Intune Suite Expands into Microsoft 365 E3 and E5

Almost there Link to heading

When Microsoft announced in December 2025 that Intune Suite capabilities would be bundled into Microsoft 365 E3 and E5, the CY26 Q3 target felt comfortably distant. Six months later, Message Center notifications are landing in tenants and the rollout is weeks away. The official completion date is 1 August 2026. According to a Microsoft employee, 18 July is the internal target for all tenants to receive the entitlements, though the publicly committed date remains 1 August. Our tenant’s notification shows 18 July as the activation date.

No action is required to receive the new capabilities. Eligible tenants are provisioned automatically, with at least 30 days’ notice before anything changes in their environment. The question at this point is not whether you’ll receive these features, but whether you’ll be ready to use them when they arrive.

Capabilities added per plan Link to heading

What Intune Plan 2 covers Link to heading

Intune Plan 2, added to EMS E3, groups three capabilities:

• Tunnel for MAM: per-app VPN access to corporate resources without requiring full device enrolment. Particularly relevant for BYOD scenarios where IT needs to protect corporate data without touching the personal device partition.
• Specialty device management: coverage for AR/VR headsets, smart screens and certain meeting room systems — device categories that have historically sat outside standard MDM scope.
• FOTA for Zebra devices: firmware over the air updates for supported Zebra hardware, closing a gap for organisations running ruggedised Android estate.

Windows Enterprise E3 additions Link to heading

Alongside the Intune changes, Windows Enterprise E3 (included in Microsoft 365 E3) gains:

• Quick Machine Recovery: enterprise-level controls, point-in-time restore and cloud rebuild for Windows 11, managed through Intune
• Autopatch update readiness: real-time visibility into device compliance and update risks through a pre-built Intune dashboard, currently in preview
• Post-quantum security APIs

These resiliency capabilities are part of the same packaging update but separate from the Intune Suite bundling. A Windows Enterprise per-device licence receives a subset: basic QMR and point-in-time restore, plus Software Assurance.

The pricing context Link to heading

The packaging changes arrived alongside price increases effective 1 July 2026. Microsoft 365 E3 and E5 both increased by $3/user/month. The wider update affected most commercial SKUs: Business Basic up $1, Business Standard up $1.50 and frontline plans significantly more on a percentage basis (M365 F1 up 33%, M365 F3 up 25%).

For organisations already paying for the Intune Suite add-on ($10/user/month), the bundling of Remote Help, Advanced Analytics and Intune Plan 2 into E3, and of EPM, Cloud PKI and Enterprise Application Management into E5, represents a meaningful reduction in total per-user cost at next renewal. For organisations without Intune Suite add-ons, the price increase was net new cost regardless of whether they plan to use what is being added.

The Intune Suite add-on is not being discontinued. Customers who need capabilities beyond what is bundled, or who hold non-E3/E5 plans, can still purchase it separately.

Before your tenant activates Link to heading

With the rollout imminent, this is the window to get ahead of it rather than react to it:

• Check which capabilities apply to your plan. Remote Help and Advanced Analytics for E3, EPM and Cloud PKI for E5. The Intune licensing overview on Microsoft Learn has the current entitlement matrix.
• Do not wait for activation to start planning. Remote Help requires role assignments. Endpoint Privilege Management needs elevation rules before it does anything useful. Cloud PKI requires issuing CA configuration. None of these are meaningfully on by default.
• Review Intune Suite add-on licences ahead of your next renewal. If E3 or E5 now covers most of what you purchased the Suite for, the add-on is worth revisiting.
• Government and sovereign cloud tenants: packaging follows a separate validation process and timeline. Check the Microsoft 365 Admin Center directly for your environment.