Microsoft will complete a critical shift in enterprise licensing by August 1, 2026, automatically rolling key Intune Suite capabilities into Microsoft 365 E3 and E5 plans. For many organizations, this means remote help, advanced analytics, and, depending on your tier, endpoint privilege management and cloud PKI may no longer require separate add-on subscriptions. But the change comes on the heels of price increases and does not mean every overlapped license can be safely canceled. Here’s how to turn this packaging update into real savings without breaking your device management.

What’s Actually Landing in Your Tenant

Starting in the third quarter of 2026, Microsoft will activate new Intune service plans inside eligible Microsoft 365 tenants. The rollout should be complete by August 1, and you’ll receive a heads-up through the Message Center in the Microsoft 365 admin center.

The capabilities are not distributed evenly. Your current subscription tier determines exactly which tools appear:

  • Microsoft 365 E3 gains Intune Plan 2 (which includes features like Microsoft Tunnel for mobile app access), Remote Help for attended and unattended support, and Advanced Analytics (formerly known as Endpoint Analytics).
  • Microsoft 365 E5 and the newer E7 tier receive everything in E3, plus Endpoint Privilege Management (letting standard users perform approved elevated tasks), Microsoft Cloud PKI (a cloud-based certificate authority), and Enterprise Application Management (a catalog of pre-packaged third-party apps for deployment).
  • Office 365 E3 does not get any of these Intune additions, even though it sounds similar. That plan only receives Defender for Office 365 Plan 1 as part of the broader licensing refresh.

Microsoft has confirmed that standalone Intune Suite and individual add-on licenses will remain available for purchase. Organizations with mixed licensing, or those that need capabilities beyond what’s packaged, can keep buying the components à la carte.

What This Means for Your Next Renewal

The immediate temptation is to axe every existing Intune add-on, remote-support tool, and PKI service that now appears inside your E3 or E5 subscription. That would be a mistake.

First, the entitlement is not an automatic migration. Having Remote Help show up in your Intune console is not the same as your service desk knowing how to use it, your endpoints being configured to allow it, or your audit trail being intact. You may still depend on a third-party remote-control product that offers features Remote Help lacks, such as support for non-Windows devices or specific compliance logging.

Second, the financial equation has shifted. Effective July 1, 2026, Microsoft raised list prices:
- Microsoft 365 E3 increased 8%
- Microsoft 365 E5 increased 5%
- Enterprise Mobility + Security (EMS) E3 jumped 13%
- EMS E5 rose 10%

Those bumps may eat into any savings you hoped to realize from canceling add-ons. You need to calculate using the renewal quote in front of you, not last year’s invoice.

Third, the new capabilities are not universally production-ready in every organization. Endpoint Privilege Management, for instance, requires you to identify which applications need elevation, define elevation rules, and review elevation events. Cloud PKI touches authentication, Wi‑Fi, VPN, and device trust — it’s an infrastructure project, not a checkbox. Enterprise Application Management may not include your line-of-business apps, forcing you to keep a third-party catalog.

The smart move is to treat the August 1 deadline as a trigger for an entitlement audit, not a cancellation spree.

How We Got Here

For years, the Intune Suite — Remote Help, Endpoint Privilege Management, Cloud PKI, Advanced Analytics, and others — was a separate purchase on top of Microsoft 365 E3/E5 or EMS. Large organizations often bought multiple add-ons and third-party tools that overlapped. Microsoft’s packaging update aims to simplify licensing and make its own management stack more attractive, but it also consolidates more control into the Microsoft 365 control plane.

The company began signaling these changes earlier in 2026, with the July pricing announcement and packaging FAQ. The idea is that “advanced endpoint management” is becoming a core part of enterprise productivity suites, much like security and compliance features were bundled in previous years.

Your Pre‑Renewal Checklist: 9 Steps to Convert Entitlement into Operational Gain

The work should begin now, while your purchasing team is still planning the next renewal. Here’s a practical sequence, distilled from Microsoft’s own planning guidance and real‑world licensing practice:

  1. Export your full subscription inventory. List every paid Microsoft 365, EMS, Intune Suite add-on, remote-support license, PKI service, application-management product, and email-security subscription you currently hold. Don’t trust spreadsheet abbreviations — use the exact product names from the admin center.
  2. Separate tenants by exact tier. Sort users and licenses into distinct buckets: Microsoft 365 E3, Microsoft 365 E5, EMS E3, EMS E5, Office 365 E3. Never lump them as “E3” or “E5.”
  3. Watch the Message Center. Look for the notice that tells you when your tenant will receive the new service plans, and save it as part of your renewal records.
  4. Inspect what’s actually assigned. In the Microsoft 365 admin center and Azure AD (now Microsoft Entra), check which service plans are visible to users. Entitlement does not equal deployment. Confirm that Remote Help, Advanced Analytics, and the others appear in the Intune portal.
  5. Map each capability to your current stack. For every new Intune tool you intend to adopt, document the tool it might replace. Record the incumbent’s device coverage, platform support, technician workflows, policy dependencies, logging, and help-desk integration.
  6. Create a gap list. For each potential replacement, mark it as: “retain as-is,” “ready for pilot,” “blocked (missing feature X),” or “redundant.” Be honest. A feature that appears in the portal but can’t handle your Mac fleet or generate the audit logs your compliance team requires is not a replacement.
  7. Run a controlled pilot. Choose a small set of users, devices, and support staff. Test the new service(s) with real workloads, including exception handling and rollback. Do not cancel anything until the pilot demonstrates parity.
  8. Retire licenses only after acceptance. Only reduce your add-on seat count when the replacement passes acceptance testing and you’ve confirmed that all affected users are covered by the correct entitlement.
  9. Re‑check license assignment models. Some capabilities require per-user licensing even if the admin console shows the feature. Ensure your user count matches and that you aren’t assuming one entitled admin covers the entire device estate.

Watch Out for These Hidden Traps

  • Office 365 E3 is not Microsoft 365 E3. An organization that normalizes licensing records by “E3” may inadvertently try to cut remote-support costs for Office 365 E3 users, who won’t receive Remote Help. You’ll create a support gap and a compliance headache.
  • Price increases change the math. The July 1 hike means your baseline cost is higher. A third-party tool that cost $5 per user/month last year may now be cheaper than the effective price increase on your E5 seats, especially if you aren’t using all the new Intune features.
  • Security Copilot isn’t part of this. While Microsoft 365 E5 includes Security Copilot, its consumption is measured in Security Compute Units and activation is phased separately. Don’t include it in your immediate Intune consolidation calculations.
  • Enterprise Application Management may not be enough. If your application catalog includes custom-packaged or niche LOB apps, the built-in catalog might not cover them. You may still need a third-party deployment tool.
  • Not everything arrives at once. Microsoft says the rollout should be complete by August 1, but specific tenants may see services light up on slightly different dates. Don’t plan a weekend cutover based on a single Message Center date.

Outlook

The August 1 milestone doesn’t force you to throw out every overlapping license overnight. Smart IT teams will begin the audit now, run pilots through early summer, and arrive at renewal negotiations with a clear, data-backed list of which add-ons can be safely retired and which must stay. For some, Remote Help may become the default support tool; for others, an existing privilege-management product will remain because the built-in EPM lacks a critical approval workflow. The real win is not in canceling everything but in knowing exactly what you’re paying for and why.

By this time next year, the enterprise licensing landscape will look different: more capabilities bundled, but also more responsibility on IT to manage an increasingly powerful, consolidated control plane. Your job right now is simply to be ready when those capabilities appear in your tenant — and to make sure your finance team doesn’t interpret an icon in the admin center as an immediate cost saving.