Microsoft Intune Plan 1 Device [New Commerce Experience]

What it is

The device based form of Microsoft Intune Plan 1. Plan 1 is the base unified endpoint management service; this licence covers a device rather than a person.

Who it is for

Microsoft's own examples are kiosks, dedicated devices, phone room devices, Internet of Things devices and other single use devices. The shape to look for is hardware that belongs to a task rather than to a person: warehouse scanners, shop floor terminals, rugged handsets on a shift rota, screens nobody signs in to.

Microsoft licenses meeting room hardware differently. For Microsoft Teams Rooms devices, including Surface Hub, it points to Teams Rooms Pro licences, the Teams Shared Device licence, or a Teams plan that includes Intune Plan 1, so do not assume this SKU covers them.

The six enrolment methods it applies to

Microsoft states that device licences apply when a device is enrolled through any of the following:

• Windows Autopilot self deploying mode
• Apple Device Enrollment Program without user affinity
• Apple School Manager without user affinity
• Apple Configurator without user affinity
• Android Enterprise dedicated
• Enrolment using a device enrolment manager account

Three things it does not support

Microsoft states that when a device is enrolled using a device licence, the following Intune functions are not supported:

• Intune app protection policies
• Conditional Access
• User based management features, such as email and calendaring

Conditional Access, stated carefully, because two Microsoft pages say different things

The licensing page lists Conditional Access as unsupported on a device licensed enrolment. The Android Enterprise compliance reference is more specific and more useful, and it is worth reading before designing an access model.

Microsoft states there that compliance policies are evaluated on dedicated devices, and that they must be targeted at groups of devices, not users, because the policy is evaluated against the device and reflects the device compliance state in Intune. It then states that users on dedicated devices enrolled without Microsoft Entra shared device mode cannot sign in to resources protected by Conditional Access policies, even if the device is compliant in Intune, and recommends Android Enterprise dedicated with Microsoft Entra shared device mode to allow those users to sign in to Conditional Access protected resources.

So the accurate position: device compliance is not lost, but the signed in user does not reach Conditional Access protected resources unless the deployment uses shared device mode. If the access design depends on a person on a shared device reaching gated resources, that dependency has to be designed in, not assumed.

The boundary against the user licence

Microsoft's rule for multi user hardware is an either or, not a ranking: a device used by more than one user needs either a device based licence or a user licence for every one of its users. Each user licence covers that user and up to 15 devices under mobile device management.

The decision is therefore arithmetic and functional at the same time. Count the users per device, and check the unsupported list against what those users have to do.

Sizing

Microsoft's guidance is to assign device licences based on estimated usage. Count endpoints enrolled without user affinity rather than deriving a number from headcount.