Intune licensing decides which users, devices and administrators the service will manage, and which advanced features appear in the admin center at all. Most guides answer it with a price table, which goes stale within a quarter and skips the rules that cause real tickets: device-only licences that quietly switch off Conditional Access, shared devices that need a licence per user, and administrators in nested groups who still need a seat. This post sets out the three plans, who needs which licence, and the failure modes Microsoft documents but rarely puts on one page.
It sits under the Microsoft 365 licensing guide, alongside the comparison of Microsoft 365 E3 and E5. Every Microsoft fact below was checked against Microsoft Learn on 31 October 2026. I have not run this in production; my tenant is a lab with no enrolled devices, so what follows is the documentation read carefully, plus where I would expect it to bite. I have deliberately left out prices: they belong on Microsoft’s own pricing page, and they change more often than the rules do.
Intune licensing in one table: the three plans
Intune is licensed through three plans, and the admin center and the documentation use the same three names to say which capability needs which plan. According to Microsoft Learn’s Intune licensing article, the relationship between them is additive, not tiered.
| Plan | What Microsoft Learn says it is | What it depends on |
|---|---|---|
| Microsoft Intune Plan 1 | The base service: cloud-based unified endpoint management for devices and apps. | Nothing. This is the foundation. |
| Microsoft Intune Plan 2 | Advanced endpoint management capabilities, including Remote Help and Advanced Analytics. | Additive to Plan 1. |
| Microsoft Intune Suite | Unifies advanced endpoint management and security capabilities, and includes Plan 2. | Additive to Plan 1. |
The word that matters is additive. Plan 2 and the Suite are not standalone products that replace Plan 1; they sit on top of it. A user with the Suite and no Plan 1 entitlement from somewhere has bought the extras without the base.
The same article says most organisations get Intune as part of a Microsoft 365 bundle, naming Microsoft 365 E3, E5 and E7 as examples, rather than buying the plans directly. In education, Intune Plan 1 for Education is included in Microsoft 365 Education A3 and A5. So the first Intune licensing question is rarely “which plan should I buy”. It is “which plan do the seats I already own carry, and for whom”.
Who needs a licence: users, devices and administrators
The rule is broad. Microsoft Learn states that an Intune licence is required for any user or device that benefits directly or indirectly from the Intune service, including access through a Microsoft API. Reading data out of Intune with a script does not move a user outside that rule.
For users, Microsoft Learn’s article on assigning Intune licences sets out three points that decide most designs:
- A user must have a licence assigned before they can enrol devices.
- Each user licence covers that user on up to 15 MDM devices.
- Users who receive an app protection policy without enrolling their device still need an Intune licence to receive the policy. If you run MAM without enrollment for personal phones, those users are licensed users, not free riders.
Shared devices are where it gets expensive by accident. The same article says that if a device is used by more than one user, either the device needs a device licence or every user of it needs a user licence. A shift-work tablet with ten casual users is either one device licence or ten user licences, and the second option is usually the one nobody budgeted for.
Administrators are the exception. Unlicensed admin access lets administrators sign in to and manage Intune without an Intune licence. It is on by default for tenants created after July 2021. For older tenants, an Intune Administrator turns it on under Tenant administration > Roles > Administrator Licensing by selecting Allow access to unlicensed admins. Learn notes that the setting cannot be undone once it is on, and that it does not remove licence requirements for anything else, such as features that depend on Microsoft Entra ID P1 or P2.
Device-only licences and what they switch off
Intune offers a device-only subscription for devices that are not affiliated with a specific user: kiosks, dedicated devices, phone-room devices, IoT and other single-use hardware. Learn lists the enrolment methods where a device licence applies:
- Windows Autopilot self-deploying mode
- Apple Device Enrollment Program without user affinity, or with Entra Shared Device Mode
- Apple School Manager without user affinity
- Apple Configurator without user affinity
- Android Enterprise dedicated devices
- Enrolment with a device enrollment manager account
Device licences are not assigned to individual devices. Learn says each device that uses the service must have a device licence available in the tenant, and that you assign them based on estimated usage. The pool has to be large enough; the assignment is implicit.
The trade-off is what a device licence does not support. When a device is enrolled with a device licence, Intune does not support app protection policies, Conditional Access, or user-based management such as email and calendaring. Learn also states that a signed-in user without an Intune user licence does not stop device-targeted policies, apps or actions from processing. Device-targeted management works; anything that needs the user does not. Which user, if any, the device is tied to is decided at enrolment, which is covered in what the Intune primary user field controls.
