Microsoft Intune Pricing 2026: Plan 1 vs Plan 2 vs Suite, and What You Already Own

The short answer: Microsoft lists Intune Plan 1 at US$8 per user per month, the Plan 2 add-on at US$4 and the Intune Suite add-on at US$10 (both need Plan 1). Many firms already own Plan 1 through Microsoft 365 Business Premium, E3 or E5. The real cost is the licence gap for staff on lower plans, plus setup and management.

Microsoft Intune pricing looks simple on Microsoft's price card and gets confusing the moment you hold it up against your own tenant. Some of your users already have Intune and do not know it. Some do not have it and need it. A few might benefit from an add-on, and most never will. And the line item that decides whether the project succeeds — the work of setting Intune up and keeping it running — appears on no Microsoft price list at all.

This guide sets out the current Microsoft list prices for Intune Plan 1, Plan 2 and the Intune Suite, which Microsoft 365 plans already include Intune, how to find the licence gap seat by seat, how to protect partners' personal phones without enrolling them, and what a realistic total looks like for a 60-seat Hong Kong office. If you want the short version in a table, Brocent keeps a Microsoft Intune pricing page with the same list prices, and our mobile device management and BYOD service covers the rollout and day-to-day management described below.

How much does Microsoft Intune cost in 2026?

Microsoft publishes Intune prices in US dollars, per user per month; the add-ons are listed as annual subscriptions that renew automatically. As of 9 October 2026, Microsoft's own Intune plans and pricing page lists:

• Microsoft Intune Plan 1: US$8.00 per user per month. This is the base product: device enrolment, configuration and compliance policies, app deployment, app protection for mobile devices, and endpoint analytics.
• Microsoft Intune Plan 2 (add-on): US$4.00 per user per month, on top of Plan 1. Specialty and shared-device management, Microsoft Tunnel for mobile application management, and firmware-over-the-air updates.
• Microsoft Intune Suite (add-on): US$10.00 per user per month, on top of Plan 1. A bundle of the advanced modules listed below.
• Individual Suite modules (add-ons, each requiring Plan 1): Remote Help US$3.50, Endpoint Privilege Management US$3.00, Advanced Analytics US$5.00, Enterprise Application Management US$2.00, Microsoft Cloud PKI US$2.00.

Two consequences follow straight away. First, Plan 2 is not a US$4 product: it cannot be bought alone, so the real figure for a user who needs it is US$12 (US$8 + US$4). Second, the Suite only saves money once the modules you need would cost more than US$10 bought individually. Any one or two modules cost less on their own (the dearest pair, Advanced Analytics plus Remote Help, is US$8.50); it takes three or more, such as Remote Help, Endpoint Privilege Management and Advanced Analytics at US$11.50, before the Suite can come out ahead. Microsoft Learn also lists Plan 2 as included in the Suite, which adds to its value if you need Plan 2 features as well.

Prices in Hong Kong dollars depend on how you buy. Microsoft sells Intune through Cloud Solution Provider (CSP) partners and direct agreements, and the local price can differ from a straight currency conversion. At an indicative 7.8 HKD to the US dollar, US$8 is roughly HK$62 per user per month, but treat that as an estimate and confirm the price on your actual quote.

Is Intune included in Microsoft 365?

Often, yes — and this is where most overspending starts. Before anyone buys a standalone Intune licence, check what your users already have.

• Microsoft 365 Business Premium includes Intune Plan 1, together with Microsoft Entra ID P1 and Microsoft Defender for Business. Business plans are limited to 300 users.
• Microsoft 365 E3 and E5 include Intune Plan 1, as do Enterprise Mobility + Security (EMS) E3 and E5.
• Microsoft 365 Business Basic and Business Standard do not include Intune. Neither does Microsoft 365 Apps for business.

Microsoft is also folding parts of the Intune Suite into its enterprise plans. Its pricing page says that, starting July 2026 (calendar Q3 2026), Microsoft 365 E3 gains Remote Help, Advanced Analytics and the Plan 2 capabilities, and E5 gains those plus Endpoint Privilege Management, Cloud PKI and Enterprise Application Management. Tenants receive a 30-day notice in the Microsoft 365 Message Center before the change is switched on. If your firm is on E3 or E5, check the Message Center before buying any Intune add-on — you may be about to receive it as part of what you already pay for.

