How should MSPs charge for Microsoft Intune management?

MSPs should charge for Intune in three parts: paid discovery, a fixed-fee deployment project, then monthly management. The license may already exist in Microsoft 365, but policy design, enrollment cleanup, app packaging, reporting, and support ownership still need a priced scope.

Is Intune included in Microsoft 365 Business Premium?

Microsoft says Microsoft 365 Business Premium includes Intune Plan 1 for device and app management. MSPs should still verify the tenant, because license rights do not include deployment labor, cleanup, policy design, documentation, or monthly support.

What should an MSP include in an Intune deployment project?

An Intune deployment scope should include license review, device inventory, identity model, enrollment method, compliance and configuration policies, app packaging, pilot groups, user communication, support ownership, reporting, and exclusions for remediation or onsite work.

Can Intune replace SCCM for SMB clients?

For many SMB clients, Intune is the cleaner default path for endpoint management. SCCM, now Microsoft Configuration Manager, still matters in larger legacy environments, co-management scenarios, and phased workload moves. Do not quote that migration as a weekend cleanup.

Does Intune replace an RMM for MSPs?

No. Intune handles Microsoft endpoint and app management, compliance policy, and enrollment workflows. An RMM still covers monitoring, scripting, remote access, patch operations, automation, and technician workflows that Intune does not replace.

What is included in monthly Intune management?

Monthly Intune management usually includes compliance review, policy monitoring, minor policy changes, stale device review, reporting, and exception handling. App repackaging, major migrations, onsite remediation, procurement, and user training should be separate line items unless the agreement says otherwise.

Microsoft Intune for MSPs: Pricing, Scope, and the SCCM Exit

If you are an MSP selling into Microsoft-heavy SMBs, Intune is easy to underprice. The client may already own the license. That is exactly how a Microsoft Intune MSP project turns into free labor.

The license is not the service. Intune work includes tenant review, device cleanup, enrollment choices, app packaging, compliance policy, Conditional Access coordination, reporting, support ownership, and a lot of exception handling.

Quick answer: Microsoft Intune is now the default endpoint management path for many Microsoft-heavy MSP clients, especially those on Business Premium, E3, or E5. MSPs should charge for Intune as scoped work: discovery, deployment, policy design, enrollment cleanup, app packaging, then ongoing management. The license may be included. The work is not.

That distinction matters. If Intune lives inside a generic Microsoft 365 support line, nobody knows who owns failed enrollments, stale devices, local admin cleanup, printer installs, app packaging, reporting, or policy changes. The client thinks endpoint management is handled. The MSP inherits the mess.

What Intune actually does for an MSP client

Microsoft describes Intune as a cloud-based endpoint management service for devices and apps. In practical MSP terms, it gives you a control plane for company-owned and bring-your-own devices across Windows, macOS, iOS, iPadOS, Android, Linux, tvOS, and visionOS where supported by Microsoft. It also supports mobile application management, compliance policies, device configuration, app deployment, reporting, and Microsoft Entra Conditional Access signals.

That sounds broad because it is. For an MSP client, Intune can help answer questions like:

Which devices are enrolled and compliant?
Which users can access company data from personal phones?
Which Windows devices should get which configuration policies?
Which apps need to be pushed, protected, or removed?
Which devices should be blocked or flagged before access is granted?

Microsoft's own Intune overview is a useful starting point for capabilities, platforms, MDM, MAM, and compliance. Read it before turning Intune into a menu item on your quote.

Just do not sell it as magic.

Intune is not your PSA. It is not your RMM. It is not procurement. It does not clean up bad licensing, stale devices, undocumented exceptions, bad naming, unmanaged local admin habits, or old GPO logic by itself.

If the client has six years of endpoint debt, Intune will surface that debt. It will not politely make it disappear.

Licensing reality: what the client may already own

This is where MSP pricing gets slippery.

Microsoft's Intune licensing docs say Intune is licensed through three plans and included in several Microsoft 365 bundles. Microsoft also documents Microsoft 365 Business Premium device and app management as including Intune Plan 1. For enterprise, frontline, government, education, EMS, and add-on scenarios, the current Microsoft Intune pricing and licensing pages should be the source of truth.

