The practical answer
Effective July 2026, Microsoft added selected advanced Intune capabilities to eligible Microsoft 365 enterprise suites. E3 gained a useful operations layer; E5 gained that layer plus three security-heavy capabilities. The standalone Intune Suite and add-ons still exist.
The current packaging at a glance
Microsoft’s current planning guidance describes the distribution this way. Microsoft 365 E3 includes the existing Intune Plan 1 foundation plus: Intune Remote Help; Intune Advanced Analytics; Intune Plan 2 capabilities.
What the names mean operationally
Remote support tied to Entra identity, Intune RBAC, and session reporting. Both helper and sharer need entitlement.
“Intune Suite included” is imprecise
The standalone Intune Suite is a purchasable bundle with prerequisites. The July 2026 Microsoft 365 changes distribute several Suite capabilities across E3 and E5, but the phrases “E3 has the Intune Suite” and “E5 makes every Intune add-on redundant” hide three important facts.
The current packaging at a glance
Microsoft’s current planning guidance describes the distribution this way. Microsoft 365 E3 includes the existing Intune Plan 1 foundation plus:
- Intune Remote Help; Intune Advanced Analytics;
- Intune Plan 2 capabilities.
- Microsoft 365 E5 and E7 include the E3 additions plus: Intune Endpoint Privilege Management;
- Microsoft Cloud PKI; Intune Enterprise Application Management.
Practical checks
Microsoft’s public FAQ said rollout would complete by 1 August 2026. A tenant that does not yet display an expected service plan should be checked against Message Center, exact SKU, cloud, provisioning status, and the current Microsoft matrix before a support case is opened.
What the names mean operationally
Remote support tied to Entra
- identity, Intune RBAC, and
- session reporting. Both helper
- and sharer need entitlement.
- and sharer need entitlement.
Remote Help
Remote support tied to Entra identity, Intune RBAC, and session reporting. Both helper and sharer need entitlement. Enabling the tenant does not license every user. Advanced Analytics Deeper endpoint insights intended to help teams investigate performance, anomalies, and user experience. The available reports and prerequisites should be checked at the feature level; the label is not a promise that every analytics preview is included. Intune Plan 2 The advanced management tier includes capabilities for specialised devices and other scenarios beyond Plan 1. Treat it as a feature bundle, then verify the exact workload required. Endpoint Privilege Management EPM lets organisations remove standing local-admin rights while providing controlled elevation for approved tasks. This is an E5/E7 addition in the new packaging, not an E3 entitlement. Cloud PKI Cloud-based certificate authority and certificate lifecycle integration for Intune-managed devices. It is valuable only when certificate templates, trust, renewal, revocation, and dependent network services are designed—not simply because a menu appeared. Enterprise Application Management An Enterprise App Catalog and update workflow for supported Windows applications. EAM does not eliminate packaging, testing, assignment, or change-control responsibilities.
“Intune Suite included” is imprecise
The standalone Intune Suite is a purchasable bundle with prerequisites. The
- July 2026 Microsoft 365 changes distribute several Suite capabilities across E3
- and E5, but the phrases “E3 has the Intune Suite” and “E5 makes every Intune add-on redundant” hide three important facts.
- First, E3 and E5 receive different capability sets. Second, only
- eligible users assigned the qualifying suite benefit. Third, standalone
Practical checks
offers remain relevant for Business Premium, frontline, EMS-only, or mixed populations where the advanced capability is not included.
How to target features in a mixed E3/E5 estate
Do not rely on a device group that happens to contain laptops normally used by E5 users. EPM and other user-benefit licensing follows the licensed population, while policy targeting has its own technical rules. Build a repeatable entitlement process:
- 1. export subscriptions, service plans, assignment method, and usage location; 2. define who should receive each advanced capability;
- 3. create groups from approved licence/persona logic;
- 4. target policy using Microsoft-supported user or device assignment semantics; 5. account for shared devices and secondary users;
- 6. monitor licence reassignment and group latency; 7. test what happens when an E5 user is downgraded to E3.
Practical checks
A dynamic group based on licence data can be useful, but service-plan identifiers, processing delays, and indirect group membership need testing. Keep the commercial entitlement inventory as the control of record rather than hiding it inside one dynamic rule.
Renewal decisions after the change
Remote Help may now change the build-versus-renew
- calculation. Compare cross-platform coverage, unattended needs,
- external support, recording, integrations, and licence
- scope—not only the incremental Microsoft price.
- scope—not only the incremental Microsoft price.
E3 customer with a third-party remote-support tool
Remote Help may now change the build-versus-renew calculation. Compare cross-platform coverage, unattended needs, external support, recording, integrations, and licence scope—not only the incremental Microsoft price. E5 customer buying separate EPM and Cloud PKI add-ons Identify duplicate subscriptions and their renewal dates. Do not cancel them until the included service plans are provisioned, policies work for the entitled users, and contractual cancellation windows are understood. Business Premium plus a small advanced group The July additions to E3/E5 do not automatically change Business Premium. Standalone Intune Suite or individual add-ons can still be more targeted than moving the whole population to E5. Mixed E3, E5, F3, and contractors Create a feature-by-persona ledger. A tenant-wide portal view can make a small entitled group’s feature look universally available. Helpers and users outside the E3/E5 population may still require add-ons.
A 30-day audit
Confirm every commercial SKU and renewal date. Compare assigned service plans with the current Microsoft packaging page.
- Inventory standalone Intune add-ons and trials.
- Map every advanced policy to benefiting users and devices.
- Pilot included capabilities before cancelling other tools. Remove duplicate licences only inside the applicable cancellation window.
- Update internal service catalogues and support documentation.
Practical checks
This is the moment to replace old “E3 versus E5” spreadsheets. Axeti can help rebuild the matrix around personas and current service plans, then model which standalone add-ons remain justified.
Sources and scope: Microsoft Licensing Resources, Microsoft 365 packaging and pricing updates: SKU-level feature additions. Microsoft Licensing Resources, Packaging and pricing updates FAQ: rollout, existing-customer treatment, and standalone availability. Microsoft Learn, Planning guide to move to Microsoft Intune: E3 and E5 capability distribution. Microsoft Intune Blog, Advanced Intune capabilities now available in Microsoft 365 E3 and E5: July 2026 availability context. Government, education, frontline, EMS, and regional offers can differ. Validate the exact tenant SKU and service plans rather than applying the commercial E3/E5 shorthand globally.