In Hong Kong, the most common pattern in a professional-services office is a mixed estate: partners and fee earners on Business Premium, support staff on Business Standard, and a handful of shared or reception devices that nobody licensed at all. That mix is exactly what the licence-gap check below is for.

Intune Plan 1 vs Plan 2 vs Intune Suite: what each adds

The comparison below is about capability, not price. Most small and mid-sized firms need only the first.

Intune Plan 1 vs Plan 2 vs Intune Suite compared

• Intune Plan 1 — the foundation: enrol Windows, macOS, iOS/iPadOS and Android devices; push Wi-Fi, VPN, encryption and password policies; mark non-compliant devices so Conditional Access can block them; deploy and update apps; apply app protection policies to Outlook and Teams on phones; wipe company data from a lost device. For a law firm, accountancy or trading office, this covers what an insurer's questionnaire usually asks about.
• Intune Plan 2 — specialist devices: shared and specialty devices (rugged handhelds, kiosks, frontline shared phones), Microsoft Tunnel for mobile application management so unenrolled phones can reach internal apps, and firmware-over-the-air updates for supported Android hardware. Rarely needed in an office of 60 people.
• Intune Suite — advanced operations and security: Remote Help (secure, logged remote support from inside Intune), Endpoint Privilege Management (let users elevate a specific installer without making them local admins), Cloud PKI (certificates for Wi-Fi and VPN without running your own certificate server), Enterprise Application Management (a catalogue of third-party apps kept up to date) and Advanced Analytics. Valuable when you already run Plan 1 well and need enough of these that their individual prices add up to more than US$10.

A useful rule of thumb: buy Plan 1 (or confirm you already own it), run it properly for a quarter, and only then ask whether a specific Suite module solves a problem you can name. A firm that buys the Suite before its compliance policies are even switched on has paid for features nobody will configure.

Note that Microsoft has been repackaging these plans during 2026, and its own documentation describes the boundaries slightly differently from page to page. Re-check the current packaging on Microsoft's licensing page on the day you buy.

The licence-gap check: who actually needs a new Intune licence?

Intune is licensed per user (a licensed user can enrol several devices), with a separate device-only licence for devices that have no user, such as kiosks or meeting-room tablets. Microsoft's licensing terms say any user or device that benefits from the service needs a licence. Administrators, on the other hand, can manage Intune without a licence of their own in tenants created after July 2021.

So the check is a seat-by-seat list, not a headcount multiplied by US$8:

• Step 1 — export your licences. In the Microsoft 365 admin centre, list every user and the plan assigned to them. Note which plans already carry Intune Plan 1.
• Step 2 — mark who needs device management. Anyone who reads client email or documents on a laptop or phone does. Service accounts and leavers' mailboxes do not.
• Step 3 — find the gap. Users who need management but sit on Business Basic, Business Standard or Apps for business are your gap.
• Step 4 — price two ways to close it. Either add Intune Plan 1 to those users, or upgrade them to Business Premium. The second route also adds Entra ID P1 (needed for Conditional Access) and Defender for Business, which is why it often wins.
• Step 5 — count shared devices separately. Reception iPads, meeting-room PCs and scanners with an operating system need device-only licensing or a user licence, depending on how they are enrolled.

Do not skip the Entra point. Standalone Intune Plan 1 manages devices, but the policy that actually stops an unmanaged device from opening client email is Conditional Access, which requires Microsoft Entra ID P1. A firm that buys Intune Plan 1 for Business Standard users and forgets Entra ID P1 ends up with devices it can see but cannot gate.

Can we manage partners' personal phones without enrolling them?

Yes, and for most partners this is the answer they prefer. Intune app protection policies (often called MAM, mobile application management) apply to the apps rather than the phone. Outlook, Teams, OneDrive and Word on a partner's own iPhone can be required to use a PIN, blocked from copy-pasting client data into personal apps, and selectively wiped of firm data if the phone is lost or the partner leaves — without the firm seeing personal photos or controlling the device.

