One trial per capability per tenant. Spend it on the wrong one and you do not get another.
Intune advanced capabilities cover privilege management, remote help, a managed certificate authority, curated app deployment and more. Trials run 90 days for up to 250 users, one per capability per tenant, with a 30 day grace period afterwards. Choosing which to trial first is the decision that matters.
- Eight capabilitiesAcross security, support and deployment
- 90 daysTrial duration
- 250 usersTrial maximum per tenant
- One trial eachPer capability, per tenant
Four constraints worth knowing before you start clicking.
Microsoft publishes these plainly, and they change how you should approach evaluating these capabilities.
- Ninety days duration, and a maximum of 250 users per tenant. For a larger organisation that means the trial has to be scoped to a representative population rather than rolled out broadly, and choosing that population is part of the design.
- One trial per capability per tenant. This is the constraint that matters most. A trial started casually, evaluated badly and allowed to lapse cannot be repeated, so an unplanned trial can cost you the ability to evaluate properly later.
- A thirty day grace period after the trial ends, and once that expires Microsoft states the capability is no longer available in the admin center. Anything you built during the trial needs a decision before that window closes rather than after somebody notices it has stopped working.
- Starting a trial requires a Global or Billing administrator. Microsoft notes that without those roles the add-ons tab is not visible at all, although the capabilities tab still shows what your tenant is eligible for. Worth knowing before somebody spends an afternoon looking for a page they cannot see.
What each one does, described the way Microsoft describes it.
Endpoint Privilege Management
Microsoft describes it as running users with least privilege while still allowing approved tasks that require elevation. This is the capability that lets you remove local administrator rights without breaking the handful of legitimate tasks that need them, which is the objection that has kept administrator rights in place in most organisations here for years. Of the eight, it usually delivers the largest single risk reduction, and it is the one where the audit evidence is most immediately useful, because every elevation is logged with the file, the user and the reason they gave.
Remote Help
Securely connecting to user devices for cloud-based help desk support with role-based access controls. The role-based element is the part that distinguishes it from the remote tools most organisations already use, because it means the person connecting has a defined, auditable scope rather than unrestricted access to whatever they can reach.
Cloud PKI
A managed certificate authority for issuance, renewal and revocation across Intune platforms. For organisations still running an on-premises certificate authority purely to issue device and Wi-Fi certificates, this removes a server, a set of connectors and a recurring source of outage when something expires. It is one of the more consequential additions of recent years, particularly for organisations whose certificate authority is now maintained by nobody in particular and understood by one person who has since changed roles.
Enterprise App Management
Deploying curated Win32 applications from a Microsoft-hosted Enterprise App Catalog with built-in install settings. Packaging Win32 applications is one of the more tedious parts of running Intune, and a catalogue of pre-prepared applications with the install logic already written removes a genuine ongoing cost rather than adding a feature nobody uses.
Advanced Endpoint Analytics
Analytics-driven insights to understand and improve the user experience across your endpoints. This is the capability that answers why devices are slow, which is a question every IT function is asked and almost none can answer with data. It also tends to be the one that produces evidence for a hardware refresh business case.
Microsoft Tunnel for mobile application management
Extending the Microsoft Tunnel VPN to Android and iOS devices that are not enrolled in Intune. That is specifically the unenrolled case, which matters in a market where a large proportion of mobile access happens from personal devices that nobody is going to enrol, and where the alternative is either full enrolment or no access to internal resources at all.
Specialty device management
Managing AR and VR headsets, large smart-screen devices, and conference room meeting devices. Narrower than the others and genuinely relevant for organisations with meeting room estates, training environments or digital signage, which in this market covers a lot of hospitality, education and corporate real estate.
Android firmware over the air
Remotely delivering firmware updates to Android devices over the air, without user action. The without-user-action part is what makes it valuable for a fleet of shared or rugged devices in a warehouse, a hotel or a site office, where waiting for a user to accept an update means the update never happens.
Four things that decide whether these capabilities are worth the money.
We establish what you already hold before recommending anything
Microsoft advises reviewing your licensing to understand what is already included and to avoid overlapping functionality, and notes that availability may vary across an organisation. In practice we regularly find part of the Suite already available on a subscription bought for other reasons, and a third-party tool being paid for alongside it that does the same job less well.
We plan the trial before anybody starts one
One trial per capability per tenant, ninety days, 250 users. That is not a lot of room for a casual evaluation. We define the population, the success criteria and the owner before the trial starts, so the ninety days produce a decision rather than an inconclusive impression and a lapsed entitlement.
We usually start with privilege management
Removing local administrator rights is the single largest endpoint risk reduction available to most organisations, and the reason it has not happened is always the same handful of tasks that legitimately need elevation. Endpoint Privilege Management is designed for exactly that, and it is the capability most likely to produce an unambiguous result inside a ninety day window.
We look for what can be retired, not just what can be added
Cloud PKI can remove an on-premises certificate authority and its connectors. Enterprise App Management removes packaging effort. Remote Help may replace a separate remote support subscription. The business case for these is considerably stronger when it is framed as replacement rather than addition, and that framing is usually accurate.
Six UAE situations where an advanced capability solves a real problem.
An organisation that has never removed local administrator rights
The reason is always the same: a small number of legitimate tasks need elevation, nobody wants to be the person who breaks them, and so everybody keeps administrator rights indefinitely. Running users with least privilege while still allowing approved tasks that require elevation is precisely the mechanism that resolves the standoff.
A business still running a certificate authority for Wi-Fi certificates
An on-premises server, its connectors, and an annual scramble when something expires, maintained purely so devices can get certificates. A managed certificate authority handling issuance, renewal and revocation across Intune platforms removes an entire piece of infrastructure whose only remaining purpose is this.
