Microsoft Intune for SMBs: What Your License Covers
If you're on Microsoft 365 Business Premium, you may already own Intune. What it does, which plans include it, and the costs and gotchas that surprise SMBs.
Most small businesses arrive at device management the same way. You hire faster than you planned, laptops get bought wherever they’re in stock, half the team reads work email on personal phones, and one day someone asks a reasonable question: if a laptop walks out of here, what happens to the data on it?
The usual assumption is that answering that question means buying something new. Often it doesn’t. If you’re on Microsoft 365 Business Premium, the device management tool is already sitting in your tenant, unassigned and switched off.
Here’s what Microsoft Intune does, how to work out what your license covers, and where the real costs and gotchas show up.
What Intune actually is
Intune is Microsoft’s cloud service for managing endpoints — enrolling devices, pushing configuration and security settings, deploying and updating applications, and applying policies to the apps people use on phones you don’t own.
The practical version, for a 20-person office:
- Company laptops enroll and receive a consistent baseline instead of whatever configuration the last person set up by hand.
- Compliance policies define what “acceptable” means — disk encryption on, screen lock enabled, OS at a supported patch level.
- App protection policies can govern work data inside apps like Outlook on a personal iPhone, without you taking control of the whole phone.
- A lost or departing device can be wiped remotely or have work data removed.
One 2026 pricing guide describes Plan 1 as covering baseline endpoint management, mobile application management, built-in endpoint security and cross-platform support across Windows, macOS, iOS and Android. That cross-platform reach is the part SMBs tend to underrate — small offices are almost never single-platform.
A note on framing: these are things Intune can be configured to do. A license and an enrolled device are not, on their own, a security outcome. The configuration is the work.
Which Microsoft 365 plan are you on?
This is the qualifying question, and most owners and office managers don’t know the answer offhand. Third-party licensing analysis published in July 2026 lays out the split like this:
| Plan | Intune Plan 1 included? |
|---|---|
| Microsoft 365 Business Basic | No |
| Microsoft 365 Business Standard | No |
| Microsoft 365 Business Premium | Yes |
| Microsoft 365 E3 / E5 | Yes |
| Microsoft 365 F1 / F3 | Yes |
| Enterprise Mobility + Security E3 / E5 | Yes |
| Any Office 365 plan | No |
The same analysis reports that Intune Plan 1 is included at no additional cost with those SKUs, and that it is not included with Business Basic, Business Standard or Office 365 plans. A Microsoft Q&A response from September 2025 states that Intune is fully included with Microsoft 365 Business Premium, with no separate Intune plan required. Worth knowing that a Q&A thread is a support answer, not formal licensing documentation — confirm against Microsoft’s current Business Premium service description, or just look at your own tenant’s license list, before you plan around it.
A separate June 2026 licensing explainer makes the point plainly: because Business Premium already includes Intune Plan 1, the only step required is assigning the licenses you already have, at zero additional cost.
If you’re on Business Standard, that’s the fork in the road. You’d be looking at adding Intune or stepping up to Business Premium — and Business Premium bundles other things worth pricing into the comparison rather than evaluating Intune in isolation.
What changed on July 1, 2026, and why it probably doesn’t affect you
You may have seen headlines about Intune getting cheaper. Read them carefully, because this is an enterprise licensing story.
Microsoft’s Intune blog confirmed on July 1, 2026 that advanced Intune Suite capabilities are now included in Microsoft 365 E5, with select capabilities available in Microsoft 365 E3, putting into effect packaging changes Microsoft announced in December 2025. In a June 2026 post, Microsoft stated that no plan change is necessary to use those capabilities, that eligible EM+S E3 and Microsoft 365 E5 tenants are provisioned automatically, and that admins of eligible organizations get a notification in the Microsoft 365 admin center 30 days before the change takes effect.
Third-party licensing analysis from June 2026 describes the split as uneven: Microsoft 365 E3 and EM+S E3 receiving Intune Plan 2, Remote Help and Advanced Analytics, while Endpoint Privilege Management, Enterprise App Management and Cloud PKI stay E5-only. That analysis reports the rollout ran from June 2026 and completed by August 1, 2026. Microsoft’s own post attaches footnoted conditions to the E3 capabilities, so treat the tidy version of that table with some caution.
Here’s the part some providers skip: none of this extends Intune Suite inclusion to Microsoft 365 Business Premium. If you’re an SMB on Business Premium, you did not get free Suite features in July. What you likely already had — Intune Plan 1 — hasn’t changed. Anyone telling you otherwise is reading enterprise news to a small-business audience.
The Windows Home problem
This one catches people, and it’s usually a procurement habit rather than a technical failure.
Per that same September 2025 Microsoft Q&A response, devices running Windows Home cannot be enrolled in Intune MDM and must be upgraded to Windows Pro. The response notes the upgrade can be applied without reformatting or losing data. Again, that’s a support answer rather than licensing documentation, so it’s worth confirming against Microsoft’s supported-platforms docs — but it matches what small businesses run into in practice.
Retail laptops frequently ship with Windows Home. So a business that bought six machines from a big-box store over two years may find that some of them can’t be enrolled until they’re upgraded. It’s a solvable problem, but it’s a line item and a scheduling exercise — and it’s a strong argument for standardizing what you buy going forward.
What genuinely costs extra
Two honest caveats before any numbers.
First, one 2026 pricing analysis notes that Intune has no permanent free tier for commercial endpoint management, and that Microsoft lists paid Plan 1, Plan 2 and Intune Suite options with trials.
Second, the list prices circulating in 2026 come from third-party pricing guides rather than microsoft.com, and at least one of them flagged a 2026 Intune price increase. For reference: one guide lists Plan 1 around $8.00 per user/month with Plan 2 adding roughly $4.00, and a July 2026 analysis puts Intune Suite layered on Plan 1 at roughly $18 per user/month with individual add-ons at $2–$5 per user/month. Several of those publishers sell licensing services or Intune alternatives, so treat their cost framing as interested rather than neutral, and verify current pricing on Microsoft’s own page before you budget.
There’s also a dependency worth checking. One 2026 cost breakdown notes that Intune features such as Conditional Access and co-management auto-enrollment require Microsoft Entra ID Premium (P1 or P2), which needs separate budgeting if your base SKU doesn’t include it. Before you assume either way, confirm what Entra tier your specific plan includes.
Owning the license isn’t the same as managing the devices
This is the gap we see most often. The license is assigned. Nothing is enrolled. No compliance policies exist. Apps are still installed by hand. Nobody is watching whether a device drifted out of compliance three weeks ago.
Closing that gap is mostly sequencing: decide your device standard, get enrollment working (including any Windows Pro upgrades), write compliance and app protection policies that match how your staff actually work, then automate provisioning so the next laptop configures itself instead of consuming an afternoon.
It also has to sit alongside the rest of your stack rather than replacing it. Intune is the device management and policy layer; endpoint detection and response, network security and backup are separate jobs. palmiq is a Microsoft partner, and our partner set — CrowdStrike, SentinelOne, Sophos, Fortinet, Acronis and Veeam among them — covers those adjacent layers, with 24/7 SOC coverage and a 15-minute response SLA on critical issues behind the work.
Device management also tends to draw outside scrutiny in some sectors, K-12, government contracting and healthcare among them. That’s a longer conversation, and a different post.
Start with the license you already have
If you don’t know which Microsoft 365 SKU you’re on, start there. It’s a five-minute check that determines whether this is a configuration project or a purchasing decision.
Want a second pair of eyes on what you already own and what it would take to actually manage your devices? Book a discovery call and we’ll walk your tenant with you.