App protection is part of Intune Plan 1, so the partner still needs a licence that includes Intune. What it removes is the hardest conversation in a partnership: asking a senior partner to hand over control of their personal phone. Pair it with a Conditional Access rule that only lets approved apps reach Microsoft 365, and the insurer's "do you control company data on mobile devices?" question has a clear yes.

Full enrolment still makes sense for firm-owned laptops and any firm-issued phones. The two approaches sit side by side in the same tenant.

What does Intune setup and management cost?

The licence is the smaller part of the bill. Intune does nothing useful until someone designs and applies the policies, and it keeps needing attention after that: new starters, leavers, lost phones, operating-system updates, compliance reports for the insurer.

Typical work in a first rollout for a firm of this size:

• Discovery and design: inventory devices, decide which are enrolled and which use app protection only, agree compliance rules (encryption, OS version, screen lock), and plan the Conditional Access policies.
• Baseline configuration: Windows and macOS security baselines, BitLocker or FileVault, Windows Update rings, Defender settings, Wi-Fi and VPN profiles.
• App and data protection: app deployment, app protection policies for iOS and Android, and the Conditional Access rules that enforce them.
• Enrolment: Windows Autopilot or Apple Business Manager for firm-owned devices, user-driven enrolment for the rest, and a short guide for staff.
• Pilot and cut-over: a small pilot group, fixes, then the whole firm, with a period where non-compliant devices are reported before they are blocked.

After the rollout, the ongoing work is monthly: reviewing non-compliant devices, approving app updates, handling joiners and leavers, keeping policies current as Microsoft changes the product, and producing evidence when an insurer or a client's due-diligence questionnaire asks for it.

Brocent does not publish a fixed Intune setup fee, because it depends on device count, platforms and how much is already configured; we quote it after a short review of the tenant. In Brocent's managed IT plans, device management is an add-on rather than bundled into every tier, so a firm only pays for it when it needs it. The managed IT support page shows the current plans and price table.

What does Intune cost for a 60-seat Hong Kong office? A worked example

Take a 60-seat professional-services office in Hong Kong with this licence mix:

• 40 partners and fee earners on Microsoft 365 Business Premium (Intune Plan 1 already included).
• 20 support staff on Microsoft 365 Business Standard (no Intune, no Entra ID P1).
• 4 shared devices: two reception iPads and two meeting-room PCs.

Licence gap: 20 users plus 4 shared devices. The 40 Business Premium users cost nothing extra for Intune.

Option A — add Intune Plan 1 to the 20 Business Standard users. At Microsoft's list price, 20 × US$8 = US$160 a month, or US$1,920 a year. This manages their devices but does not add Entra ID P1, so Conditional Access for those users needs another licence on top.

Option B — upgrade the 20 users to Business Premium. Brocent's Microsoft 365 pricing page lists Hong Kong list prices of HK$97.50 per user per month for Business Standard and HK$171.67 for Business Premium (prices last verified 5 July 2026). The difference is HK$74.17 per user, so 20 users cost HK$1,483.40 more per month, about HK$17,800 a year. That buys Intune Plan 1, Entra ID P1 and Defender for Business together — the full set an insurer's device-security questions are usually checking.

Add-ons: for this firm, probably none. No rugged or kiosk devices, no need for Tunnel, and Remote Help can be weighed later. Buying the Intune Suite for all 60 users would add 60 × US$10 = US$600 a month at list price — worth it only if the modules the firm will actually use would cost more than US$10 per user bought individually.

Setup and management: quoted separately, as above. In most first-year budgets this is a larger number than the licence gap, and it is the number that decides whether the licences deliver anything.

The point of the example is not the exact total — your mix will differ — but the order of the decision: find the gap, price the two ways to close it, leave add-ons until there is a named need, and budget properly for the work.

Case study: A composite of the firms we speak to — a 55-person Hong Kong law practice on Microsoft 365. Its cyber insurer's renewal form asked whether the firm could remotely wipe company data from lost devices. The office manager assumed that meant a new Intune contract for everyone. A licence export showed 38 people already on Business Premium. The gap was 17 support staff and three shared devices. The firm upgraded the 17 to Business Premium, used app protection only on partners' personal phones, enrolled firm laptops through Autopilot, and answered the insurer's question with a compliance report rather than a promise.

