Intune Plan 1 vs Plan 2 used to be a small add-on decision. Plan 1 ran the estate, and Plan 2 was an extra licence for a short list of device scenarios that most organisations never met. Microsoft’s Intune pricing page now says that, starting July 2026, the Plan 2 capabilities are rolling into Microsoft 365 E3 and E5, yet most comparison pages still treat Plan 2 as something you buy. This post sets out what each plan covers on Microsoft’s own pages today, which licences now carry Plan 2, and the narrow cases where buying it still makes sense.
The decision is one branch of the rules that decide your Microsoft 365 licensing bill, and the bundle you already hold settles most of it. I have not run Plan 2 in production; my tenant is a lab with no enrolled devices, so what follows is Microsoft’s documentation and pricing page, checked on 2 November 2026, plus where I would expect it to bite.
Intune Plan 1 vs Plan 2 in one table
The Microsoft Intune licensing page on Microsoft Learn organises Intune into three plans: Plan 1 as the base service, Plan 2 as additive to Plan 1, and the Intune Suite, which is also additive to Plan 1 and includes Plan 2. The table sets the first two side by side, using only what Microsoft’s pages state today. Rows I could not confirm on a Microsoft page during this check are left out rather than guessed.
| Area | Microsoft Intune Plan 1 | Microsoft Intune Plan 2 |
|---|---|---|
| What it is | The base service: cloud-based unified endpoint management for devices and apps | Additive to Plan 1: advanced endpoint management capabilities |
| Prerequisite | It is the base licence | Requires a Microsoft Intune Plan 1 subscription |
| Microsoft Tunnel for MAM | Not included | Included |
| Specialty device management | Not included | Included |
| Firmware Over-the-Air updates for Android | Not included | Included |
| Microsoft 365 E3 and E5 | Included | Plan 2 capabilities rolling in from July 2026 |
| Intune Suite | Not a substitute: the Suite is additive to Plan 1 | Included in the Suite |
| UK list price on Microsoft’s pricing page | Not compared here | £3.10 user/month, paid yearly, excluding VAT |
The price row is the figure on Microsoft’s UK pricing page during this check. It is a list price, not a quote: the page itself says prices may vary based on your Microsoft agreement. Plan 1 pricing is left out because the comparison that matters here is whether you need to pay for Plan 2 at all.
What Plan 2 actually adds
Strip the marketing away and Plan 2 is three capabilities. The Microsoft Intune pricing page describes Plan 2 as extending Plan 1 with Microsoft Tunnel for Mobile Application Management, specialty and shared device management, and Firmware-over-the-Air updates. Each of the three Microsoft Learn feature pages carries the same licensing line: the feature requires Microsoft Intune Plan 2 or an additional subscription.
Microsoft Tunnel for MAM
Tunnel for MAM extends the Microsoft Tunnel VPN gateway to Android and iOS devices that are not enrolled in Intune. The point is bring-your-own-device access to on-premises apps and resources with modern authentication, single sign-on and Conditional Access, without asking the user to enrol a personal phone. It only matters if you already run, or plan to run, Microsoft Tunnel. If every on-premises app is already published another way, this capability buys you nothing.
Specialty device management
Specialty device management covers AR and VR headsets, large smart-screen devices and select conference room meeting devices. The specialty devices page on Microsoft Learn adds licensing detail most comparison pages skip. Users of headsets such as Apple Vision Pro, RealWear and HTC devices must be assigned a required licence. Microsoft Teams Rooms devices, including Surface Hub, need sufficient Microsoft Teams Rooms Pro licences or the other Teams device licences the page lists, rather than extra Intune ones.
Firmware Over-the-Air updates
FOTA pushes firmware updates to Android devices over a wireless connection, on a schedule or on demand. Microsoft Learn lists the supported enrolment types as Android Enterprise corporate-owned dedicated, corporate-owned fully managed, and corporate-owned with a work profile. Personally owned devices are out of scope, so this is a fleet tool for rugged and frontline Android estates, not a general patching feature.
Which licences now carry Plan 2
The pricing page FAQ says that, starting July 2026, Microsoft is rolling select advanced endpoint management capabilities directly into Microsoft 365 E3 and E5. E3 customers receive Remote Help, Advanced Analytics and the Intune Plan 2 capabilities: Tunnel for MAM, FOTA and specialty devices. E5 customers get all of that plus Endpoint Privilege Management, Microsoft Cloud PKI and Enterprise App Management. Tenants receive a 30-day notice in Message Center before the change is activated.
That changes the Intune Plan 1 vs Plan 2 question for most enterprises. If you hold Microsoft 365 E3 or E5, the default answer is that you should not be buying Plan 2 separately; you should be checking whether the change has activated in your tenant. The E5 side of the same change is covered in what E5 now covers for Endpoint Privilege Management, and the wider uplift in the cliff edges between E3 and E5.
