Microsoft Intune Suite: expanded availability in Microsoft 365
Since July 1, 2025, Microsoft has officially integrated the advanced capabilities of the Microsoft Intune Suite directly into Microsoft 365 E5 licenses, with a subset of capabilities also available in Microsoft 365 E3. This evolution, announced in December 2024, marks a significant milestone for IT teams seeking to consolidate their endpoint management approach without multiplying additional licenses.
This decision is part of a broader trend: the convergence of identity, security, compliance, and AI governance tools within a unified platform. Microsoft Intune is the operational foundation.
Industry Recognition
Microsoft was recently named a Leader in the Forrester Wave™: Endpoint Management Platforms, Q2 2026 report, confirming Intune's strategic positioning in the enterprise endpoint management market.
Why this evolution is strategic for IT teams
Endpoint management is no longer limited to simple MDM policy distribution. It becomes a lever for operational security, service continuity, and AI adoption. Three pillars structure this evolution:
- Reducing the attack surface through the principle of least privilege
- Accelerating IT resolution cycles through near real-time visibility
- Preparing for AI-assisted operations with Microsoft Security Copilot in Intune
Each of these pillars corresponds to features now included in existing Microsoft 365 plans.
Protecting endpoints: EPM and Cloud PKI
Endpoint Privilege Management (EPM)
Microsoft Intune Endpoint Privilege Management (EPM) eliminates permanent local administrator rights while allowing users to perform tasks requiring privilege elevation in a controlled and audited manner. This is a concrete implementation of the Zero Trust principle of least privilege.
Concretely, EPM allows you to:
- Remove local administrator accounts in bulk across the Windows fleet
- Define granular elevation rules by application or process
- Log each elevation request for compliance audits
- Integrate Microsoft Security Copilot for risk assessment before approval
Hino Motors applies EPM to both its Cloud PCs and physical workstations, maintaining a consistent security posture across the entire Windows 365 and Intune fleet.
Tip for EPM deployment
Start with a pilot in Report Only mode before enabling rule enforcement. This allows you to identify applications requiring elevation without impacting user productivity.
Microsoft Cloud PKI
Traditional PKI (Public Key Infrastructure) infrastructures are notoriously complex to operate: expensive deployment, maintenance of on-premises certification authorities, manual certificate lifecycle management. Microsoft Cloud PKI addresses these limitations with a fully managed cloud approach.
Key benefits of Cloud PKI:
- Elimination of on-premises CA infrastructure
- Automation of certificate lifecycle (issuance, renewal, revocation)
- Native integration with Intune for certificate deployment on managed devices
- Support for certificate-based authentication for Wi-Fi, VPN, and applications
For reference, the official Microsoft Cloud PKI documentation is available on Microsoft Learn.
Attention
Advanced Cloud PKI features (beyond the base plan) are part of Intune Suite capabilities. Verify the exact availability according to your E3 or E5 plan in the Message Center of your tenant.
Empowering IT teams: Remote Help, Analytics, and EAM
Remote Help: secure and auditable support
Microsoft Intune Remote Help stands out from traditional remote support tools through its native integration with Microsoft 365 identity and compliance controls. Unlike third-party solutions operating outside your organization's security perimeter, Remote Help applies:
- Azure AD / Entra ID authentication for each session
- Intune Role-Based Access Control (RBAC)
- Complete session logging for audits
- Compliance with Conditional Access policies
This approach is particularly critical for organizations with geographically distributed users, where the delay between incident detection and resolution can directly impact operational continuity.
Advanced Analytics and Multi-Device Query
Microsoft Intune Advanced Analytics transforms endpoint management from a reactive to a proactive approach. Key capabilities include:
- Real-time Device Query: query the state of a specific device without waiting for the next sync cycle
- Multi-Device Query (MDQ): run KQL queries across the fleet to identify trends or anomalies
- Endpoint health score: aggregated visibility on fleet performance and compliance
Example KQL query to identify devices with critical disk space:
1Device2| where DiskSpaceAvailable < 5000 // Less than 5 GB available3| project DeviceName, DiskSpaceAvailable, OSVersion, LastSyncDateTime4| order by DiskSpaceAvailable ascThis large-scale analysis capability becomes essential in retail or manufacturing environments where thousands of shared devices (Android, iOS, specialized devices) must be monitored without operational friction.
Enterprise Application Management (EAM)
Microsoft Intune Enterprise Application Management (EAM) simplifies the deployment and updating of Win32 applications at scale. Issues of manual packaging, installation source maintenance, and update management are addressed by:
- A catalog of pre-packaged, Microsoft-maintained managed applications
- Automation of updates without IT intervention
- The ability for users to self-install approved applications via the Company Portal
To view the catalog of applications available in EAM, refer to the official documentation.
