IntuneAI Briefing: The E3/E5 Licensing Shake-Up
IntuneAI Briefing: The E3/E5 Licensing Shake-Up
Microsoft Just Folded Intune Suite Into E3 and E5 — Here's What Changes for You
Advanced device management, security, and automation capabilities that used to cost extra are now sitting inside licenses most enterprises already own.
July 6, 2026
For the last few years, the most powerful parts of Intune — Remote Help, Advanced Analytics, Endpoint Privilege Management, Cloud PKI — lived behind a separate paywall: the Intune Suite add-on, priced around $10 per user per month on top of an existing E3 or E5 seat. As of July 2026, that changes. Microsoft is folding a meaningful slice of Intune Suite directly into Microsoft 365 E3 and E5, at no additional cost, with automatic provisioning for eligible tenants. This is one of the more consequential licensing moves for enterprise admins in recent memory — not because the features are new, but because the barrier to using them just disappeared for a huge number of organizations.
What's Actually Moving — and Where
Microsoft is splitting the bundle across tiers rather than dumping everything into both:
Microsoft 365 E3 gains:
Intune Remote Help
Intune Advanced Analytics (device query, anomaly detection, battery health reporting)
Microsoft Tunnel for Mobile Application Management
Specialty device management
Firmware updates
Microsoft 365 E5 gets everything in E3, plus the heavier security tooling:
Intune Endpoint Privilege Management (EPM)
Intune Enterprise Application Management (a curated catalog of 1,000+ prepackaged apps)
Microsoft Cloud PKI for certificate management
Security Copilot integration inside Intune, with agentic AI workflows
Provisioning is automatic — no action required for eligible tenants already on Microsoft Enterprise Mobility + Security E3 or Microsoft 365 E5.
The separate Intune Suite add-on that previously cost around $10 per user per month is now simply included.
Why Now: The Pricing Increase Context
This bundling isn't happening in a vacuum. It lands alongside Microsoft's broader July 2026 Microsoft 365 pricing adjustment, and multiple outlets read it as a deliberate offset: rather than a price increase with nothing new to show for it, Microsoft is positioning the change as bundled investment in security and operational efficiency. Whether or not that framing lands with your finance team, the practical effect for IT is the same — capabilities that required a business case and a separate PO now just show up in tenants that were already paying for E3/E5.
What This Actually Changes for Enterprise Admins
A few concrete shifts worth planning around:
Endpoint Privilege Management (E5) lets you run standard user accounts fleet-wide while still allowing elevation for specific, approved tasks — a real dent in the "everyone's a local admin because IT" problem, now available without a separate license conversation.
Advanced Analytics (E3) gives you device-level query and anomaly detection that most orgs previously bolted on with third-party endpoint monitoring tools — worth an audit for overlap.
Microsoft Tunnel for MAM (E3) extends secure, per-app VPN access to on-premises resources from unenrolled and BYOD devices, without requiring full device enrollment.
Enterprise Application Management (E5) replaces a lot of manual packaging work with a catalog of 1,000+ prepackaged apps kept current automatically.
Cloud PKI (E5) removes the on-prem certificate authority as a hard dependency for device certificate issuance.
None of this requires new procurement — it requires an inventory review. If you're paying for a third-party tool that duplicates one of these, or you shelved an Intune Suite proposal because of cost, both of those decisions are now worth revisiting.
Recommended Next Steps
Security Risk Advisors and other early guidance converge on a similar sequence:
Audit your current toolset for overlap — flag any third-party product duplicating Remote Help, Advanced Analytics, EPM, Cloud PKI, or Enterprise App Management.
Pilot the newly-included capabilities with a small group before wide rollout, even though they're already provisioned — policy and workflow changes still need testing.
Start with Advanced Analytics as the low-friction win, then layer in EPM and Enterprise App Management as your team has bandwidth.
Check platform coverage before you commit — EPM is Windows-only today, and macOS/mobile support varies by capability, so don't assume parity across your fleet.
Since provisioning is automatic, the capabilities are live in eligible tenants right now, whether or not anyone has turned them on in policy yet — which makes the audit step more urgent than usual.
Sources
IntuneAI Briefing — licensing and platform changes relevant to Intune administrators.