live inventory, and device scopes inherit every quirk of Intune scope tags, including what a blank field actually means.
The platform constraint matters more than the feature list. The documented requirement is Windows devices managed by Intune or co-managed with Configuration Manager, and Microsoft Entra joined or Microsoft Entra hybrid joined. Device query for multiple devices reaches Android Enterprise and Apple platforms. The reports do not. In United States Department of Defense environments, Device query and the Resource performance report are excluded outright.
The four routes to the licence, and the one that is not a route
There are four routes that genuinely grant Intune Advanced Analytics, and a fifth that people buy by mistake. Figures below are from Microsoft’s United Kingdom Intune pricing page as it stood on 11 October 2026. Microsoft publishes a sterling list price for each individual add-on and a dollar price for the Suite, and states that the add-on prices exclude VAT. Licensing in this corner of the product has changed twice in eighteen months, so treat any figure you find without a date against it as wrong.
| Route | Cost | What else is required |
|---|---|---|
| Microsoft 365 E5, from 1 July 2026 | Included | Nothing further |
| Microsoft 365 E3, from 1 July 2026 | Included | Nothing further |
| Advanced Analytics standalone add-on | £3.80 per user per month, paid yearly, excluding VAT | Microsoft Intune Plan 1 as the base licence |
| Microsoft Intune Suite | $10.00 per user per month | Includes Plan 2 and the other advanced capabilities |
| Microsoft Intune Plan 2 | £3.10 per user per month | Not a route to this capability |
The July change is the one that saves money, and it is asymmetric. The Intune pricing page states that from July 2026 Microsoft 365 E3 customers receive Remote Help, Advanced Analytics and the Intune Plan 2 capabilities, and that Microsoft 365 E5 customers get all of that plus Endpoint Privilege Management, Cloud PKI and Enterprise App Management. It also says tenants are given a 30 day notice in Message Center before the update is activated, which is the detail worth acting on: the entitlement does not arrive on a date you can look up, it arrives on a date your tenant was told about.
If an estate on E3 or E5 renewed a standalone Advanced Analytics subscription this year, that is a line item to go and look at. The same date moved two other add-ons in the same direction, so the Endpoint Privilege Management cost and the Cloud PKI trial you cannot undo are worth pricing in one sitting rather than one at a time. If the question is really whether the bundle itself is worth it, Microsoft 365 licensing is the wider version of the same arithmetic.
Where Microsoft’s own pages disagree
Three Microsoft pages were live on 11 October 2026 giving three different answers to one question: does Intune Plan 2 include Advanced Analytics.
The Advanced Analytics overview, under Licensing requirements, says the feature requires a subscription in addition to Microsoft Intune Plan 1 or Plan 2. Read plainly, that means Plan 2 is not enough.
The Microsoft Intune licensing article says the opposite. It describes Plan 2 as additive to Plan 1 and covering advanced endpoint management capabilities, including Remote Help and Advanced Analytics, by name.
The pricing page agrees with the first and not the second. Its own plan comparison says Plan 2 extends Plan 1 with Microsoft Tunnel for Mobile Application Management, specialty and shared device management, and firmware over the air updates. Elsewhere on the same page it says those three are available only through Plan 2 or the full Suite and not as standalone purchases, which defines Plan 2 by exactly those three things and nothing else.
Two of the three are the pages that bill you, and they agree with each other. The licensing article is the outlier. The practical reading is that Plan 2 at £3.10 per user per month buys specialty and shared device management, Tunnel for MAM and firmware updates, and that anyone who bought it to reach the analytics reports has bought something else.
What none of the three pages tells you is where to check your own tenant, which is the only answer that settles it. The Microsoft Intune advanced capabilities article, last updated 28 May 2026, puts it under Tenant administration then Intune add-ons in the Intune admin centre. The Capabilities tab shows what the tenant is eligible for. The Your add-ons tab, which shows what is actually active, is hidden from anyone who is not a Global or Billing administrator, so the person most likely to be asked the licensing question is often the person who cannot see the answer.