The advanced capabilities and where Intune licensing puts them
Microsoft Learn’s page on Intune advanced capabilities lists eight, and says they are available through Intune Plan 2, the Intune Suite and select Microsoft 365 bundles:
| Capability | What it does |
|---|---|
| Firmware Over-the-Air updates | Delivers firmware updates to Android devices over the air, without user action. |
| Specialty device management | Manages AR and VR headsets, large smart-screen devices and conference room devices. |
| Microsoft Tunnel for MAM | Extends Microsoft Tunnel VPN to Android and iOS devices that are not enrolled. |
| Advanced Analytics | Analytics-driven insight into the user experience across endpoints. |
| Remote Help | Cloud-based help-desk connections to user devices with role-based access control. |
| Microsoft Cloud PKI | A managed certificate authority for issuance, renewal and revocation. |
| Endpoint Privilege Management | Runs users without admin rights while allowing approved elevation. |
| Enterprise Application Management | Deploys curated Win32 apps from a Microsoft-hosted Enterprise App Catalog. |
Learn does not map every capability to Plan 2 or the Suite on that page; it sends you to the pricing page for that, and the mapping has moved more than once. The individual cost questions are covered in their own posts: what Intune Cloud PKI costs once AD CS is counted, which plans include an Endpoint Privilege Management licence and what the Intune Advanced Analytics licence covers.
Each capability can be trialled before purchase. Learn gives the terms as 90 days, up to 250 users per tenant, one trial per capability per tenant, and a 30-day grace period after the trial ends, after which the capability disappears from the admin center. A Global or Billing administrator starts it from Tenant administration > Intune add-ons.
The newsletter
Get the next licensing fix like this one by email
Subscribe and get the free 8-page Intune troubleshooting field guide (PDF), then new fixes about twice a month. From a Microsoft MVP.
How to check what your tenant actually has
Licences are managed only in the Microsoft 365 admin center. The Intune and Entra admin centers show licence information but cannot change it. The places to look, all from Microsoft Learn:
- In the Microsoft 365 admin center, go to Billing > Licenses and select the Subscriptions tab to see what the tenant owns.
- For a single user, go to Users > Active users, select the user, then Licenses and apps.
- In the Microsoft Intune admin center, go to Tenant administration > Tenant status and open the Tenant details tab. It shows the MDM authority, the total licensed users and the total Intune licences.
- Still in the Intune admin center, Tenant administration > Intune add-ons shows which advanced capabilities the tenant is eligible for and which are active.
How you bought Intune also changes what you are looking at. Learn says Enterprise Agreement subscriptions appear in the Volume Licensing portal, Cloud Solution Provider customers should ask the reseller, and licences bought by card or invoice are user-based.
Intune licensing failure modes
These are the documented behaviours I would expect to generate tickets. None of them throws a clear licensing error.
- A removed licence breaks compliance, not enrolment. Learn warns that removing a licence from a user with managed devices may affect compliance or management of those devices. Re-assigning the licence restores it. In a tenant using compliance in Conditional Access, that looks like an access problem, not a licensing one.
- Conditional Access does nothing on device-licensed devices. If a kiosk was enrolled under a device licence, a compliance-based Conditional Access design will not apply to it, because Conditional Access is listed as unsupported for device-licensed enrolment.
- App protection silently missing. Users on unenrolled phones with no Intune licence do not receive the app protection policy. The policy looks assigned; the user is simply not entitled.
- Nested groups and unlicensed admins. Learn states that members of nested security groups are not included in unlicensed admin access, so admins in a nested group still need a licence. It also caps the feature at 1,000 unlicensed admins per security group and says changes can take up to 48 hours.
- The one-shot trial. One trial per capability per tenant means a trial started in production by accident cannot be repeated for a proper evaluation later.
- Co-management that assumes Intune seats. For co-management auto-enrolment, Learn says each user needs Microsoft Entra ID P1 or P2, and that Intune Plan 1 is included automatically for that scenario without assigning individual Intune licences. Other enrolment scenarios still need assigned licences, so the exemption does not carry over to new devices enrolled any other way.
What I would do differently
I would audit Intune licensing by entitlement source before buying anything. Most tenants already hold Plan 1 inside a Microsoft 365 bundle, and the expensive mistake is paying for an add-on the bundle already covers. The E3 versus E5 question in what actually stops at E3 usually answers part of it.
I would design shared and kiosk devices around device licences from the start, and write down that Conditional Access and app protection are out of scope for them. Retrofitting a device-licensed fleet into a compliance-based access design is a re-enrolment project.
I would flatten the admin role groups before relying on unlicensed admin access, because the nested group exclusion is the kind of rule that only shows up when someone cannot sign in during an incident.
And I would treat each advanced capability trial as a single evaluation window, scheduled with the people who will judge it, because Microsoft gives you one per tenant.
Last verified: 31 October 2026.
