SOLVED

Intune Admin License

%3CLINGO-SUB%20id%3D%22lingo-sub-218132%22%20slang%3D%22en-US%22%3EIntune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218132%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAm%20I%20correct%20in%20saying%20that%20Intune%20Administrators%2C%20at%20any%20RBAC%20level%2C%20who%20aren't%20enrolling%20any%20devices%20still%20require%20a%20license%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EInfo%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EStuart%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-218132%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMobile%20Device%20Management%20(MDM)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218572%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218572%22%20slang%3D%22en-US%22%3EI%20agree%20licensing%20should%20be%20relaxed%20for%20admin%20roles.%3CBR%20%2F%3E%3CBR%20%2F%3EOliver%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218570%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218570%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Oliver%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20the%20process%20of%20raising%20this%20with%20MS.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20purchase%20of%20licenses%20to%20enable%20users%20to%20enrol%20etc%20is%20one%20thing%20and%20quite%20acceptable%2C%20however%20the%20purchase%20of%20additional%20licenses%20to%20admin%20%2F%20support%20those%20devices%20is%20quite%20another!!!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EStuart%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218565%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218565%22%20slang%3D%22en-US%22%3EI%20agree%2C%20but%20from%20my%20understanding%20MS%20wants%20every%20user%20to%20have%20a%20license.%20Following%20the%20first%20blog%20it%E2%80%98s%20clear%20to%20assign%20every%20role%20an%20Intune%20license.%20It%E2%80%98s%20maybe%20not%20needed%20for%20technical%20reasons%20but%20for%20correct%20licensing.%20If%20this%20is%20a%20big%20concern%20it%20may%20be%20the%20best%20to%20open%20a%20support%20case%20regarding%20proper%20licensing%20in%20a%20scenario%20with%20lots%20of%20Intune%20Help%20Desk%20roles%20and%20how%20they%20are%20supposed%20to%20be%20licensed.%3CBR%20%2F%3E%3CBR%20%2F%3EBest%2C%3CBR%20%2F%3EOliver%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218556%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218556%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Oliver%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20so%20much%20for%20your%20feedback.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELet's%20assume%20that%20the%20Exchange%20Connector%20isn't%20required%20for%20now!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20dilemma%20that%20I%20have%20is%20that%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIntune%20Service%20Admin%20role%20%3D%20More%20permissions%20%2F%20License%20not%20required%3C%2FP%3E%3CP%3EIntune%20Help%20Desk%20Operator%20RBAC%20role%20%3D%20Less%20permissions%20%2F%20License%20required%20per%20operator%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%2C%20any%20given%20organisation%20might%20have%20a%20few%20Intune%20Service%20Admins%20but%20hundreds%20of%20L1%20Help%20Desk%20Operators%2C%20the%20problem%2C%20then%20is%20COST.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EStuart%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218549%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218549%22%20slang%3D%22en-US%22%3EHi%20Stuart%2C%3CBR%20%2F%3E%3CBR%20%2F%3EYes%20you%20can%20perform%20tasks%20but%20not%20everything.%20See%20here%3A%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20account%20you%20use%20to%20create%20your%20Microsoft%20Intune%20subscription%20is%20a%20global%20administrator.%20As%20a%20best%20practice%2C%20do%20not%20use%20a%20global%20administrator%20for%20day-to-day%20management%20tasks.%20While%20an%20administrator%20does%20not%20require%20an%20Intune%20license%20to%20access%20the%20Intune%20on%20Azure%20portal%2C%20in%20order%20to%20perform%20certain%20management%20tasks%2C%20such%20as%20setting%20up%20the%20Exchange%20service%20Connector%2C%20an%20Intune%20license%20is%20required.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fusers-add%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fusers-add%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EBest%2C%3CBR%20%2F%3EOliver%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218545%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218545%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20There%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EJust%20as%20I%20thought%2C%20however%2C%20the%20Intune%20Service%20Admin%20Role%20can%20be%20assigned%20within%20the%20O365%20portal%20with%20NO%20license%20attached.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EStuart%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218492%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218492%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Stuart%2C%3CBR%20%2F%3Eall%20administrators%20with%20an%20Intune%20Role%20require%20an%20Intune%20license.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20a%20reference%20see%20here%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fintunesupport%2F2017%2F08%2F07%2Fusing-the-new-role-based-access-controls-in-intune%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblogs.technet.microsoft.com%2Fintunesupport%2F2017%2F08%2F07%2Fusing-the-new-role-based-access-controls-in-intune%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Esee%20section%3A%3C%2FP%3E%3CP%3E%3CSTRONG%3EIntune%20Roles%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3ELicensing%3A%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%3EAdministrators%20with%20an%20Intune%20Role%20require%20an%20Intune%20license.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3Ebest%2COliver%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Frequent Contributor

Hi All

 

Am I correct in saying that Intune Administrators, at any RBAC level, who aren't enrolling any devices still require a license?

 

Info appreciated.

 

Stuart

7 Replies

Hi Stuart,
all administrators with an Intune Role require an Intune license.

 

As a reference see here:
https://blogs.technet.microsoft.com/intunesupport/2017/08/07/using-the-new-role-based-access-control...

 

see section:

Intune Roles

Licensing: Administrators with an Intune Role require an Intune license.

 

best,
Oliver

Hi There

 

Just as I thought, however, the Intune Service Admin Role can be assigned within the O365 portal with NO license attached.

 

Stuart

Hi Stuart,

Yes you can perform tasks but not everything. See here:

The account you use to create your Microsoft Intune subscription is a global administrator. As a best practice, do not use a global administrator for day-to-day management tasks. While an administrator does not require an Intune license to access the Intune on Azure portal, in order to perform certain management tasks, such as setting up the Exchange service Connector, an Intune license is required.

https://docs.microsoft.com/en-us/intune/users-add

Best,
Oliver

Hi Oliver

 

Thanks so much for your feedback.

 

Let's assume that the Exchange Connector isn't required for now!

 

The dilemma that I have is that:

 

Intune Service Admin role = More permissions / License not required

Intune Help Desk Operator RBAC role = Less permissions / License required per operator

 

Now, any given organisation might have a few Intune Service Admins but hundreds of L1 Help Desk Operators, the problem, then is COST.

 

Stuart

Solution
I agree, but from my understanding MS wants every user to have a license. Following the first blog it‘s clear to assign every role an Intune license. It‘s maybe not needed for technical reasons but for correct licensing. If this is a big concern it may be the best to open a support case regarding proper licensing in a scenario with lots of Intune Help Desk roles and how they are supposed to be licensed.

Best,
Oliver

Hi Oliver

 

In the process of raising this with MS.

 

The purchase of licenses to enable users to enrol etc is one thing and quite acceptable, however the purchase of additional licenses to admin / support those devices is quite another!!!

 

Stuart

I agree licensing should be relaxed for admin roles.

Oliver
Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
36 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
9 Replies