Microsoft has made a significant change to the endpoint management landscape. As of 1 July 2026, several advanced Microsoft Intune capabilities are now included with Microsoft 365 E3 and E5, giving many organisations access to tools that were previously treated as premium add-ons.
This is not just a licensing update. It is an opportunity for IT and security leaders to simplify their endpoint management stack, reduce operational friction, strengthen Zero Trust controls and extract more value from their existing Microsoft investment. Microsoft’s announcement confirms that advanced Intune capabilities are now available across Microsoft 365 E3 and E5. Microsoft announcement
The key question for organisations is straightforward:
What should we do first now that these capabilities are available in our tenant?
My view is clear: the organisations that act over the next 30 to 90 days will be best placed to improve endpoint visibility, reduce support effort, remove unnecessary tooling overlap and accelerate their journey towards modern endpoint management.
What Has Changed?
For Microsoft 365 E3 customers, Microsoft now includes:
- Remote Help
- Advanced Analytics
- Microsoft Tunnel for Mobile Application Management
- Additional Intune Plan 2 capabilities
For Microsoft 365 E5 customers, organisations receive everything above plus:
- Endpoint Privilege Management (EPM)
- Microsoft Cloud PKI
- Enterprise Application Management
- Security Copilot integration within Intune
These capabilities were previously associated with Microsoft Intune Suite or additional Intune licensing. The change means many customers should now review their current endpoint tooling, adoption roadmap and renewal cycles against what is already available through Microsoft 365. Microsoft announcement
1. Review Remote Support Tooling Before Your Next Renewal
This is the first conversation I’m having with almost every IT leadership team.
Most organisations today are paying for one or more remote support platforms that exist entirely outside the Microsoft ecosystem.
Historically, those investments made sense because Intune lacked a native enterprise-grade remote assistance platform.
That conversation changes now.
Remote Help provides:
- Secure remote assistance
- Integration with Microsoft Entra ID
- Role-based access controls
- Auditing and session logging
- Intune administration integration
- Support for modern hybrid work environments
For organisations already standardised on Microsoft 365, Remote Help creates a practical opportunity to assess whether existing third-party remote support contracts still provide enough differentiated value. Microsoft announcement
My recommendation:
Before your next renewal cycle, perform a structured Remote Help proof of concept and compare capability against your current operational requirements.
You may discover you’re paying for functionality you already own.
2. Enable Advanced Analytics Early
If you’re an E3 customer, this is the quickest win available.
In fact, I’ve been encouraging clients to start proof-of-concept deployments immediately.
Many organisations already use Endpoint Analytics.
Advanced Analytics takes that visibility much further.
Microsoft Intune Advanced Analytics provides deeper operational insight into:
- Device health
- Endpoint performance
- Reliability trends
- User experience issues
- Configuration drift
- Productivity-impacting events
- Endpoint operational intelligence
Advanced Analytics builds on Endpoint Analytics by providing deeper insight into device health, performance, anomalies, battery health, resource utilisation and troubleshooting data. Microsoft describes it as a way to help IT teams proactively manage user experience and optimise productivity through data-driven intelligence. Microsoft Learn: Advanced Analytics
The biggest mistake I see organisations make?
They focus only on compliance.
Advanced Analytics allows IT Operations teams to answer questions such as:
- Which applications are creating the most user disruption?
- Which devices are driving service desk tickets?
- Where are performance bottlenecks occurring?
- Which hardware platforms are delivering poor user experience?
- What trends are emerging before users start complaining?
This shifts endpoint management from a support function into an operational intelligence capability.
My recommendation:
Enable Advanced Analytics immediately and make it part of your weekly IT Operations review process.
The insights become exponentially more valuable as telemetry accumulates.
3. Start Endpoint Privilege Management in Audit Mode
If there’s one recommendation, I would prioritise above all others for E5 customers, it’s this.
Enable Endpoint Privilege Management.
Today.
But start in Audit Mode.
Endpoint Privilege Management allows users to run as standard users while still completing approved tasks that require elevation. It supports a least-privilege operating model by reducing the need for standing local administrator rights. Microsoft Learn: Endpoint Privilege Management overview
The reason I recommend Audit Mode first is simple.
You cannot secure what you cannot see.
