- Remote Help, Advanced Analytics, Intune Plan 2, Tunnel for MAM, specialty device management, and OTA firmware updates move into M365 E3 and E5 from 1 July 2026. No action required to receive them.
- These features previously required the Intune Suite add-on at approximately £10–12 per user per month. If your organisation pays for that add-on, review your renewal.
- Remote Help covers the main helpdesk use case for Intune-managed Windows and macOS devices. Review third-party remote support contracts before renewal.
- Tunnel for MAM enables BYOD access to corporate resources without full device enrolment. It is the answer to contractor and personal device scenarios.
- Microsoft Cloud PKI is not included in this change. It remains in the full Intune Suite add-on.
- Full rollout completes by 1 August 2026. Features appear automatically in the Intune admin centre.
If you manage Microsoft 365 in an enterprise environment, this is one of the most significant Intune licensing changes in years. Starting 1 July 2026, Microsoft moves advanced Intune Suite capabilities into M365 E3 and E5 with no add-on cost. Rollout continues across tenants through 1 August 2026.
This covers exactly what is included, how each feature works, and what your IT team should do right now.
What Changes from July 2026
Previously, getting Remote Help, Advanced Analytics, or Tunnel for MAM required purchasing the Intune Suite add-on at roughly £10–12 per user per month. From July 2026, these capabilities move into the base M365 E3 and E5 SKUs.
1 July 2026: Feature availability begins for eligible tenants.
1 August 2026: Full rollout completes across all qualifying tenants.
No action required. Features appear automatically in your Intune admin centre once your tenant is updated.
What Is Now Included
M365 E3 and EMS E3
| Feature | What It Does | Previously Required |
|---|---|---|
| Intune Remote Help | Built-in remote assistance for IT support | Intune Suite add-on |
| Advanced Analytics | Deeper device reporting and anomaly detection | Intune Suite add-on |
| Intune Plan 2 | Tunnel for MAM, specialty device management, OTA firmware | Intune Plan 2 add-on |
M365 E5 and EMS E5
E5 tenants receive everything in the E3 bundle above, plus all existing E5 entitlements. Organisations already on E5 will find these capabilities appear without any licensing change on their side.
Remote Help
Remote Help is Microsoft's native remote assistance solution built directly into Intune. Before this change, IT teams either paid for the Intune Suite to access it, or relied on third-party tools like TeamViewer, AnyDesk, or the built-in Quick Assist.
How a Remote Help Session Works
Remote Help Capabilities
| Capability | Details |
|---|---|
| Full remote control | Technician takes control of the remote device |
| View-only mode | Technician observes without controlling |
| UAC elevation | Elevated tasks during session without local admin password |
| Unattended sessions | Support unattended devices: servers, kiosks |
| In-session chat | Built-in chat alongside screen share |
| Audit logging | All sessions captured in Intune audit logs |
| Role-based access | Helpdesk roles can be scoped: who can help whom |
| Platform support | Windows and macOS |
If your organisation pays for TeamViewer Business or AnyDesk for helpdesk support on Intune-managed devices, Remote Help covers the same use case natively. Review your remote support contracts before next renewal.
Advanced Analytics
Advanced Analytics extends Intune's default reporting with device intelligence, anomaly detection, and proactive insights. Where standard Intune reports tell you what is happening, Advanced Analytics helps you understand why, and predict what will happen next.
What Advanced Analytics Adds
| Capability | What It Gives You |
|---|---|
| Anomaly detection | Flags unusual patterns: a device with 5x more app crashes or 3x more policy failures than its peer group |
| Battery health insights | Predicts which devices are approaching battery failure before users raise tickets |
| Resource performance scoring | CPU, RAM, and disk metrics with trend analysis per device and per model |
| Startup performance | Time-to-productivity scores from power-on to usable state |
| Work from anywhere reports | Connectivity quality and reliability metrics for remote workers |
| Custom reports | Build and export tailored device health dashboards |
Standard Intune includes basic Endpoint Analytics. Advanced Analytics layers AI-driven anomaly detection, predictive battery insights, and richer drill-down reporting on top of the base telemetry. They share the same data pipeline; Advanced Analytics is an enhanced view of what Intune already collects.
A Practical Example
Your helpdesk receives 20 tickets in a week from Finance users reporting slow login times. Without Advanced Analytics, you work through each ticket individually. With it: anomaly detection flags a spike in startup time scores across 18 devices running a specific Intune configuration profile revision; the drill-down identifies that a new font package deployment adds 40 seconds to logon; you roll back the deployment from the Intune console and startup scores normalise within 24 hours.
Intune Plan 2: What It Unlocks
Intune Plan 2 sits above the standard Plan 1 included in M365 E3. From July 2026 it is included in E3. The three main capabilities it adds are Tunnel for MAM, specialty device management, and OTA firmware updates.