Do we need Intune for cyber insurance?

Not Intune specifically, but most cyber insurance questionnaires and client security questionnaires now ask some version of: are company devices encrypted, are they patched, can you remotely wipe a lost device, and can you stop unmanaged devices from accessing company data? In a Microsoft 365 firm, Intune plus Conditional Access is the most direct way to answer all four with evidence. The questionnaire is usually what turns "we should look at device management" into a budget line.

How to choose: a five-point checklist before you buy

• Check the Message Center first if you are on E3 or E5: some Suite capabilities may already be on their way to you.
• Run the licence export and count the gap in users and shared devices; never buy by headcount.
• Price the upgrade route (to Business Premium) against standalone Intune, and include Entra ID P1 in the comparison.
• Use app protection for personal phones and full enrolment for firm-owned devices.
• Budget the setup and the monthly management separately from the licences, and ask whoever does it what evidence they will give you for insurers and clients.

Frequently asked questions

How much does Microsoft Intune cost?

Microsoft's list price is US$8 per user per month for Intune Plan 1. The Plan 2 add-on is US$4 and the Intune Suite add-on is US$10, both on top of Plan 1. Local prices through a CSP partner can differ slightly from a direct currency conversion.

Is Intune included in Microsoft 365 Business Premium?

Yes. Business Premium includes Intune Plan 1, along with Entra ID P1 and Defender for Business. Business Basic, Business Standard and Apps for business do not include Intune.

What is the difference between Intune Plan 1 and Plan 2?

Plan 1 is the core device and app management product. Plan 2 is an add-on for specialist cases — shared and specialty devices, Microsoft Tunnel for mobile app management, and firmware-over-the-air updates. It cannot be bought without Plan 1, so the combined price is US$12 per user per month.

Is the Intune Suite worth it?

Only if the modules you will actually use — Remote Help, Endpoint Privilege Management, Cloud PKI, Enterprise Application Management or Advanced Analytics — would cost more than US$10 per user per month bought individually. Any one or two modules cost less on their own (at most US$8.50); three or more often do not, and Microsoft Learn lists Plan 2 as included in the Suite. If you are on Microsoft 365 E3 or E5, check first: Microsoft is adding several Suite capabilities to those plans from July 2026.

Can we manage personal phones without enrolling them?

Yes. Intune app protection policies protect firm data inside Outlook, Teams and Office apps on a personal phone and can wipe that data alone, without enrolling or controlling the device. The user still needs a licence that includes Intune Plan 1.

Do administrators need an Intune licence?

Not in most cases. Tenants created after July 2021 allow administrators to manage Intune without an assigned Intune licence; older tenants can turn this on. Licences are needed for the users and devices being managed.

How long does an Intune rollout take?

It depends on device count, platforms and how much is already configured. For a firm of around 60 people the work runs through discovery, baseline policies, a pilot group and a firm-wide cut-over, with a reporting period before non-compliant devices are blocked. Plan it in weeks rather than days, and avoid a single-weekend switch-over.

Getting Intune pricing right

The Intune licence is usually the cheapest and least important number in the decision. Many firms already own it. The questions that matter are which users fall in the gap, whether upgrading them to Business Premium is better value than standalone Intune, and who will design and run the policies that turn a licence into evidence an insurer will accept.

Brocent's Microsoft Intune pricing page keeps the list prices in one place, and our MDM and BYOD service covers the licence-gap review, rollout and monthly management for offices in Hong Kong, Singapore and Mainland China. If you would like a second opinion on your licence mix before you buy anything, contact our team with a licence export and we will tell you where the gap really is.

Sources: Microsoft, "Microsoft Intune plans and pricing" (microsoft.com, checked 9 October 2026); Microsoft Learn, "Microsoft Intune licensing plans and options" (updated August 2026); Brocent Microsoft 365 and Microsoft Intune pricing pages (list prices last verified 5 July 2026).