The failure modes
These are the documented ones, in roughly the order they turn up.
Licences are assigned and nothing appears. The overview says it can take up to 48 hours after you buy licences or start a trial for the features to show up in the tenant. Enablement is automatic once the licence requirement is met, so there is no switch to go and find.
The features appear and the reports are empty. Advanced Analytics sits on top of endpoint analytics rather than beside it. Devices have to meet the endpoint analytics prerequisites and endpoint analytics has to be configured in the tenant first. A tenant that never onboarded devices to endpoint analytics gets the new reports and no data to put in them.
One device reports and another does not. The Advanced Analytics FAQ, last updated 30 March 2026, is explicit that a device must restart at least once after the policy is applied before data displays properly. On an estate where people close the lid instead of shutting down, that single line explains most of the gaps.
The data looks a day old. It is. Refresh is typically every 24 hours, and the FAQ notes that end to end latency can exceed 24 hours when event details are not uploaded immediately, which is common for restarts and stop errors on a device that does not reboot straight afterwards. The event eventually lands on the timeline with its original timestamp, so the record is right and the delay is real.
The anomalies report shows nothing on a healthy estate. That is the design. The device has to be actively used and enrolled in endpoint analytics, and a high volume of events is normally needed before anything is flagged as anomalous. An empty anomalies report is not evidence that anomaly detection is working.
Device query for multiple devices returns nothing. It needs a properties catalog policy configured and deployed. That is a separate deployment step from the licence and from endpoint analytics, and it is the one most often missed.
The data cannot be piped anywhere. The FAQ states there is no connector for Advanced Analytics data to be used in other monitoring tools. Device query for multiple devices supports a CSV export. If a SIEM or a reporting pipeline is the actual requirement, settle that before the purchase order rather than after it.
The trial ends more abruptly than people expect. Ninety days, a maximum of 250 users per tenant, one trial per capability per tenant, then a 30 day grace period, after which the capability is no longer available in the admin centre. Combined with the 48 hour activation delay and the restart requirement, a trial that is not planned properly spends its first fortnight looking broken.
The documentation moves under you. Three paths that search engines still return for this topic were dead on 11 October 2026: the old Intune add-ons article, the older Intune licenses article, and the legacy advanced endpoint analytics page under the mem path. All three returned 404 rather than redirecting. If a runbook or a wiki page in your own estate links to any of them, it is already broken.
One thing I have not done: run Intune Advanced Analytics against a populated estate. My tenant is a lab with no enrolled devices, which is itself the second item on the list above, and an unlicensed tenant with nothing reporting looks exactly like a licensed one with nothing reporting. Everything above comes from Microsoft’s current documentation and pricing pages, named and dated, and not from a measured result.
What I would do differently
Open the Capabilities tab before raising a purchase order. The whole licensing question above is settled in one screen in your own tenant, and since July 2026 the most likely answer for an enterprise estate is that you already own it.
Never buy Plan 2 to reach a capability. Plan 2 is a specialty and shared device plan with a name that suggests a tier. Every time the plan name and the capability list disagree, the capability list is right.
Treat the 48 hours and the restart requirement as part of the evaluation plan rather than as faults to raise a ticket about. A 90 day trial where the first fortnight is spent deciding whether the product is working is not a 90 day trial.
Decide which decision the data is going to change before switching it on. Resource performance is a hardware refresh argument. Battery health is a warranty and procurement argument. The anomalies report is a change control argument. If none of those decisions is actually waiting on evidence, the reports will be admired for a month and then ignored, and at per user pricing that is an expensive dashboard.
Ask the reseller what partial licensing does before assuming it is allowed. The add-on is priced per user while most of the reports are estate wide, and Microsoft’s public pages do not spell out what a partly licensed estate sees. That is a question for the agreement, not for a blog post, and I would want it answered in writing.
Last verified: 11 October 2026.
