SOLVED

Intune Admin License

%3CLINGO-SUB%20id%3D%22lingo-sub-218132%22%20slang%3D%22en-US%22%3EIntune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218132%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAm%20I%20correct%20in%20saying%20that%20Intune%20Administrators%2C%20at%20any%20RBAC%20level%2C%20who%20aren't%20enrolling%20any%20devices%20still%20require%20a%20license%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EInfo%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EStuart%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-218132%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntune%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMobile%20Device%20Management%20(MDM)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218572%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218572%22%20slang%3D%22en-US%22%3EI%20agree%20licensing%20should%20be%20relaxed%20for%20admin%20roles.%3CBR%20%2F%3E%3CBR%20%2F%3EOliver%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218570%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218570%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Oliver%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20the%20process%20of%20raising%20this%20with%20MS.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20purchase%20of%20licenses%20to%20enable%20users%20to%20enrol%20etc%20is%20one%20thing%20and%20quite%20acceptable%2C%20however%20the%20purchase%20of%20additional%20licenses%20to%20admin%20%2F%20support%20those%20devices%20is%20quite%20another!!!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EStuart%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218565%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218565%22%20slang%3D%22en-US%22%3EI%20agree%2C%20but%20from%20my%20understanding%20MS%20wants%20every%20user%20to%20have%20a%20license.%20Following%20the%20first%20blog%20it%E2%80%98s%20clear%20to%20assign%20every%20role%20an%20Intune%20license.%20It%E2%80%98s%20maybe%20not%20needed%20for%20technical%20reasons%20but%20for%20correct%20licensing.%20If%20this%20is%20a%20big%20concern%20it%20may%20be%20the%20best%20to%20open%20a%20support%20case%20regarding%20proper%20licensing%20in%20a%20scenario%20with%20lots%20of%20Intune%20Help%20Desk%20roles%20and%20how%20they%20are%20supposed%20to%20be%20licensed.%3CBR%20%2F%3E%3CBR%20%2F%3EBest%2C%3CBR%20%2F%3EOliver%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218556%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218556%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Oliver%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20so%20much%20for%20your%20feedback.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELet's%20assume%20that%20the%20Exchange%20Connector%20isn't%20required%20for%20now!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20dilemma%20that%20I%20have%20is%20that%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIntune%20Service%20Admin%20role%20%3D%20More%20permissions%20%2F%20License%20not%20required%3C%2FP%3E%3CP%3EIntune%20Help%20Desk%20Operator%20RBAC%20role%20%3D%20Less%20permissions%20%2F%20License%20required%20per%20operator%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%2C%20any%20given%20organisation%20might%20have%20a%20few%20Intune%20Service%20Admins%20but%20hundreds%20of%20L1%20Help%20Desk%20Operators%2C%20the%20problem%2C%20then%20is%20COST.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EStuart%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218549%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218549%22%20slang%3D%22en-US%22%3EHi%20Stuart%2C%3CBR%20%2F%3E%3CBR%20%2F%3EYes%20you%20can%20perform%20tasks%20but%20not%20everything.%20See%20here%3A%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20account%20you%20use%20to%20create%20your%20Microsoft%20Intune%20subscription%20is%20a%20global%20administrator.%20As%20a%20best%20practice%2C%20do%20not%20use%20a%20global%20administrator%20for%20day-to-day%20management%20tasks.%20While%20an%20administrator%20does%20not%20require%20an%20Intune%20license%20to%20access%20the%20Intune%20on%20Azure%20portal%2C%20in%20order%20to%20perform%20certain%20management%20tasks%2C%20such%20as%20setting%20up%20the%20Exchange%20service%20Connector%2C%20an%20Intune%20license%20is%20required.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fusers-add%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fusers-add%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EBest%2C%3CBR%20%2F%3EOliver%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218545%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218545%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20There%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EJust%20as%20I%20thought%2C%20however%2C%20the%20Intune%20Service%20Admin%20Role%20can%20be%20assigned%20within%20the%20O365%20portal%20with%20NO%20license%20attached.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EStuart%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218492%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Admin%20License%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218492%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Stuart%2C%3CBR%20%2F%3Eall%20administrators%20with%20an%20Intune%20Role%20require%20an%20Intune%20license.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20a%20reference%20see%20here%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fintunesupport%2F2017%2F08%2F07%2Fusing-the-new-role-based-access-controls-in-intune%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblogs.technet.microsoft.com%2Fintunesupport%2F2017%2F08%2F07%2Fusing-the-new-role-based-access-controls-in-intune%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Esee%20section%3A%3C%2FP%3E%3CP%3E%3CSTRONG%3EIntune%20Roles%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3ELicensing%3A%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%3EAdministrators%20with%20an%20Intune%20Role%20require%20an%20Intune%20license.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3Ebest%2COliver%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Regular Contributor

Hi All

 

Am I correct in saying that Intune Administrators, at any RBAC level, who aren't enrolling any devices still require a license?

 

Info appreciated.

 

Stuart

7 Replies
Highlighted

Hi Stuart,
all administrators with an Intune Role require an Intune license.

 

As a reference see here:
https://blogs.technet.microsoft.com/intunesupport/2017/08/07/using-the-new-role-based-access-control...

 

see section:

Intune Roles

Licensing: Administrators with an Intune Role require an Intune license.

 

best,
Oliver

Highlighted

Hi There

 

Just as I thought, however, the Intune Service Admin Role can be assigned within the O365 portal with NO license attached.

 

Stuart

Highlighted
Hi Stuart,

Yes you can perform tasks but not everything. See here:

The account you use to create your Microsoft Intune subscription is a global administrator. As a best practice, do not use a global administrator for day-to-day management tasks. While an administrator does not require an Intune license to access the Intune on Azure portal, in order to perform certain management tasks, such as setting up the Exchange service Connector, an Intune license is required.

https://docs.microsoft.com/en-us/intune/users-add

Best,
Oliver
Highlighted

Hi Oliver

 

Thanks so much for your feedback.

 

Let's assume that the Exchange Connector isn't required for now!

 

The dilemma that I have is that:

 

Intune Service Admin role = More permissions / License not required

Intune Help Desk Operator RBAC role = Less permissions / License required per operator

 

Now, any given organisation might have a few Intune Service Admins but hundreds of L1 Help Desk Operators, the problem, then is COST.

 

Stuart

Highlighted
Solution
I agree, but from my understanding MS wants every user to have a license. Following the first blog it‘s clear to assign every role an Intune license. It‘s maybe not needed for technical reasons but for correct licensing. If this is a big concern it may be the best to open a support case regarding proper licensing in a scenario with lots of Intune Help Desk roles and how they are supposed to be licensed.

Best,
Oliver
Highlighted

Hi Oliver

 

In the process of raising this with MS.

 

The purchase of licenses to enable users to enrol etc is one thing and quite acceptable, however the purchase of additional licenses to admin / support those devices is quite another!!!

 

Stuart

Highlighted
I agree licensing should be relaxed for admin roles.

Oliver