Microsoft Intune licensing Australia 2026 — Plan 1 vs Plan 2 vs Suite

Microsoft Intune is the Microsoft endpoint management platform — MDM (managing whole devices), MAM (managing apps on personal devices), endpoint configuration, app delivery, security baselines. In 2026 Intune ships in three commercial tiers — Plan 1, Plan 2 and the Intune Suite — and each one adds materially different capabilities.

AUD pricing in 2026

• Microsoft Intune Plan 1 — $11 AUD/user/month standalone. Included in Microsoft 365 E3, E5, Business Premium, EMS E3 and E5.
• Microsoft Intune Plan 2 — Plan 1 + $4.50 AUD/user/month add-on. Available as add-on to Plan 1 or to bundled licences.
• Microsoft Intune Suite — $15 AUD/user/month standalone add-on (on top of Plan 1). Bundles Plan 2 + several previously-separate SKUs.

What Plan 1 covers (already in most M365 bundles)

Plan 1 is the workhorse — covers Windows, iOS, Android, macOS device management, App Protection Policies (MAM), conditional access integration, Windows Autopilot, application deployment, security baselines, Intune endpoint security profiles for Defender. For 90% of AU mid-market organisations Plan 1 is sufficient as the device management platform.

What Plan 2 adds

Plan 2 specifically adds three capabilities that some organisations need:

1. 1Specialty device management — Microsoft Teams Rooms, AR/VR headsets, IoT-class devices that Plan 1 doesn't cover.
2. 2Advanced endpoint analytics — Plan 1 gives you baseline endpoint analytics; Plan 2 expands to the full analytics suite including anomaly detection.
3. 3Enterprise App Management — managed app catalogue with automated update workflow for Win32 apps. Plan 1 has the basic Win32 app deployment; Plan 2 adds the catalogue and update automation.

What the Intune Suite adds on top

The Intune Suite is a bundle launched in 2023 that includes Plan 2 plus six additional capabilities, each previously a separate purchase:

1. 1Microsoft Tunnel for Mobile Application Management — VPN access for managed apps on personal iOS/Android devices, without enrolling the whole device.
2. 2Remote Help — secure cloud-based remote assistance tool (a Microsoft alternative to Bomgar, ConnectWise Control, TeamViewer for the IT helpdesk use case).
3. 3Endpoint Privilege Management (EPM) — least-privilege enforcement on Windows endpoints. Standard users can elevate specific applications or tasks based on policy, without admin rights. The Microsoft answer to BeyondTrust Privilege Management for Windows or CyberArk EPM.
4. 4Advanced Endpoint Analytics — more depth than Plan 2, with predictive analysis and proactive remediation scripting.
5. 5Microsoft Cloud PKI — cloud-managed Public Key Infrastructure for issuing and managing certificates for Wi-Fi, VPN, S/MIME, app authentication. Replaces on-premises ADCS in many AU mid-market deployments.
6. 6Enterprise App Management with enhanced catalogue — Plan 2's app management plus catalogue depth.

When the Intune Suite pays back

The Suite is $15 AUD per user per month on top of Plan 1. For a 200-user AU mid-market tenant that's $36,000 AUD per year. The Suite pays back when at least two of the six capabilities replace existing third-party tooling:

• Remote Help — replacing Bomgar, ConnectWise Control, or similar at $30–100 AUD/user/month for licensed technicians. If you have 10 technicians, that's $3,600–12,000 AUD per year saved.
• Endpoint Privilege Management — replacing BeyondTrust Privilege Management or CyberArk EPM at $10–30 AUD per managed user per month. Often the single biggest value driver.
• Microsoft Cloud PKI — replacing on-premises ADCS infrastructure, which has real maintenance cost (servers, certs of certs, HSM, audit, monitoring). Mid-market organisations typically retire 2 Windows servers and reclaim 1 FTE-month per year of certificate management work.
• Microsoft Tunnel for MAM — for BYOD-heavy organisations, replaces per-user VPN client cost.

When the Suite doesn't pay back

Three patterns: you have no Windows endpoints needing EPM (you're a Mac-shop or fully VDI on Azure Virtual Desktop), you have minimal helpdesk usage of remote assist, and you have a stable ADCS infrastructure that doesn't need replacing. In those cases the standalone Plan 1 (already in E3) is enough.

Special-case licensing — frontline workers and education

Frontline worker SKUs (F1, F3) include limited Intune capabilities — sufficient for shared-device shift workers, not for primary devices. Education SKUs (A3, A5) include Intune for Education with capabilities tuned to classroom device management.