Intune Licensing for Kiosks and Shared Devices

The rule that resolves most cases

Microsoft Product Terms state that each licensed Intune user may manage applications and up to 15 devices.

• When a device is accessed by more than one user, each user requires a User Subscription Licence.
• The separate Intune Plan 1 for Devices offer may be linked only to devices without user affinity. It does not
• support user-affinity features, including Conditional Access, app protection, optional application
• installation, or user applications such as Outlook and OneDrive.

Practical checks

So ask: is this device serving a place or process, or is it delivering personalised Microsoft services to people?

Good device-only candidates

A Windows Autopilot self-deploying kiosk that launches one line-of-business application. An Android Enterprise dedicated scanner shared across a warehouse shift.

• A lobby check-in screen.
• Digital signage.
• A room or specialised device where the relevant Microsoft workload has its own supported device licence.
• Microsoft lists no-user-affinity enrollment methods such as Windows Autopilot self-deploying mode, Apple automated enrollment without user affinity, Android Enterprise dedicated mode, and certain device enrollment manager scenarios.

Practical checks

Hardware alone is not enough. A shared tablet can still be user-affiliated if employees sign into personal Outlook and OneDrive sessions.

When user licences are required

If Alice and Ben each sign into

• Outlook or OneDrive on the same tablet,
• the device is delivering user-mapped applications. Device-only
• Intune rights do not cover that workflow.
• Intune rights do not cover that workflow.

Personal productivity follows the user

If Alice and Ben each sign into Outlook or OneDrive on the same tablet, the device is delivering user-mapped applications. Device-only Intune rights do not cover that workflow. Licence the users for Intune and the Microsoft 365 services they use. Conditional Access is part of the design Device-only Intune licensing excludes Conditional Access. Conditional Access also has Microsoft Entra licensing requirements. A compliant-device policy that controls each employee’s access is a user benefit, even if the physical device sits on a shop floor. App protection or optional apps are assigned by identity Intune app protection policies target users. Microsoft requires the user receiving an app protection policy to have an Intune licence. Optional app installation is another user-affinity feature excluded from the device-only service. Many users share one Windows PC Do not solve this with one generic licensed account. Microsoft Product Terms explicitly require an Intune User SL for each user when multiple users access a managed device. Shared sign-in also damages attribution and MFA.

Four common designs

The device auto-enrols without user affinity,

• runs only a managed scanning app,
• and never presents personal Microsoft 365
• data. Device-only Intune can fit.
• data. Device-only Intune can fit.

Dedicated Android scanner

The device auto-enrols without user affinity, runs only a managed scanning app, and never presents personal Microsoft 365 data. Device-only Intune can fit. Android shared-device mode Employees sign in for a personalised session and access user data. Licence each participating user for the required core Intune entitlement and every Microsoft service they use. Microsoft’s specialty-device guidance may require matching quantities of relevant licences for these users. Windows kiosk in a reception area Autopilot self-deploying mode, a local kiosk experience, and a single LOB app can fit device-only licensing. If reception staff also open personal Outlook, Teams, or OneDrive, redesign or user-license the experience. Shared meeting or phone hardware Start with the workload-specific Teams Rooms or Teams Shared Space licensing rules. A generic Intune device licence should not be substituted for a required Teams device licence merely because Intune can see the hardware.

Why generic accounts are a trap

A generic account can make a user-affinity device look anonymous in a technical report. It does not erase the

• real people using the service. It also creates password
• sharing, weak attribution, poor offboarding, and Conditional Access exceptions.
• Model the actual user journey. Who authenticates? Whose
• data appears? Which policies evaluate an identity? Who

Practical checks

receives an optional app? Those answers are better licensing evidence than the enrollment account name.

A licensing design worksheet

For every shared-device pattern, record: platform and enrollment mode;

• whether the device has user affinity; every person or role that signs in;
• personal apps and data presented; Conditional Access and app protection use;
• optional versus required app deployment; Teams, Windows, Defender, and other workload licences;
• expected concurrency and device count; the Product Terms program used by the customer.

Practical checks

Only after that inventory should procurement compare device and user quantities. Axeti can help validate the entitlement map where frontline suites, device licences, and Teams device offers overlap.

Sources and scope: Microsoft Product Terms, Microsoft Intune for MCA: 15-device user right, multiple-user rule, and device-only limitations. Microsoft Learn, Microsoft Intune licensing: supported device-only scenarios and enrollment methods. Microsoft Learn, Assign Microsoft Intune licences: user and app-protection licensing. Microsoft Learn, Manage specialty devices with Intune: Teams and shared-device considerations. Product Terms differ by agreement and may be updated. Validate the customer’s program, device workflow, user population, and dependent workloads before purchasing.