Intune Plan 1 is already included in Microsoft 365 E3, E5 and both EMS tiers — yet enterprises still buy EMS or the Intune Suite add-on on top of an E5 that carries the entitlement. This guide sets out exactly what Intune and EMS include, where they overlap the E5 suite, and whether the Intune Suite add-on at around $10 per user per month earns its place beyond a small admin and frontline subset.
Intune is the product — Microsoft's cloud endpoint-management and mobile-device-management service. EMS (Enterprise Mobility + Security) is the suite that bundles Intune with Entra ID and, at the E5 tier, Defender for Identity and Microsoft Defender for Cloud Apps. The practical point for licensing is that Intune Plan 1 is already carried inside Microsoft 365 E3, E5 and both EMS tiers, so paying separately for it is almost always a double-buy. EMS itself is increasingly a legacy purchasing vehicle: most enterprises now get its components through Microsoft 365 E3/E5 instead.
The core point: if you own Microsoft 365 E3 or E5, you already own Intune Plan 1. The only Intune line worth paying extra for is the Intune Suite add-on — and only for the users who genuinely use its advanced features.
This is a sub-guide in our Microsoft security licensing pillar. It pairs with the Purview licensing and Sentinel pricing guides, sits under our Microsoft vendor practice, and connects to the suite decision in Microsoft 365 licensing.
The entitlement map below is what we walk clients through before any add-on conversation. The key takeaway: Intune Plan 1 is everywhere in the modern suites, EMS E5 duplicates security components you may already hold in Microsoft 365 E5, and the Intune Suite is the only genuinely incremental endpoint purchase.
| SKU | Intune | Identity | Added security | ~Per user / month |
|---|---|---|---|---|
| Microsoft 365 E3 | Plan 1 | Entra ID P1 | Baseline | ~$36 (suite) |
| Microsoft 365 E5 | Plan 1 | Entra ID P2 | Full Defender stack | ~$57 (suite) |
| EMS E3 | Plan 1 | Entra ID P1 | Azure Information Protection P1 | ~$10.60 |
| EMS E5 | Plan 1 | Entra ID P2 | Defender for Identity, Cloud App Security | ~$16.40 |
| Intune Suite add-on | Advanced | — | Remote Help, EPM, advanced analytics | ~$10 |
Where this goes wrong: an organisation standardised on Microsoft 365 E5 buys EMS E5 "for Intune" and pays twice for Entra ID P2, Defender for Identity and Cloud App Security it already holds. Reconciling the two is one of the fastest cleanups in a security-stack review.
We reconcile your endpoint and identity entitlement against the suite you already own — most clients find a duplicated line.
For a minority of users, yes; estate-wide, almost never. The Intune Suite (~$10 per user per month) adds Remote Help, Endpoint Privilege Management, Microsoft Tunnel for Mobile App Management, advanced endpoint analytics and Enterprise App Management. Those features earn their cost for help-desk staff, privileged-access users and high-touch frontline devices — but applying them to every knowledge worker triples the per-user endpoint cost for capabilities most never invoke. The defensible position is to license the Suite to the personas that use it and leave the rest on the included Plan 1.
| Persona | Needs Intune Suite? | Why |
|---|---|---|
| Help-desk / IT support | Yes | Remote Help, EPM are core to the role |
| Privileged-access users | Yes | Endpoint Privilege Management |
| High-touch frontline devices | Maybe | Advanced analytics, app management |
| General knowledge workers | No | Plan 1 covers standard MDM/MAM |
The persona-mapping model, the EMS-vs-E5 overlap map, and the Intune Suite cost-benefit in one research paper.
Not on knowledge-worker SKUs. Frontline staff and shared-device scenarios — retail, manufacturing, healthcare floors — are served by the F-series (F1/F3) at a fraction of E3/E5 cost, and Intune for managing those devices is included. The error we see is licensing a 10,000-device frontline estate on E3 because that is the corporate default, when F3 plus the included Intune would cover the actual workload for a quarter of the price. Device-based licensing also matters where many users share few devices: Intune supports device licensing that can be dramatically cheaper than per-user where the ratio is high.
This persona and device-ratio analysis is where the real Intune savings sit, and it ties directly into the broader suite-mix decision in our E3 vs E5 guide and the cost levers in the Microsoft cost optimization pillar.
"The single most common Intune finding is not over-spending on Intune — it is paying for EMS on top of an E5 that already includes every component."
At the M365 or EA renewal, and whenever a security-stack standardisation is underway. The entitlement reconciliation — stripping duplicated EMS lines, persona-mapping the Intune Suite, and right-sizing frontline devices to F-SKUs — typically recovers a meaningful slice of endpoint spend with no loss of capability. For estates above a few thousand seats it routinely returns many times its advisory cost. Sequence it inside the renewal so the corrected counts feed the negotiation rather than surfacing after signing.
For the full picture, read the Microsoft security licensing pillar, then the Purview and Sentinel sub-guides, and see the Microsoft EA optimization case study for how endpoint right-sizing folds into a full renewal.
$1.8B+ in documented client savings across 340+ engagements. Buyer-side only since 2016. Gartner recognised.
Weekly compliance intelligence for IT leaders.
