Summary
Microsoft is moving the Intune Suite, historically a $10-per-user-per-month premium add-on, into Microsoft 365 E5 at no additional charge, and adding a subset of those capabilities to Microsoft 365 E3 and Enterprise Mobility + Security E3. The change rolls out over the summer of 2026, and eligible tenants are automatically provisioned with no purchase or administrative action required. Microsoft's packaging and pricing update puts the rollout start in June 2026, with the feature additions complete by 1 August 2026.
For organisations that were paying for the Intune Suite separately, or buying individual Intune add-ons à la carte, the bundling is a genuine consolidation of spend. For those that never needed advanced endpoint management, it is another set of capabilities arriving inside a subscription whose price is also going up on the same date.
Key points:
Microsoft 365 E5 receives the full Intune Suite, previously a $10 per user per month standalone add-on, with no separate Intune Suite purchase required.
Microsoft 365 E3 and EM+S E3 receive a partial set: Intune Plan 2, Remote Help, and Advanced Analytics. They do not receive Endpoint Privilege Management, Enterprise App Management, or Cloud PKI, which stay exclusive to E5.
Rollout runs over summer 2026, starting in June 2026 and complete by 1 August 2026, with a 30-day notice in the Microsoft 365 admin center before each tenant is changed. Eligible EM+S E3 and Microsoft 365 E5 tenants are provisioned automatically.
The expansion does not cover Microsoft 365 F1 or F3, which keep Intune Plan 1. Standalone Enterprise Mobility + Security E5 receives the same additions as EM+S E3 (Intune Plan 2, Remote Help, and Advanced Analytics), but not the E5-only capabilities.
The added entitlements coincide with the 1 July 2026 Microsoft 365 price increase, and Microsoft cites the expanded capabilities as part of its justification.
What Is Changing
Historically, the advanced parts of Microsoft Intune have been sold separately from the Microsoft 365 suites. Every Microsoft 365 E3 and E5 subscription already includes Intune Plan 1, the base mobile device and mobile application management service, but anything beyond that base requires a paid add-on. The most complete of those add-ons is the Intune Suite at $10 per user per month, which bundles every advanced Intune capability into a single licence.
Starting in summer 2026, Microsoft will move most of that advanced functionality into the Microsoft 365 suites themselves. Microsoft 365 E5 gets the entire Intune Suite as part of the subscription. Microsoft 365 E3 and EM+S E3 get a smaller selection of the same capabilities. The features are added to EM+S E3, and because EM+S E3 is a component of Microsoft 365 E3, the value extends to Microsoft 365 E3 as well.
The budget impact depends on what a tenant already buys. An organisation that has been buying the Intune Suite, or one or more of its component add-ons, on top of Microsoft 365 E5 will be paying for entitlements it is about to receive inside the suite. Those line items become candidates for removal at the next true-up or renewal. An organisation that has never bought beyond Intune Plan 1 receives a new capability it did not ask for, on a subscription whose price rises on the same day.
What the Intune Suite Costs Today
The size of the change is clearest in how Microsoft prices these capabilities today. Intune is sold in layers. Plan 1 is the base. Plan 2 and the Intune Suite are paid add-ons that require Plan 1 as a prerequisite, and several capabilities are also sold individually to Plan 1 customers who want only one or two of them.
Capability | Sold today as | Price |
|---|---|---|
Intune Plan 2 (Microsoft Tunnel, Firmware-over-the-air, Specialty device management) | Add-on requiring Plan 1 | $4/user/month |
Advanced Analytics | Standalone add-on | $5/user/month |
Remote Help | Standalone add-on | $3.50/user/month |
Endpoint Privilege Management | Standalone add-on | $3/user/month |
Cloud PKI | Standalone add-on | $2/user/month |
Enterprise App Management | Standalone add-on | $2/user/month |
Intune Suite (all of the above) | Add-on requiring Plan 1 | $10/user/month |
Prices are taken from the Microsoft Intune Plans and Pricing page and the Microsoft Intune Suite documentation.
