azureblog.co.uk
← cd ~/posts

Intune's advanced features are coming to Microsoft 365 E3 and E5

Remote Help, Endpoint Privilege Management, Cloud PKI and more are moving into the main Microsoft 365 licences. If you've been holding off because of the add-on cost, it's time to look again.

2 min read✓ checked 2 Jul 2026Intune · Microsoft 365 · What's new
On this page
  1. What you get
  2. How it rolls out
  3. What to do with it
  4. Where to start
  5. An Endpoint Privilege Management pilot

Many of Intune's best features have been paid add-ons, sold separately or in the Intune Suite. That made them easy to admire and hard to justify. Microsoft is now folding them into Microsoft 365 E3 and E5.

What you get

LicenceAdds
M365 E3Remote Help, Advanced Analytics, and Intune Plan 2 (Microsoft Tunnel for , specialty device management, and firmware-over-the-air updates for supported devices)
M365 E5Everything in E3, plus Endpoint Privilege Management, Enterprise Application Management and Microsoft Cloud PKI
Microsoft 365 E5Endpoint Privilege Management, Enterprise App Management, Cloud PKI
Microsoft 365 E3Remote Help, Advanced Analytics, Intune Plan 2
Intune Plan 1Core device and app management

↓ E5 includes everything in E3

How the capabilities stack up.

How it rolls out

  • It's gradual, and eligible tenants are provisioned automatically. There's nothing to buy or assign.
  • Microsoft posts a notice in the Microsoft 365 admin center 30 days before the change reaches your tenant.
  • It covers commercial E3 and E5 only. Education and frontline plans aren't changing for now, and government plans will follow, subject to compliance requirements.

What to do with it

  • Endpoint Privilege Management (E5). Lets standard users run specific approved tasks with elevation, without being local admins. If you still hand out local admin rights for one or two apps, this is the quickest security win on the list.
  • Enterprise Application Management (E5). A catalogue of pre-packaged that Intune can deploy and keep updated. Less packaging, fewer outdated apps.
  • Cloud PKI (E5). Issue certificates for Wi-Fi, VPN and other authentication from the cloud, without running your own certificate servers and connectors.
  • Remote Help (E3). Secure, Entra-authenticated remote support built into Intune, with role-based access and logging.
  • Retire overlapping tools. If you're paying for separate remote support, privilege management or PKI products, check renewal dates now.
Watch for the notice: when the 30-day notice arrives, that's your cue to plan pilots. Having the licence doesn't configure anything, so nothing changes for users until you do.

Where to start

What's your biggest pain point?
Users with local admin rightsEndpoint Privilege Management (E5)
Packaging and patching third-party appsEnterprise App Management (E5)
Running certificate servers for Wi-Fi or VPNCloud PKI (E5)
Remote support tool costsRemote Help (E3)
Picking the first feature to adopt.

An Endpoint Privilege Management pilot

  1. List the reasons users currently need local admin, from your service desk tickets.
  2. Create elevation rules for the most common ones, such as a specific installer or tool.
  3. Pilot with a team that has admin rights today, then remove their local admin membership.
  4. Review the elevation reports weekly and add rules where requests repeat.
Sources

Related posts