Tunnel for MAM
Microsoft Tunnel creates a secure VPN connection from a managed app on a mobile device to your corporate network, without requiring the device to be enrolled in full MDM.
| Scenario | What You Need |
|---|---|
| Corporate device enrolled in Intune MDM, needs access to company resources | Tunnel for MDM (available in Plan 1) |
| Personal device (BYOD), only the work app needs corporate access | Tunnel for MAM (Plan 2, now included in E3) |
Tunnel for MAM answers the question: "How do we let contractors and personal devices access internal SharePoint without enrolling their private phone into MDM?" The device is never fully managed. Only the specific work apps are protected and tunnelled.
Specialty Device Management
Plan 2 supports device categories beyond standard Windows, iOS, Android, and macOS:
| Device Type | Examples | Use Case |
|---|---|---|
| AR/VR headsets | Microsoft HoloLens 2, Meta Quest for Business | Field service, manufacturing, healthcare |
| Industrial handhelds | Zebra TC-series, Honeywell devices | Warehouse, logistics, retail |
| Digital signage | Windows-based kiosks and displays | Reception, retail, wayfinding |
| Ruggedised laptops | Panasonic Toughbook, Dell Latitude Rugged | Field operations, public safety |
These devices can now be enrolled, configured, and monitored in the same Intune portal as your standard fleet. Single pane of glass management across all device categories.
OTA Firmware Updates: Zebra and Others
For organisations running Zebra devices, the most widely deployed rugged Android handhelds in logistics and retail, Intune Plan 2 integrates with Zebra's Firmware Over the Air (FOTA) service.
This replaces manual firmware update processes that previously required field technicians to update devices one by one, or complex SCCM and WSUS workarounds.
Cost Impact
| Scenario | Previous Monthly Cost | From July 2026 |
|---|---|---|
| M365 E3 + Remote Help + Advanced Analytics + Plan 2 | E3 base + ~£10–12/user add-on | E3 base only |
| M365 E5 with Intune Suite | E5 base + add-on | E5 base only |
Organisations that have already purchased the Intune Suite add-on separately should review their licensing agreements. In many cases, the add-on cost can be removed at renewal. Confirm with your Microsoft licensing partner.
What IT Teams Should Do Now
Intune Suite capabilities appear automatically in your tenant once Microsoft completes rollout. You do not need to assign new licences or make any admin centre changes. New options appear in: Tenant administration › Remote Help, Reports › Endpoint Analytics › Advanced Analytics, and Tenant administration › Microsoft Tunnel.
Updated Licence Map: July 2026
| Feature | M365 Business Premium | M365 E3 (Post July 2026) | M365 E5 (Post July 2026) |
|---|---|---|---|
| MDM / MAM | ✅ | ✅ | ✅ |
| Compliance policies | ✅ | ✅ | ✅ |
| App deployment | ✅ | ✅ | ✅ |
| LAPS (cloud) | ✅ | ✅ | ✅ |
| Conditional Access | ✅ (P1) | ✅ (P1) | ✅ (P2) |
| SSPR | ✅ (P1) | ✅ (P1) | ✅ (P2) |
| PIM / PAM | ❌ | ❌ | ✅ (P2) |
| Identity Protection | ❌ | ❌ | ✅ (P2) |
| Remote Help | ❌ | New✅ | New✅ |
| Advanced Analytics | ❌ | New✅ | New✅ |
| Tunnel for MAM | ❌ | New✅ | New✅ |
| Specialty device management | ❌ | New✅ | New✅ |
| OTA firmware (Zebra) | ❌ | New✅ | New✅ |
| Cloud PKI | ❌ | Suite only | Suite only |
Microsoft Cloud PKI, the fully managed cloud certificate authority for issuing device and user certificates, is not part of this July 2026 inclusion. It remains in the full Intune Suite add-on. If your organisation uses or plans to use Cloud PKI, you still need the Intune Suite separately.
Summary
The July 2026 Intune licensing update is a genuine saving for E3 and E5 customers. Three previously paid capabilities move into the base plans at no extra cost:
- Remote Help covers the helpdesk remote assistance use case for Intune-managed Windows and macOS devices, natively, without third-party tools.
- Advanced Analytics adds AI-driven anomaly detection and predictive device health reporting. Worth enabling immediately for any fleet over 100 devices.
- Tunnel for MAM enables BYOD scenarios where only work apps tunnel to corporate resources. No full device enrolment required.
- Specialty device management brings AR/VR headsets, rugged handhelds, and industrial devices under the same Intune umbrella as your standard fleet.
- OTA firmware management for Zebra and compatible devices removes the need for manual firmware update operations.
The most immediate action: if your organisation pays for the Intune Plan 2 or Intune Suite add-on, speak to your Microsoft licensing partner before your next renewal. You may no longer need that add-on for the features covered by this change.