The Intune Suite at $10 already prices below the sum of its parts, which is the usual logic of a bundle. What changes in summer 2026 is that the $10 bundle will no longer be a separate purchase for Microsoft 365 E5 customers and will become part of the subscription.
What Microsoft 365 E5 Gains
Microsoft 365 E5 receives the complete Intune Suite, including the three Intune Plan 2 capabilities plus the five further capabilities that distinguish the Suite from Plan 2.
The Intune Plan 2 capabilities are Microsoft Tunnel, a per-app virtual private network (VPN) for iOS and Android devices that does not require full device enrolment; Firmware-over-the-air updates for supported Zebra Android devices; and Specialty device management for augmented reality (AR) and virtual reality (VR) hardware and large smart-screen devices, including HoloLens, Apple Vision Pro, and Teams Rooms.
The Suite-only capabilities that E5 also gains are:
Endpoint Privilege Management, which lets users run as standard accounts and elevate only specific approved applications or tasks, reducing standing administrative privileges.
Cloud PKI, a certificate lifecycle service that issues, renews, and revokes certificates using the Simple Certificate Enrolment Protocol (SCEP) without on-premises public key infrastructure.
Enterprise App Management for discovering, deploying, and updating Win32 applications from a curated enterprise app catalogue.
Advanced Analytics, which adds resource performance reporting, battery health reporting, and anomaly detection.
Remote Help, a help desk remote control tool with role-based access and session audit logs.
A Microsoft 365 E5 tenant that previously had to pay $10 per user per month for the Intune Suite, or purchase components separately, will include it in the subscription once the rollout reaches the tenant.
What Microsoft 365 E3 and EM+S E3 Gain
Microsoft 365 E3 and EM+S E3 receive a narrower set. They gain Intune Plan 2 in full, which is Microsoft Tunnel, Firmware-over-the-air, and Specialty device management, plus Remote Help and Advanced Analytics.
They do not gain the three capabilities that remain reserved for E5: Endpoint Privilege Management, Enterprise App Management, and Cloud PKI. Organisations on E3 that want those will still need a paid add-on or a move to E5.
Before and After, by Plan
The matrix below consolidates the change for the two plans that gain capability. In Microsoft's own breakdown, the Microsoft 365 E3 and EM+S E3 lines have identical values, so they are grouped into a single column. The "previously sold as" column shows how each capability was packaged before the change, which is the clearest measure of what the bundling is worth to a given tenant.
Capability | Previously sold as | M365 E3 / EM+S E3 | M365 E5 |
|---|---|---|---|
Intune (base) | Included with the suite (Intune Plan 1) | ✓ | ✓ |
Microsoft Tunnel | Intune Plan 2 ($4/user/month) | New | New |
Firmware-over-the-air | Intune Plan 2 ($4/user/month) | New | New |
Specialty device management | Intune Plan 2 ($4/user/month) | New | New |
Remote Help | $3.50/user/month add-on | New | New |
Advanced Analytics | $5/user/month add-on | New | New |
Endpoint Privilege Management | $3/user/month add-on | No | New |
Enterprise App Management | $2/user/month add-on | No | New |
Cloud PKI | $2/user/month add-on | No | New |
The before-and-after packaging is drawn from the Microsoft Intune Blog, 4 December 2025 (updated 18 June 2026) and the Microsoft Intune Plans and Pricing page.
In the table, New marks a capability added in summer 2026, a tick marks one that was already included, and No marks one that is not included, where the Intune Suite remains a separate add-on. Microsoft Tunnel, Firmware-over-the-air, and Specialty device management are the three parts of Intune Plan 2, a single $4 per user per month add-on rather than three separate purchases, which is why they move together. Microsoft 365 F1 and F3 and Microsoft 365 Business Premium do not gain anything here, for the reasons set out in the next section.
Who Is Not Covered, and Where the Detail Is Missing
The announcement is specific about Microsoft 365 E3, EM+S E3, and Microsoft 365 E5. For every other plan it is either silent or states an exclusion, which the rest of this section works through.
