Microsoft Intune Suite: what it covers, and who has it
Microsoft Intune Suite
per user per month, excluding VAT
Ask a questionNo markup on top of Pax8's suggested retail. My margin is the Pax8 wholesale discount.
Check whether your current plan already includes this: Licence Overlap Check, free, and nothing leaves your browser.
The Microsoft Intune Suite unifies the advanced endpoint management and security capabilities that sit above the base service, and it includes Intune Plan 2. The capabilities span Remote Help for secure help-desk sessions with role-based access control, Endpoint Privilege Management for running users as standard accounts while still allowing approved elevation, Microsoft Cloud PKI for certificate lifecycle management, Enterprise Application Management with a Microsoft-hosted catalogue of Win32 applications, and Advanced Analytics for endpoint experience insight. Since July 2026 much of this is distributed through the Microsoft 365 enterprise plans, so the first question is what your existing licences already cover.
What it is
The Microsoft Intune Suite brings the advanced endpoint management and security capabilities together in one subscription. It is additive to Intune Plan 1 and includes Intune Plan 2.
Who it is for
Organisations that want several of the advanced capabilities rather than one, and that are on a Microsoft 365 plan which does not already distribute them.
Check your suite first, because this changed in July 2026
- Microsoft 365 E3 includes Intune Plan 2, Remote Help and Advanced Analytics.
- Microsoft 365 E5 and E7 include everything in E3 plus Endpoint Privilege Management, Microsoft Cloud PKI and Enterprise Application Management.
- Other plans buy the Intune Suite as a separate subscription.
On E5 or E7 the Suite may add very little. Confirm against assigned licences before ordering, and if only one capability is missing, buy that capability as a standalone add-on instead.
What the Suite covers
- Remote Help, cloud-based help-desk connections with role-based access controls, on Windows, macOS and Android
- Endpoint Privilege Management, letting users run without administrator rights while still completing approved tasks that need elevation
- Microsoft Cloud PKI, a managed certificate authority handling issuance, renewal and revocation across Intune-supported platforms
- Enterprise Application Management, deploying curated Win32 applications from a Microsoft-hosted catalogue with built-in install and detection settings
- Advanced Analytics, analytics-driven insight into endpoint experience, including anomaly detection, device timelines, device queries and battery health
- Microsoft Tunnel for Mobile Application Management, extending Tunnel VPN to unenrolled Android and iOS devices
- Specialised device management and Android firmware over-the-air updates
Limits worth knowing before deployment
Remote Help needs a licence for both the helper and the user being helped. It cannot cross tenants, may not be available in every market, and is not supported on GCC High or Department of Defense tenants. Advanced Analytics requires endpoint analytics to be configured first, and supports Windows devices that are Intune managed, co-managed, or Microsoft Entra joined or hybrid joined.
Requirements
Intune Plan 1 or Plan 2 is the base. Conditional Access enforcement still requires Microsoft Entra ID P1 or P2.
Should I buy the Intune Suite if I am on Microsoft 365 E5?
Check first. Since July 2026, E5 and E7 include Intune Plan 2, Remote Help, Advanced Analytics, Endpoint Privilege Management, Microsoft Cloud PKI and Enterprise Application Management. On those plans the Suite may add very little.
Can I buy just one capability instead of the Suite?
Yes. Remote Help, Advanced Analytics, Endpoint Privilege Management, Microsoft Cloud PKI and Enterprise Application Management are each available as standalone add-ons on top of Intune Plan 1 or Plan 2.
Who needs a Remote Help licence?
Everyone in the session. Both the helper providing support and the user receiving it need to be licensed. Sessions cannot cross tenants, and Remote Help is not supported on GCC High or Department of Defense tenants.
What does Endpoint Privilege Management do?
It lets users run as standard accounts without administrator rights while still completing approved tasks that require elevation, which removes standing local admin without blocking legitimate work.
Does the Suite include Intune Plan 1?
The Suite is additive to Plan 1 and includes Plan 2. Plan 1 remains the base endpoint management service underneath it.
- Vendor
- Microsoft
- Category
- Endpoint
- Type
- SaaS
- Billing
- Monthly
- Commitment
- 1-Year
- Available terms
- 1-Year, Monthly
- SKU
- MST-NCE-290-C100
- 1You request the licence, or add it to the cart.
- 2I confirm price, term and seats, and check your VAT number in VIES. Businesses in the EU only.
- 3You pay before we provision, under the CSP Marketplace Terms. The invoice comes from Michal Jatczak, a sole trader registered in Malta, trading as ITSailor. Reverse charge for an EU VAT number that validates in VIES.
- 4Your authorised signatory accepts the Microsoft Customer Agreement before activation.
- 5I place the order with Pax8 within one business day of payment.