Intune — Microsoft Intune
Category: cloud
Last reviewed by the MSLicenseHub Licensing Desk.
Microsoft Intune is a cloud-based endpoint management solution that provides Mobile Device Management (MDM) and Mobile Application Management (MAM). It serves as the primary control plane for securing, deploying, and managing corporate and personal devices—including Windows, macOS, iOS, Android, and Linux—while ensuring that access to organizational data is governed by specific security compliance policies.
Technical Scope and Functionality
Intune operates as a central component of Microsoft’s "Unified Endpoint Management" (UEM) strategy. Its core functionality is divided into two distinct management styles:
- Mobile Device Management (MDM): The organization "enrolls" the device. This grants administrators full control over the hardware, allowing them to push security certificates, configure Wi-Fi/VPN settings, enforce full-disk encryption, and remotely wipe the device if it is lost or stolen.
- Mobile Application Management (MAM): Used primarily for Bring Your Own Device (BYOD) scenarios. Instead of managing the whole phone, Intune manages only specific apps (like Outlook or Teams). It prevents corporate data from being copied into personal apps (e.g., preventing "Copy/Paste" from a work email to a personal Facebook account) without requiring the user to enroll their entire device.
Licensing Structure
Microsoft Intune is rarely purchased in isolation for enterprise environments, though standalone options exist. It is typically acquired via the following vehicles:
| License Type | Description |
|---|---|
| Bundled Suites | Included in Microsoft 365 E3, E5, F1, F3, and Business Premium. It is also a core component of the Enterprise Mobility + Security (EMS) E3/E5 suites. |
| Intune Plan 1 | The foundational cloud-based management license included in the suites above. Covers all core MDM and MAM features. |
| Intune Plan 2 / Suite | Add-on licenses for advanced features like Remote Help, Endpoint Privilege Management (EPM), and advanced specialized device management. |
| Device-Only | A specific subscription for non-user-aligned devices, such as digital signage, kiosks, or shared meeting room devices. |
Practical Considerations for Buyers
On a formal quote or Microsoft Customer Agreement (MCA), Intune usually appears as a line item within a "Microsoft 365" SKU or as "Intune Plan 1." When reviewing a quote, it is critical to distinguish between user-based licenses and device-based licenses. Standard Intune licenses are assigned per user, allowing that individual to enroll up to 15 devices. If you are managing shared kiosks, ensure you are not overpaying for user licenses when "Intune for Devices" is more appropriate.
A common misunderstanding involves the relationship between Intune and Configuration Manager (MECM/SCCM). While Intune is cloud-native, many organizations use "Co-management," which allows both tools to manage the same Windows devices simultaneously. Furthermore, Intune is the "policy engine" for Conditional Access; while Azure AD (Microsoft Entra ID) enforces the login, it looks to Intune to verify if the device is "Compliant" before granting access.
Note on Hardware: Intune is often used to manage Windows Autopilot deployments. While the Intune service manages the software lifecycle, the underlying Windows OS license must still be present. Note that OEM licenses (Windows Pro/Home) are pre-installed by hardware manufacturers and cannot be purchased as standalone Intune-related software products; Intune merely manages the OS that is already legally licensed to the hardware.
Need this in a quote?
Our team translates glossary concepts into concrete licenses, part numbers and price lists.
Request a quote