Microsoft’s deployment guidance recommends beginning with auditing and reporting before creating elevation rules and moving towards enforcement. Microsoft Learn: Deploy Endpoint Privilege Management
Running EPM in Audit Mode enables you to identify:
- Unmanaged elevations
- Applications requiring admin privileges
- User behaviours creating risk
- Opportunities to remove local administrator rights
- Hidden attack surface previously invisible to IT
Over the last year, I’ve enabled EPM for numerous Advania clients.
The “aha” moments from IT Operations teams have been priceless.
In almost every environment, we discover elevated activity nobody knew existed.
Legacy applications. Installer packages. Scripts. Support tools.
All silently increasing risk.
After a short audit period, IT teams can build an evidence-based view of how privileged access is being used, which applications require elevation and where local administrator rights can be reduced safely. Microsoft Learn: Deploy Endpoint Privilege Management
A Practical Starting Point for EPM
A simplified deployment approach is:
- Confirm EPM licensing is active.
- Navigate to Intune Admin Centre.
- Go to:
- Endpoint Security
- Endpoint Privilege Management
- Create an Elevation Settings Policy.
- Enable:
- Endpoint Privilege Management
- Elevation Reporting
- Assign the policy to a pilot device group.
- Allow audit data collection.
- Review findings in the EPM Overview Dashboard.
- Build elevation rules based on observed behaviour.
- Transition towards least-privilege operations.
Microsoft documentation:
4. Use Microsoft Cloud PKI to Challenge Legacy Certificate Dependencies
This is perhaps the most strategically important capability now included for E5 customers.
I regularly meet organisations that have successfully modernised everything except one critical dependency:
Public Key Infrastructure (PKI).
Their devices could move to cloud-native management tomorrow.
Their users are ready.
Their applications are ready.
But certificate services remain dependent on on-premises Active Directory Certificate Services.
Microsoft Cloud PKI changes that discussion.
Microsoft Cloud PKI is a cloud-based service that simplifies and automates certificate lifecycle management for Intune-managed devices. It can issue, renew and revoke certificates without requiring on-premises servers, connectors or hardware. Microsoft Learn: Microsoft Cloud PKI overview
For organisations pursuing:
- Entra Join
- Cloud-native endpoints
- Passwordless authentication
- Wi-Fi certificates
- VPN certificates
- Zero Trust
This is hugely significant.
My recommendation is straightforward:
Start a small proof of concept as soon as Cloud PKI appears in your tenant.
Pick a small pilot group.
Deploy cloud-issued certificates.
Validate authentication scenarios.
Measure operational effort versus your existing PKI model.
You may discover one of the last blockers preventing full cloud-native endpoint management has effectively disappeared.
A Practical Starting Point for Cloud PKI
At a high level:
- Navigate to Tenant Administration > Cloud PKI
- Create a Root Certification Authority
- Create an Issuing Certification Authority
- Deploy Trusted Certificate Profiles
- Create SCEP Certificate Profiles
- Assign to pilot devices
- Validate certificate deployment
Microsoft Documentation:
Final Thought: Do Not Let Value Sit Unused
The biggest risk with these licensing changes isn’t implementation.
It’s inaction.
Many organisations will celebrate the fact they now have access to these features but won’t operationalise them.
The organisations that gain the greatest value will be the ones that:
- Reassess existing tooling
- Consolidate where appropriate
- Enable Advanced Analytics early
- Deploy EPM in Audit Mode
- Begin testing Cloud PKI
- Build a roadmap towards reduced complexity and greater Zero Trust maturity
Microsoft has effectively handed many organisations a significant endpoint management upgrade.
The question now is not whether you should adopt these capabilities.
The question is:
How quickly can you turn them into measurable business value?
How Advania Can Help
At Advania, we are proactively engaging with our clients to help them assess, pilot, and operationalise these newly available Advanced Intune capabilities.
Whether you are evaluating Remote Help, enabling Advanced Analytics, reducing local administrator risk with Endpoint Privilege Management, or assessing Microsoft Cloud PKI as part of a cloud-native endpoint strategy, our Modern Endpoint specialists can help you move from licence entitlement to measurable business value.
Don’t wait for your next licence renewal or transformation programme. Start now. The sooner you begin, the sooner you’ll realise the operational, security, and financial benefits already sitting within your Microsoft investment.