Microsoft Intune is licensed as a stand-alone Plan 1 / Plan 2 SKU, as a component of Enterprise Mobility + Security E3 / E5 and as a component of Microsoft 365 E3 / E5. The Admodum read on the Intune licensing model, the per-user-per-device entitlement and the renewal-time disposition.
Microsoft Intune is the unified endpoint-management surface: mobile device management (MDM) for iOS, Android, Windows, macOS and Linux; mobile application management (MAM) for the management of corporate data inside personal or unmanaged devices; and the configuration, compliance and policy plane that sits above. Intune sits inside the Entra ID and Defender for Endpoint trust-and-security plane and is the principal zero-trust endpoint surface in the Microsoft stack.
The wider seat-assignment hygiene sits at the seat-assignment hygiene spoke; the M365 plan-tier context sits at Microsoft 365 plans; the wider editorial sits in the Microsoft pillar.
Path one: stand-alone Plan 1 (the principal commercial SKU at roughly eight US dollars per user per month list) or Plan 2 (with endpoint privilege management, advanced analytics and remote help, at roughly thirteen per user per month). Path two: bundled in Enterprise Mobility + Security E3 (Plan 1 with Entra ID P1, Azure Information Protection P1, Defender for Cloud Apps Discovery) or EMS E5 (Plan 2 with Entra ID P2, Azure Information Protection P2, Defender for Cloud Apps). Path three: bundled in M365 E3 (Plan 1 inside the M365 E3 bundle alongside EMS E3) or M365 E5 (Plan 2 inside the M365 E5 bundle alongside EMS E5).
The decision typically follows the wider plan-tier disposition: if the user is on M365 E3 or E5, Intune is already entitled and stand-alone Intune is double-licensing; if the user is on M365 F1 or F3, the Intune surface is partial (frontline-specific MAM scenarios) and a stand-alone Plan 1 or 2 attach may be needed for richer policies.
The wider frontline context sits at M365 frontline plans; the wider Entra ID context sits at Entra ID licensing; the wider Defender context sits at Defender suite licensing.
Each licensed user may enrol multiple devices into Intune under the per-user entitlement. The published guidance is up to five devices per user for the enrolment-of-personal-devices scenario; for the corporate-managed-device scenario, the per-user entitlement is functionally unbounded. The user-device relationship is established at enrolment time and tracked in the Intune device inventory.
The buyer-side discipline at audit time (see SAM audit anatomy) is to reconcile the device-enrolment register against the user-licence register: every enrolled device must have a corresponding user with an Intune entitlement, the enrolled-device-count per user should sit within published limits, the unenrolled corporate devices should be addressed by the per-device SKU.
The per-device SKU exists for shared-device populations: kiosks (retail tills, hospital triage tablets, factory floor terminals), shared frontline devices, multi-user-per-device workflows. The per-device SKU prices at roughly three US dollars per device per month list and permits any number of users on the device under a documented kiosk-or-shared-device configuration.
The per-device variant is the right tier where: the user-to-device ratio is greater than one (multiple users per device), the device is corporate-supplied and locked to a single workflow, the user population would otherwise need stand-alone Intune licences that they would not exercise outside that single device. The wider per-user-per-device construct sits at per-user versus per-device.
The wider seat-assignment hygiene context sits at seat-assignment hygiene; the M365 frontline context sits at M365 frontline plans; the wider SAM scope-control discipline sits at SAM scope control.
The Plan 1 to Plan 2 step-up adds: endpoint privilege management (just-in-time elevation for standard users), advanced app management (a richer app-protection policy surface), advanced analytics (the Intune Advanced Analytics workspace), remote help (an in-product remote-support tool with audit logging). The step-up sits at roughly five US dollars per user per month at list.
The breakeven test runs against the helpdesk and security-engineering economics: does the population need just-in-time elevation against standard-user posture (yes for any organisation pursuing the principle of least privilege; the JEA-and-EPM equivalent is paid against helpdesk ticket reduction)? Does the population need the advanced-analytics workspace (yes for any organisation tracking endpoint security posture as a KPI)? Does the population need in-product remote help (yes where the existing third-party remote-support tool can be retired)?
The wider Defender posture sits at Defender suite licensing; the wider Entra ID posture sits at Entra ID licensing; the BATNA against third-party MDM and EPM tools sits at Microsoft BATNA.
At renewal the buyer holds six artefacts on the Intune estate: the licence-path map (stand-alone Plan 1 / 2, EMS E3 / E5, M365 E3 / E5; the populations per path), the device-enrolment inventory (devices per user per platform, total per-user enrolment counts), the per-device-licensed kiosk inventory (shared-device populations, user-to-device ratios), the Plan 1 / 2 exercise map (the populations using endpoint privilege management, advanced analytics and remote help), the double-licensing audit (the M365 E3 / E5 population that also carries stand-alone Intune is the right-tiering target) and the renewal-quantum forecast.
The wider engagement sits at the Microsoft practice; the aggregated reading list sits at the Microsoft knowledge hub; the engagement-models read sits at Fixed Fee, Contingency and Annual Retainer; the renewal moment routes to the Renewal Programme; engagement opens at contact.
Microsoft Intune is licensed three ways: as a stand-alone Plan 1 or Plan 2 subscription, as a component of Enterprise Mobility + Security (EMS E3 or E5), or as a component of Microsoft 365 (E3 or E5). The entitlement is per user, and one licensed user may enrol multiple devices.
Yes. EMS E3 includes Intune Plan 1, alongside Entra ID P1 and Azure Information Protection P1. EMS E5 includes Intune Plan 2. A user already licensed for EMS does not need a separate stand-alone Intune subscription.
Yes. Microsoft 365 E3 includes Intune Plan 1 and Microsoft 365 E5 includes Intune Plan 2, because both bundle EMS. A user on M365 E3 or E5 who also holds a stand-alone Intune licence is double-licensed.
At list price, stand-alone Intune Plan 1 is roughly $8 per user per month and Plan 2 roughly $13; the per-device variant for shared devices is roughly $3 per device per month. Intune carries no extra cost where the user is already on EMS or Microsoft 365 E3/E5.
Intune is a per-user entitlement, so one licensed user may enrol multiple devices. Microsoft's published guidance is up to five personal devices per user; for corporate-managed devices the per-user entitlement is functionally unbounded.
Plan 2 adds endpoint privilege management, advanced app management, advanced analytics and remote help on top of Plan 1's core device and app management. The step-up is roughly $5 per user per month at list.
A senior Admodum Microsoft advisor will read your licence-path map, the device-enrolment inventory and the Plan 1 / Plan 2 exercise map against the renewal-time disposition framework on a private call. Renewal moments route to the Renewal Programme.