Microsoft has started a significant change to the endpoint-management value included with Microsoft 365. Advanced Intune capabilities that previously required separate licensing are now being distributed across eligible Microsoft 365 E3 and E5 subscriptions.

What changed

From July 2026, Microsoft 365 E3 includes Intune Plan 2, Remote Help and Advanced Analytics. Microsoft 365 E5 and E7 include those E3 capabilities plus Endpoint Privilege Management, Microsoft Cloud PKI and Enterprise Application Management.

These are not simply extra portal tiles. They can change how platform teams approach remote support, least-privilege administration, certificate lifecycle management, application packaging and endpoint experience analytics.

Who is affected

The change matters most to organisations running Microsoft 365 E3 or E5 that currently license comparable products separately, rely on manual operational processes, or have not yet built a roadmap for the advanced Intune capabilities.

Microsoft says eligible EMS E3, Microsoft 365 E3 and Microsoft 365 E5 tenants will receive the new Intune entitlements automatically. Standalone Intune Suite and add-ons remain available for customers on other plans or with different requirements.

Rollout and licensing status

This is a rolling-out change, not a roadmap-only announcement. Microsoft states that the new features began rolling out in calendar-year 2026 Q3 and should be available to eligible tenants by 1 August 2026. Customers should receive a 30-day Message Center notice before activation. No opt-in is required to receive the entitlements.

The associated Microsoft 365 commercial pricing changes took effect on 1 July 2026 for new purchases and apply to existing customers at their next renewal. Pricing varies by market and agreement, so commercial impact should be validated against your own licensing position rather than assumed from headline figures.

What platform teams should do now

First, review Message Center and confirm which entitlements have appeared in your tenant. Treat entitlement availability as the start of assessment, not automatic approval for production use.

Second, map the new capabilities against existing tools and contracts. Remote Help, Endpoint Privilege Management, Cloud PKI and Enterprise Application Management may overlap with service-desk, privilege-management, certificate and application-packaging products. Build the business case before changing established controls.

Third, establish ownership and guardrails. Define administrative roles, data-retention expectations, support processes, pilot groups and success measures. Endpoint Privilege Management in particular should be designed around least privilege, approved elevation scenarios and auditable policy—not used as a convenience feature.

Finally, pilot one outcome at a time. A focused Remote Help pilot or a small Enterprise App Management catalogue is easier to govern and measure than enabling several capabilities at once.

The licensing change creates useful options, but the value will come from disciplined adoption: clear use cases, strong operational ownership and measured rollout.

Official Microsoft sources

Microsoft Learn — Planning guide to move to Microsoft Intune: https://learn.microsoft.com/en-us/intune/fundamentals/planning-guide

Microsoft Licensing — Microsoft 365 packaging and pricing FAQ: https://www.microsoft.com/en-us/licensing/news/2026-m365-packaging-pricing-updates-faq

Microsoft Learn — Intune advanced capabilities: https://learn.microsoft.com/en-us/intune/fundamentals/advanced-capabilities

Microsoft Intune Blog — Advanced Microsoft Intune capabilities now available in Microsoft 365 E3 and E5: https://techcommunity.microsoft.com/blog/microsoftintuneblog/advanced-microsoft-intune-capabilities-now-available-in-microsoft-365-e3-and-e5/4529335