The Intune Suite still sits above both plans. Microsoft Learn says the Suite includes Plan 2, and the pricing page says Tunnel for MAM, FOTA and specialised device management are only available through Plan 2 or the full Suite, not as standalone purchases. There is no cheaper route to any one of the three than Plan 2 itself.
Who should still buy Plan 2
The pricing page frames Plan 2 as an add-on to Intune Plan 1 for organisations that do not subscribe to Microsoft 365 E3 or E5. It also says Plan 1 is included in Microsoft 365 E3 and E5 and in EMS E3 and E5, and can be bought standalone. That leaves a short list of buyers:
- Tenants whose Plan 1 comes from EMS or a standalone subscription, with a named requirement for Tunnel for MAM, specialty devices or FOTA. Without the named requirement, the licence is shelfware.
- E3 or E5 tenants with a hard deadline that falls before the change activates in their tenant. Buying a licence that the bundle is about to supersede is a poor trade, so I would only do it on a short term and set a reminder to remove it.
- Organisations already pricing the Intune Suite for other capabilities. If two or more Suite modules are on the list, the Suite carries Plan 2 anyway, and a separate Plan 2 subscription is redundant.
If Plan 2 is being discussed as part of a bigger move off a small business plan, what the step up from Business Premium to E5 buys covers that decision. Plan 2 alone is rarely the reason to change bundle.
The newsletter
Get the next licensing fix like this one by email
Subscribe and get the free 8-page Intune troubleshooting field guide (PDF), then new fixes about twice a month. From a Microsoft MVP.
How to check what your tenant already has
Microsoft Learn places advanced capabilities in the Microsoft Intune admin center under Tenant administration > Intune add-ons. The check takes a few minutes and should come before any quote:
- Sign in to the Microsoft Intune admin center and go to Tenant administration > Intune add-ons.
- Open the Capabilities tab, which Learn says still shows what your tenant is eligible for even if you are not a Global or Billing administrator.
- Look for Microsoft Tunnel for MAM, specialty device management and Firmware Over-the-Air updates in that list.
- If you are a Global or Billing administrator, check the Your add-ons tab for anything you already pay for separately.
- Check Message Center for the 30-day notice the pricing page describes, so you know when the E3 or E5 change activates.
- Go to Tenant administration > Tenant status and read the Total licensed users and Total Intune licenses on the Tenant details tab.
If you still need to evaluate a capability, Microsoft Learn describes trials of advanced capabilities as 90 days, up to 250 users per tenant, one trial per capability per tenant, followed by a 30-day grace period. One trial per capability means you should not start it until the devices you want to test are ready.
Intune Plan 1 vs Plan 2 failure modes
- Two Microsoft pages describe Plan 2 differently. The Learn licensing page describes Plan 2 as advanced endpoint management capabilities including Remote Help and Advanced Analytics. The pricing page FAQ defines Plan 2 as Tunnel for MAM, specialty and shared device management and FOTA, and lists Remote Help and Advanced Analytics as standalone add-ons. Until the two agree, treat the Intune add-ons view in your tenant and your licence agreement as the record, not either page.
- Paying twice after the E3 or E5 change. A Plan 2 subscription bought before activation keeps renewing until someone removes it. Nothing I found on the pricing page during this check says what happens to an existing add-on when the bundle change lands, so check it at renewal rather than assume a credit.
- Counting devices instead of people. For specialty devices running in Microsoft Entra shared device mode, Learn says you need the same volume of the required licence as the core Intune licences for those users. The count follows the people who share the device, not the device.
- Treating FOTA as general Android patching. It only supports the three corporate-owned Android Enterprise enrolment types. A bring-your-own-device fleet gets nothing from it.
- Copying a USD figure from the FAQ. The pricing page FAQ quotes US dollar figures while the UK price card shows sterling. Quote the card for your region, and treat both as list prices.
What I would do differently
I would not open the conversation by comparing features. I would open it with the bundle. On E3 or E5, the question is when the change activates, not whether to buy. On EMS or standalone Plan 1, the question is whether any of the three Plan 2 capabilities is a real requirement this year.
I would name the device before naming the licence. Tunnel for MAM matters only with Microsoft Tunnel in the picture, FOTA only with corporate-owned Android, and specialty device management only with headsets, large smart screens or meeting room devices. If nobody can name the device, the licence is shelfware.
I would keep Plan 2 and the Suite apart in the budget. The Suite includes Plan 2, so a tenant holding both is paying for the same three capabilities twice, and that is easy to miss when the two were bought by different teams in different years.
And I would re-read the two Microsoft Learn pages and the pricing page at every renewal. They disagree today about what Plan 2 contains, and the one you read last is the one your quote will be built on.
Last verified: 2 November 2026.