Microsoft 365 F1 and F3, the frontline worker subscriptions, keep Intune Plan 1 and are not part of the announced additions, according to the Intune Blog and the Intune pricing page.
Standalone Enterprise Mobility + Security E5 receives the same Intune additions as EM+S E3, namely Remote Help, Advanced Analytics, and Intune Plan 2, delivered through EM+S E3, according to Microsoft's packaging and pricing update. It does not receive the E5-only capabilities (Endpoint Privilege Management, Enterprise App Management, and Cloud PKI), which Microsoft adds to the Microsoft 365 E5 suite specifically, leaving the standalone EM+S E5 stock-keeping unit (SKU) without them.
Microsoft 365 Business Premium is not referenced in the announcement. It continues to include Intune Plan 1, and the Intune Suite remains available to it as a separate add-on.
Microsoft 365 F1, F3, and Business Premium gain nothing here — they keep Intune Plan 1, and the Intune Suite stays a paid add-on. Standalone EM+S E5 gets the EM+S E3 additions but not the three E5-only capabilities, which attach to the Microsoft 365 E5 suite specifically.
Government customers receive the additions too, but the exact feature set varies by environment. The Government Community Cloud (GCC) comes closest to the commercial set, while GCC High and Department of Defense (DoD) receive a narrower selection, according to Microsoft's packaging and pricing update and the Microsoft 365 Government announcement. Government packaging updates also follow a separate compliance and Federal Risk and Authorization Management Program (FedRAMP) validation timeline rather than the commercial rollout schedule, and the Intune Suite is not yet available for GCC-High or DoD customers, so the government timing is not interchangeable with the commercial one.
When It Happens and What You Have to Do
The rollout runs over summer 2026, starting in June 2026, with the feature additions complete by 1 August 2026. Before the change reaches a given tenant, Microsoft posts a 30-day notice in the Microsoft 365 admin center, and eligible EM+S E3 and Microsoft 365 E5 tenants are then provisioned automatically with no action required.
Automatic provisioning is convenient, but two consequences deserve attention. The first is licensing hygiene. If you already pay for the Intune Suite or its component add-ons on top of E5, those add-ons do not disappear on their own. You will need to identify and remove them at the appropriate point in your agreement to stop paying twice for the same entitlement. A Microsoft 365 licence review before and after the rollout is the practical way to catch that overlap.
The second is operational. Capabilities such as Endpoint Privilege Management and device provisioning change how endpoints are administered. Arriving automatically is not the same as being configured, and an unused entitlement delivers no value until someone deploys it.
The Pricing Connection
The entitlement additions coincide with the 1 July 2026 Microsoft 365 price increase, which will raise Microsoft 365 E3 from $36 to $39 per user per month and E5 from $57 to $60 per user per month. Microsoft presents the expanded Intune capabilities, together with other additions to the suites, as part of the justification for the higher prices.
Whether that justification holds depends entirely on whether an organisation would have bought the capability anyway. For a tenant that was already paying $10 per user per month for the Intune Suite on top of E5, folding it into the subscription is a real offset against the increase. For a tenant that runs a different endpoint management or privilege management stack and has no intention of switching, the bundled Intune features add nothing usable, and the price increase stands without a corresponding benefit.
The full mechanics of the increase, including its interaction with the Enterprise Agreement volume discount removal, are covered separately in our analysis of the July 2026 Microsoft 365 price increase and the accompanying renewal strategy. The point relevant here is narrower. Added Intune entitlements are worth only what they save you, regardless of the list price Microsoft assigns them, and the savings only exist where the capability was already on your shopping list.
If you are working out whether the Intune Suite arriving inside Microsoft 365 E5 lets you retire add-ons you currently pay for, or whether the E3 additions change your device management plans, we can help you model it against your actual subscription and add-on mix. We do not sell Microsoft licences or cloud services, so our advice is independent.