That means many SMB clients already have the right to use core Intune capabilities before the MSP quotes a project.

Good. That reduces license friction.

Bad. It tempts the MSP to treat the service as included too.

Plan 1, Plan 2, the Intune Suite, device-only subscriptions, and Microsoft bundle changes should be checked against Microsoft's current licensing and pricing pages during discovery. Do not copy last quarter's license notes into this quarter's proposal. Microsoft packaging changes often enough that tenant-level verification belongs inside the first paid assessment.

The client takeaway should be simple: you may already own the license. You still need someone to design, deploy, document, support, and maintain the operating model.

Scope Intune before quoting Intune

A clean Intune quote starts with discovery, not a flat setup fee pulled from memory.

Use the assessment to capture the work that will become either project scope, recurring management, or explicit exclusions.

1. Tenant and licensing state

Check Business Premium, E3, E5, EMS, F-plan, shared device, and add-on licensing. Look for stale users, duplicate licenses, disabled accounts with assigned seats, admin role sprawl, and clients still using Basic Mobility and Security.

If you skip this, read our guide on auditing Microsoft 365 licenses before quoting Intune work. License cleanup is not a footnote. It changes the quote.

2. Device inventory

Count Windows, macOS, mobile, shared workstations, remote-only users, personal devices, and devices not joined to Microsoft Entra ID. Decide whether the quote is per user, per device, or a hybrid. If the pricing model is still fuzzy, start with per-user vs per-device MSP pricing.

3. Identity and enrollment model

Document Entra joined, hybrid joined, local AD dependency, MFA readiness, Conditional Access policy, and whether Autopilot is realistic. Tie compliance policies to access decisions only when the client is ready for the support load. For that side of the project, see our Conditional Access baseline guide for MSPs.

4. Policy design

Name the policies you are building. Compliance rules, configuration profiles, security baselines, update rings, BitLocker or FileVault expectations, local admin rules, browser settings, and exception handling should not hide under "standard setup."

5. App packaging and deployment

List Microsoft 365 Apps, line-of-business apps, printers, VPN, browser settings, security tools, scripts, and weird client-specific installers. App packaging is where tidy Intune quotes go to get humbled.

6. Legacy management

Find GPO, Configuration Manager, third-party MDM, RMM policies, login scripts, and old imaging assumptions. Microsoft's Intune migration guide covers migration paths from third-party MDM, Configuration Manager, on-premises Group Policy, and Basic Mobility and Security. That is your clue that migration is a project, not a checkbox.

7. Support model and documentation

Define who owns failed enrollment, broken app installs, stale devices, exception requests, monthly reporting, pilot groups, user instructions, change windows, and executive exceptions. Then put that language into the quote. Our MSP scope-of-work template is built for exactly this kind of boundary setting.

If this feels like too much for a pre-sales conversation, that is the point. Scope the MSP project before you quote it. Otherwise delivery becomes the place where every assumption gets discovered.

What MSPs should charge for Intune

These are Scopable recommended floors and illustrative examples, not market averages. Your pricing should reflect tenant condition, device count, app complexity, travel, client urgency, support expectations, and your labor cost.

Workstream	Pricing model	Example floor
Intune readiness assessment	Fixed fee	$500 to $2,500, depending on tenant size and device mess. Deliver license findings, device issues, risk notes, and a deployment scope.
Small deployment project	Fixed fee	$3,000 to $8,000 for a clean 25 to 75 seat client with mostly Windows devices and limited app packaging.
Mid-market deployment project	Fixed fee after assessment	$8,000 to $20,000 for 75 to 200 seats, mixed device types, legacy GPO, app packaging, pilot groups, and user communication.
Legacy SCCM or GPO migration	Discovery-led project	Quote separately. Co-management, workload movement, rollback planning, and pilot testing need their own scope.
Monthly Intune management	Per device or per user	$8 to $15 per managed device per month, or a clearly named per-user security management line item. Include reporting, minor policy changes, monitoring, and exception handling.
Out-of-scope work	Hourly or project	App repackaging, device remediation, onsite cleanup, procurement, training, and non-standard requests should not be quietly included.

