Microsoft 365 license updates for 2026 have been a recent topic of discussion. The main focus has been on price increases, although Microsoft also announced significant changes to the technical features of M365 E3 and E5 licenses at the beginning of December. Intune Suite features, long sold as a separate license, will be integrated into the core licenses during 2026. Above IT ‘consigliere’ Matias Haapaniemi explains in this blog what this means in practice. So, keep reading!
What's being added?
Overall, Intune Suite offers many valuable features that will benefit at least larger organizations.
M365 E3 licenses and its component Enterprise Mobility Security (EMS) E3 will now receive:
- Remote Help – remote support for Intune-managed devices
- Advanced Analytics – anomaly detection and device health visibility
- Intune Plan 2 – includes Tunnel for MAM (Mobile Application Management) features, management of specialized devices like Teams Room devices, and firmware updates for Zebra devices
M365 E5 licenses will also receive, in addition to the above:
- Endpoint Privilege Management: implementation of the principle of least privilege for endpoints
- Cloud PKI: certificate management in the cloud without maintaining on-premises PKI infrastructure
- Enterprise Application Management: pre-packaged application library
What's still missing?
At this point, it’s worth reading between the lines. Here are a few of my observations:
Remote Help is not a complete remote support tool. It does not support unattended remote connections, meaning the user must be present to approve the connection. If you require unattended remote access (e.g., for servers or Windows IoT device management), you will still need a third-party tool. RMM tools (Remote Monitoring & Management) such as NinjaOne or Action1 remain essential.
Intune Plan 2 features are quite limited in scope. Tunnel for MAM is useful in BYOD scenarios, but for most organizations, endpoints are fully managed. Zebra Firmware Over The Air (FOTA) is perhaps a somewhat niche feature for organizations that require Zebra professional devices. Management of specialized devices (AR/VR, Teams Rooms) is a welcome addition, but not yet a “game changer”.
Business Premium is excluded. M365 Business Premium, common in the SME sector, will not receive these features. The same applies to Education licenses (A3/A5). Last week, we blogged about the Cisco Access Manager service as part of Meraki network access management, and unfortunately, Business Premium customers and educational institutions cannot currently utilize Cloud PKI solutions, for example, without separate licensing as part of it!
The timeline is unclear. Microsoft states “2026,” which could mean January or December. Administrators are promised a 30-day advance notification in the M365 admin center. Therefore, it is not advisable to count on the features being available right at the beginning of the year. But perhaps as early as July 1, 2026, when license prices increase?
Positive Aspects
To be honest: Cloud PKI services within E5 licensing are a significant development. Maintaining on-premises PKI infrastructure is laborious, error-prone, and also expensive. If E5 licenses are already in use, certificate-based user authentication for wireless networks and remote connections will be significantly simplified.
EPM (Endpoint Privilege Management) is also a welcome addition. Removing local administrator rights and controlled elevations are cornerstones of the Zero Trust principle. Until now, this has required a separate additional license or third-party services.
Advanced Analytics assists in proactive problem identification, provided one knows how to work with the data. KQL queries and dashboards require expertise that may not have been encountered previously in endpoint management.
Hasn't anyone mentioned AI yet?
As already announced at Ignite, Microsoft is integrating Security Copilot licensing directly into Microsoft E5 licensing. In practice, Microsoft 365 E5 customers will have 400 Security Compute Units (SCU) per month for every 1,000 paid user licenses, meaning up to 10,000 SCUs per month at no additional cost.
This significantly changes how AI can be leveraged for security incident handling, as previously, utilizing Security Copilot was perceived as expensive. So much so that it was more sensible to implement automations using, for example, Azure’s Open AI tools instead.
Summary
The changes are mostly positive for E3 and E5 customers, but they do not eliminate the need for third-party tools in all scenarios. Remote Help does not replace full-fledged RMM tools, and Business Premium customers will be left disappointed. This is with the exception of price changes, from which Business Premium licenses were the only ones to escape without increases.
How will you know when new features can be deployed? It is advisable to monitor notifications in the Microsoft 365 Admin Center and prepare for deployment when the features become active. Specifically, the implementation of Cloud PKI and EPM requires planning, as they are not plug-and-play features. And regarding AI extensions, all eligible Microsoft 365 E5 customers will gain access in the coming months and will receive 30 days’ advance notice before activation. Ultimately, as your ‘consigliere’ and support, we will keep your IT management on track!
Above IT is a resource for IT management, helping your organization’s IT professionals stay at the forefront of Microsoft technology development! Follow us!