About this article
This article is based on official Microsoft information as of September 17, 2026, and outlines the role of Intune Plan 1 and its positioning within E3/E5.Verification Status: 📘 Confirmed with official Microsoft information. Not yet tested on physical devices.
Microsoft Intune Plan 1 is the core service of Intune for managing PCs, smartphones, and applications from the cloud. In Microsoft 365 E3/E5, Intune serves as the foundation, combining device enrollment, configuration, compliance, and application management.
Understanding Plan 1, Plan 2, and the Suite Separately
Microsoft officially describes Plan 1 as the base service, Plan 2 as an add-on to Plan 1, and the Intune Suite as an additional framework combining advanced management and security features. Since some advanced features were reallocated to Microsoft 365 E3/E5 starting in July 2026, it is important not to rely solely on older E3/E5 comparison charts.
First Step: Reviewing Licenses and Management Status
In the Intune admin center, open Tenant administration > Tenant status to check the MDM authority, licensed users, and Intune licenses. No modifications are necessary.
What to Look For
Whether the MDM authority is set as expected
Whether there is a significant discrepancy between the number of licenses and target users
Whether your administrative permissions are as expected
Criteria for Success
Being able to explain the tenant's Intune usage status.
Making a Single Change
Modify only the display targets or filters to narrow down a specific group of devices. It is safer not to rewrite configuration profiles from the start.
Checking Device Status Using PowerShell
On Windows devices, you can first read the enrollment status.
dsregcmd /status
AzureAdJoinedBy checking statuses such as these, you can verify whether the device is in the expected Microsoft Entra joined state. This does not modify any settings.
For Production Use
Instead of treating device enrollment as the goal itself, design your approach backward from business rules, such as "allowing access to business data only from compliant devices," "deploying standard settings," and "protecting business data in case of loss."
Points for Administrators to Verify
User/device licensing
Features requiring Entra ID P1/P2
Enrollment restrictions
Division of roles between compliance and Conditional Access
RBAC and scope tags
Distinction between BYOD and company-owned devices
Official Microsoft Information
https://learn.microsoft.com/en-us/intune/fundamentals/licensing
https://learn.microsoft.com/en-us/intune/fundamentals/planning-guide
Intune Plan 1 is not merely a product for restricting devices; it is a foundation that connects devices, apps, and access control into a consistent operational workflow.