Microsoft Tunnel for MAM
Microsoft Tunnel for Mobile Application Management (MAM) extends security to BYOD (Bring Your Own Device) scenarios on Android and iOS/iPadOS. It enables:
- Per-app VPN access to on-premises resources
- Protection of corporate data in applications without full device MDM enrollment
- Support for Zebra Android devices for firmware update management
Good to know
Microsoft Tunnel for MAM is included in Intune Plan 2 capabilities, now available in Microsoft 365 E3 and E5. It is particularly suited for environments where full MDM enrollment is not feasible (employee personal devices).
Optimizing with AI: Microsoft Security Copilot in Intune
AI at the core of endpoint management workflow
Microsoft Security Copilot in Intune integrates generative AI capabilities directly into the Intune Admin Center. Administrators can:
- Query Intune data in natural language
- Generate and refine KQL queries for Advanced Analytics
- Assess application risks before approving an EPM elevation request
- Obtain contextualized recommendations for vulnerability remediation
Vulnerability Remediation Agent
The Vulnerability Remediation Agent for Security Copilot in Intune concretely illustrates the value of AI applied to endpoint management. It works in three steps:
Identifying priority CVEs
The agent leverages Microsoft Defender Vulnerability Management data to identify high-risk CVEs (Common Vulnerabilities and Exposures) present on devices managed by Intune.
Prioritization and recommendations
The agent prioritizes vulnerabilities by risk score (CVSS, real-world exposure) and generates contextualized remediation recommendations, considering the fleet of affected devices.
Guidance toward action in Intune
The agent guides the administrator through remediation steps directly in the Intune Admin Center, without requiring switching between consoles. Actions can include deploying updates or modifying security configurations.
Important
Microsoft Security Copilot and associated AI agents may require an additional license separate from Microsoft 365 E3/E5 plans. Consult the Security Copilot licenses page before any deployment.
Summary: features by license plan
| Feature | Intune Plan 1 (included M365) | Microsoft 365 E3 | Microsoft 365 E5 |
|---|---|---|---|
| Basic MDM/MAM management | ✅ | ✅ | ✅ |
| Endpoint Privilege Management (EPM) | ❌ | Partial | ✅ |
| Microsoft Cloud PKI (advanced) | ❌ | Partial | ✅ |
| Remote Help | ❌ | ✅ | ✅ |
| Advanced Analytics + MDQ | ❌ | ✅ | ✅ |
| Enterprise App Management (EAM) | ❌ | ✅ | ✅ |
| Microsoft Tunnel for MAM | ❌ | ✅ | ✅ |
| Security Copilot in Intune | ❌ | ❌ | Separate license required |
Note: The exact availability of features varies depending on your subscription plan. Existing customers will receive notification 30 days before activation in their tenant, with guaranteed access before August 2026. Check Message Center notifications in your Microsoft Admin Center.
How to get started with advanced Intune features
Verify your eligibility
Log in to the Microsoft 365 Admin Center and verify your current license plan (Microsoft 365 E3 or E5). Navigate to Billing > Your products to confirm your subscription.
Consult Message Center notifications
In the Microsoft 365 Admin Center, go to Message Center (Health menu) to identify notifications related to the activation of new Intune features in your tenant. Corresponding MC references detail timelines and required actions.
Audit licenses with PowerShell
Use the Microsoft Graph PowerShell module to identify eligible users in your tenant:
1# Connect to tenant2Connect-MgGraph -Scopes "User.Read.All", "Directory.Read.All"3 4# List available license SKUs5Get-MgSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits, @{N='Available';E={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}} | Format-Table6 7# Identify users with M365 E3 or E5 license8Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses |9Where-Object { $_.AssignedLicenses.SkuId -ne $null } |10Select-Object DisplayName, UserPrincipalName |11Export-Csv -Path ".\licensed_users.csv" -NoTypeInformation -Encoding UTF8Define adoption plan
Contact your Microsoft Account team or CSP partner to define the activation roadmap. Prioritize features according to your immediate needs: EPM for privilege reduction, Remote Help for distributed support, or Advanced Analytics for fleet visibility.
Official Resources
To learn more, consult the following resources:
Conclusion: an endpoint foundation for the AI era
The integration of advanced Microsoft Intune Suite features into Microsoft 365 E3 and E5 plans represents a concrete opportunity for IT teams to strengthen their security posture without additional licensing costs. EPM, Cloud PKI, Remote Help, Advanced Analytics, and EAM form a coherent set that covers the main challenges of modern endpoint management: privilege reduction, certificate infrastructure modernization, distributed support, and large-scale visibility.
These capabilities also constitute the technical foundation necessary to adopt AI experiences, notably Microsoft Security Copilot in Intune, under controlled security and governance conditions. Organizations that invest in this foundation today position themselves to leverage AI-assisted IT operations with a level of control and confidence appropriate to enterprise environment requirements.
