Intune Suite Features Coming to E3 and E5: What You Need to Know
Intune Suite Features Coming to E3 and E5: What You Need to Know
Microsoft has been steadily expanding what is included in Microsoft 365 E3 and E5 subscriptions, and the latest changes to the Intune Suite represent some of the most significant endpoint management additions in years. If your organization is already licensed on E3 or E5, you may now have access to capabilities you previously would have needed to pay for separately. Understanding what is included, what is changing, and how to take advantage of it is worth your attention.
The Intune Suite was introduced as a premium add-on bundle sitting above the standard Microsoft Intune Plan 1 capabilities included with most M365 subscriptions. It brought together several advanced endpoint management features under a single SKU. Microsoft has since begun folding select Intune Suite features into the core E3 and E5 tiers, making enterprise-grade endpoint management more accessible to a broader range of organizations. Here is what that means in practice.
What Is the Intune Suite?
The Intune Suite is a collection of advanced endpoint management capabilities built on top of Microsoft Intune. Where Intune Plan 1 covers the fundamentals of device enrollment, policy management, app deployment, and compliance, the Intune Suite extends those capabilities into more specialized and high-value scenarios.
Key capabilities within the Intune Suite include Remote Help, a cloud-based attended remote assistance tool that allows IT staff to connect to and support devices without relying on third-party tools like TeamViewer. It supports full control and view-only sessions across Windows, macOS, Android, and iOS, with audit logging built in. Microsoft Tunnel for Mobile Application Management extends secure VPN-like access to specific apps on personal devices without requiring full device enrollment, an important capability for BYOD scenarios. Endpoint Privilege Management (EPM) allows organizations to run specific applications with elevated privileges on a per-task basis, without granting users permanent local admin rights. This reduces attack surface significantly while maintaining the flexibility users need for legitimate tasks. Advanced Endpoint Analytics provides deeper insight into device performance, application reliability, and user experience scoring, helping IT teams be proactive rather than reactive.
What Is Now Included in E3 and E5?
Microsoft has confirmed that select Intune Suite features are being included in Microsoft 365 E3 and E5 at no additional cost. Remote Help and Endpoint Privilege Management have been among the features brought into these tiers, making what was previously a paid add-on available to organizations already on qualifying subscriptions.
For E5 subscribers, the inclusion of advanced analytics and deeper security integrations through Microsoft Defender aligns with E5’s positioning as the comprehensive security and compliance tier. Organizations on E5 should audit what they are currently paying for separately, including third-party remote assistance tools and privilege management solutions, to identify potential cost consolidation. For E3 organizations, the additions are an opportunity to increase the maturity of their endpoint management posture without additional licensing spend. If your organization has been running lean on Intune capabilities because of budget constraints, these inclusions change the calculus.
Why This Matters for Your Security Posture
The Intune Suite features that are moving into E3 and E5 are not incremental conveniences. They address real security gaps that affect a large number of organizations.
Local administrator rights are one of the most common privilege escalation vectors in ransomware and lateral movement attacks. Many organizations grant local admin broadly because it is operationally easier, even though it significantly increases risk. Endpoint Privilege Management solves this by allowing IT to define specific applications or tasks that can run elevated, without permanently elevating the user. Employees get what they need to do their jobs, and the attack surface shrinks. Similarly, Remote Help closes the gap that many organizations fill with consumer-grade remote desktop tools that lack audit trails and proper access controls. Moving support workflows onto a governed, Intune-integrated tool brings remote assistance in line with the rest of your security and compliance framework.
How to Activate and Deploy These Features
Having a license entitlement and having the feature deployed are two different things. Like most Microsoft 365 capabilities, Intune Suite features need to be configured and deployed deliberately to deliver value.
Remote Help requires enabling the feature in the Intune admin center and assigning it to the users or devices that need it. Endpoint Privilege Management requires defining elevation policies, identifying which applications are in scope, and communicating changes to end users before rolling out broadly. Advanced Analytics requires the Intune data connector to be set up and sufficient device enrollment to produce meaningful reporting. In each case, a phased approach works best, starting with a pilot group to validate policies before broader deployment. Organizations that have not recently reviewed their Intune configuration may also find that updating their device compliance policies and conditional access rules alongside these new features produces the most coherent result.
What to Do Next
If your organization is on Microsoft 365 E3 or E5 and you have not recently reviewed your Intune entitlements, now is the right time. The gap between what is licensed and what is deployed is often significant, and the Intune Suite inclusions mean there is likely capability available to you today that you are not yet using.
Steeves works with organizations across Canada to assess their current Intune posture, identify entitlement gaps, and build deployment plans that improve security and reduce operational overhead. Whether you are starting from a minimal Intune deployment or looking to mature a more established configuration, we can help you get the most from your Microsoft 365 investment. Get in touch with the Steeves team to talk through your current endpoint management setup and find out what your E3 or E5 subscription can now do for you.