The exact number is less important than the structure.

Paid discovery first. Deployment project second. Monthly management third.

That model keeps license cost separate from labor cost. It also protects margin before delivery starts, which is the point of MSP pricing, quoting, and margin protection.

Do not bury Intune inside "managed Microsoft 365" unless the agreement names the boundaries. If policy changes, reporting, app packaging, and stale device cleanup are included, price them. If they are excluded, say so.

The SCCM and Configuration Manager reality

SCCM did not vanish.

Microsoft Configuration Manager still exists, and Microsoft documents co-management for organizations that use both Configuration Manager and Intune. Co-management lets admins choose which workloads move to Intune while Configuration Manager remains in place for other work.

That matters for larger clients, legacy environments, and organizations with real ConfigMgr investments.

For SMB MSP clients, though, keeping the old model alive often means more server dependency, more GPO sprawl, more imaging work, and more technician-only knowledge. Intune is usually the cleaner default path for new endpoint management, especially when the client already lives in Microsoft 365.

Do not turn that into a false obituary. Do not tell clients SCCM is dead, unsupported, or gone unless Microsoft says that. Say the true thing: for many SMB clients, Configuration Manager is legacy debt, a bridge, or enterprise complexity. Migration should be scoped as workload movement with pilot groups and rollback plans, not a weekend cleanup.

Windows 10 Home and Pro reached end of support on October 14, 2025, according to Microsoft Lifecycle. That gives MSPs another reason to revisit endpoint standards, but it still does not make Intune deployment free.

Three Intune pricing mistakes MSPs make

1. They treat included licensing like included labor

A Business Premium tenant can have Intune Plan 1 and still have zero usable endpoint management. The billable work is the operating model: policies, enrollment, apps, reporting, exceptions, documentation, and support ownership.

2. They skip device cleanup and blame Intune

Enrollment gets ugly when the device inventory is wrong, users have unmanaged devices, old GPOs still apply, or nobody knows which laptops exist. Price cleanup before rollout. If the client will not pay for cleanup, limit the project scope.

3. They bundle monthly policy changes into a flat M365 line

Monthly management needs a boundary. Minor policy changes, health reporting, compliance review, stale device cleanup, and exception handling can be included. New app packages, major migrations, onsite remediation, and user training should usually be separate.

This is also where Intune differs from RMM. Intune handles endpoint and app management inside Microsoft's management model. Your RMM still handles monitoring, scripting, remote access, patch operations, automation, and technician workflows that Intune does not replace. If a client hears "Intune replaces our endpoint stack," slow the conversation down.

Where Scopable fits

Scopable helps MSPs turn endpoint findings, license gaps, security risks, roadmap items, and budget assumptions into client-ready scope. Intune may be the tool, but the quote still needs to say who owns enrollment, policy changes, app packaging, exceptions, reporting, and support.

Use assessments to find unmanaged devices, license gaps, stale endpoints, and missing security baselines. Turn endpoint cleanup into roadmap work instead of free ticket noise. Attach assumptions and exclusions before the MSP inherits the mess. Use QBRs to explain why Intune is a managed service, not an admin checkbox.

If the work touches compliance, security policy, or client risk, price it like real managed service work. The same logic applies to compliance-adjacent MSP services and Microsoft 365 pricing changes: the tenant detail matters because the quote depends on it.

Close the margin leak before rollout

Intune is probably the right answer for a lot of Microsoft-heavy SMB clients. The pricing mistake is treating it like an admin toggle.

If the MSP does not scope devices, apps, policies, migration path, user impact, and monthly ownership, the client gets endpoint management and the MSP gets the margin leak.

Before you sell Intune, sell the assessment. Then quote the deployment. Then price monthly management with named boundaries.

Want a cleaner way to turn endpoint findings into scoped roadmap work and quotes? Join Scopable early access.