Licensing conversations in Microsoft environments are uncomfortable because they’re usually happening at the wrong time – after someone has already designed a deployment around capabilities that turn out to require a higher license tier than the organization has.
This article isn’t a licensing guide. Microsoft’s licensing documentation covers the specifics, and those specifics change frequently enough that any article that attempts to be definitive becomes stale quickly. What this article covers is the framework for understanding how licensing shapes what’s available to you in an Intune deployment – and the specific areas where licensing gaps create the most operational surprise.
The most important distinction to understand early is between Microsoft 365 Business Premium and the enterprise licensing tiers. Business Premium is often the entry point for smaller organizations moving to cloud management – it includes Intune, Entra ID P1, Defender for Business, and Exchange Online in a single bundle at a business-appropriate price point. The Intune capabilities available under Business Premium are substantial and sufficient for most SMB deployments. The Defender product included is Defender for Business – a simplified version of Defender for Endpoint designed for smaller environments. This distinction matters because some articles in this series reference Defender for Endpoint Plan 2 capabilities that Defender for Business doesn’t fully replicate.
Microsoft 365 E3 adds volume licensing, advanced compliance features, and a broader enterprise capability set, but notably does not include Entra ID P2 or Defender for Endpoint Plan 2 by default. E3 with the Security add-on, or E3 with EMS E3, gets you closer to the full security stack. E5 includes Entra ID P2, Defender for Endpoint Plan 2, and the full Identity Protection and risk signal capability that makes risk-based Conditional Access meaningful. Understanding where your licensing sits on this spectrum determines which features in this series you can actually deploy.
One recent shift is worth pinning down, because it changed what a lot of tenants own without anyone choosing it. As of July 2026, Microsoft folded a set of advanced Intune capabilities directly into Microsoft 365 E3 and E5. E3 now effectively carries Intune Plan 2, which brings Remote Help, Advanced Endpoint Analytics, Microsoft Tunnel for MAM, specialty device management, and firmware-over-the-air updates. E5 gets all of that and adds the three capabilities that used to be strictly paid add-ons: Endpoint Privilege Management, Enterprise App Management, and Microsoft Cloud PKI. The trap to watch is that this rides on Microsoft 365 E5 specifically, not on the standalone Enterprise Mobility and Security E5 suite, so an EM+S-licensed estate still buys those three separately. If you hold Microsoft 365 E5, the practical consequence is that you may already own controls like privilege management and a managed certificate authority that you simply have not turned on, which is a better problem to have than not owning them at all.
Designing a deployment around Entra ID P2 risk-based policies when your licenses are E3 without add-ons is a design that will fail on contact with reality. Know what you have before you design around what’s possible.
The specific licensing dependencies that affect this series most often: Conditional Access requires Entra ID P1 for all users in scope – included in Business Premium, E3, and above. Risk-based Conditional Access and full Identity Protection signals require Entra ID P2 – included in E5, available as an add-on. Windows Autopatch requires Microsoft Intune Plan 1 or higher and specific Windows edition licensing. Defender for Endpoint Plan 2 features require E5 or the Defender for Endpoint add-on. Windows LAPS backup to Entra ID is available without additional licensing for Entra-joined devices.
Per-user licensing is the model for most of these capabilities. The license needs to be assigned to each user whose devices will be managed – not just to administrative accounts. A common mistake is licensing a subset of users assuming device-based features don’t require user licensing. Intune device management is user-licensed. An unlicensed user whose device is managed by Intune is in an unsupported configuration – behavior may be inconsistent and support may decline to assist.
The license follows the user, not the device. This is the single most common licensing misunderstanding in Intune deployments and the one with the most downstream consequences.
License assignment should be group-based rather than individually assigned where possible. Assigning licenses directly to user accounts creates an operational burden – when users join or leave, licenses need manual management. Group-based licensing assigns licenses to all members of a group automatically, which makes onboarding and offboarding cleaner and creates an auditable record of who is licensed for what. The enrollment scope group discussed in Phase 3 can do double duty – the group that defines who can enroll can also be the group that drives license assignment.
Verify your current license assignments and available license counts before beginning deployment design. The Microsoft 365 admin center shows assigned versus available licenses per SKU. Entra ID shows per-user license assignment and group-based license status. Running this check at the start of an engagement prevents the discovery mid-deployment that there aren’t enough licenses to cover the planned scope – a problem that’s straightforward to avoid and disruptive to fix.
Intune Deployment Guide · Phase 2: Identity and Tenant Foundation
‹ Previous: [2.1.2] Implementing Tenant Customization and Branding
Next: [2.2] Groups, Roles, and Access Boundaries ›