An IT team spending its week packaging applications
Win32 packaging is unglamorous, repetitive and never finished, because applications update. A curated catalogue of Microsoft-hosted applications with built-in install settings converts a recurring effort into a selection, which for a small team is a meaningful share of the week returned.
A regulated firm needing support access to be auditable
Where a regulator or an auditor asks who accessed a user device, when and with what authority, an ad hoc remote support tool has no good answer. Cloud-based help desk support with role-based access controls does, and it produces the evidence as a by-product of normal operation.
A distributed operation with shared Android devices
Warehouses, sites, hotels and retail floors running shared or rugged Android devices that no individual user owns, and therefore no individual user will accept an update on. Delivering firmware updates over the air without user action is the only version of this that actually keeps a fleet current.
An estate with meeting rooms, signage or training headsets
Devices that are unquestionably corporate, unquestionably unmanaged, and generally forgotten until one of them stops working during an important meeting. Specialty device management covering AR and VR headsets, large smart-screen devices and conference room meeting devices brings them into the same management estate as everything else.
How UAE organisations are handling the advanced capabilities.
| Feature | Evaluated deliberately | Trialled casually | Never looked |
|---|---|---|---|
Knows which capabilities the licensing already includes | Yes | Partly | No |
Trial scoped to a representative population | Yes | No | Not applicable |
Success criteria defined before starting | Yes | No | Not applicable |
Trial still available for the important capability | Yes | Possibly not | Yes |
Overlapping third-party tools identified | Yes | No | No |
Local administrator rights actually removed | Yes | No | No |
On-premises certificate authority retired or scoped | Considered | No | No |
Win32 packaging effort reduced | Yes | No | No |
Decision made before the grace period expired | Yes | Sometimes | Not applicable |
Frequency in the UAE market | Uncommon | Common | Common |
The eight capabilities, ranked by the problem they solve.
| Capability | The problem it solves | |
|---|---|---|
| Endpoint Privilege Management | Local administrator rights nobody has been able to remove | |
| Cloud PKI | An on-premises certificate authority kept alive purely to issue device certificates | |
| Enterprise App Management | The ongoing cost of packaging and maintaining Win32 applications | |
| Remote Help | Support access with no role scoping and no audit trail | |
| Advanced Endpoint Analytics | Nobody can answer why the devices are slow | |
| Microsoft Tunnel for MAM | Personal mobile devices needing internal access without enrolment | |
| Specialty device management | Meeting rooms, signage and headsets managed by nobody | |
| Android firmware over the air | Shared or rugged Android fleets that never get updated |
Five steps, and the first two happen before any trial starts.
- 1
Establish what your licensing already includes
Whether you are on Intune Plan 1 or Plan 2, which Microsoft 365 bundles are held, and whether entitlement varies across the organisation, which Microsoft flags as common. This regularly shortens the conversation, because part of what somebody wants to buy turns out to already be available.
- 2
Identify what you are already paying somebody else for
Remote support tooling, privilege management, certificate infrastructure, application packaging services. Microsoft advises avoiding overlapping functionality, and the business case for an advanced capability is far stronger when it replaces a line item rather than adding one.
- 3
Design the trial before starting it
Which capability, which 250 users, what success looks like at ninety days, and who owns the evaluation. This is the step that protects the one trial per capability per tenant entitlement from being spent on an inconclusive experiment nobody was responsible for.
- 4
Run the trial with a decision date
Set against the ninety day duration and the thirty day grace period that follows, so the decision happens while the capability is still active rather than after somebody notices it has disappeared from the admin center along with whatever was configured in it.
- 5
Deploy or decline, and record why
Either roll out with the configuration built during the trial, or document the reason it was not adopted so the question does not get reopened in six months by somebody who was not part of the evaluation. Both are legitimate outcomes and only one of them is usually recorded.
What organisations ask about the Intune Suite.
Fifteen questions worth answering first.
What you already own
- Are you on Intune Plan 1 or Plan 2?Advanced capabilities come through Plan 2 and the Suite.
- Which Microsoft 365 bundle do you hold?Select bundles include advanced capabilities.
- Does licensing vary across the organisation?Microsoft flags this specifically.
- Are you already paying for an overlapping tool?Microsoft advises avoiding overlapping functionality.
- Who has Global or Billing administrator rights?Required to see and start trials.
Which one would change something
- Do your users still have local administrator rights?Endpoint Privilege Management addresses this.
- Do you run an on-premises certificate authority?Cloud PKI may let you retire it.
- How much time goes into packaging Win32 apps?Enterprise App Management reduces it.
- Is your remote support tool role-scoped and audited?Remote Help is.
- Can you explain why devices are slow?Advanced Endpoint Analytics can.
Trial design
- Which 250 users would be representative?The trial cap makes selection matter.
- What would success look like in 90 days?Define it before you start, not after.
- Who owns the evaluation?An unowned trial lapses and cannot be repeated.
- What happens to anything built during the trial?Decide before the 30 day grace period ends.
- Are you trialling more than one at once?Possible, and harder to evaluate cleanly.
The pages around this one.
Microsoft Intune
The platform itself, covering enrolment, policy, application deployment and the base capability these sit on top of.
MDM solutions
The wider device management picture across Windows, Apple and Android, and how to choose between platforms.
Endpoint security
The security side of the endpoint estate, and where privilege management fits alongside detection and response.
Find out which of the eight you already have before starting a trial.
Microsoft advises exactly this, and notes entitlement can vary across an organisation. Given there is one trial per capability per tenant, knowing what is already included is what stops you spending a finite evaluation on something you did not need to trial at all.
Related Services
Explore more solutions that work great with this service
Microsoft Cloud PKI
Retire the certificate server, NDES and the Intune connector
Enterprise App Management
Hundreds of prepared Win32 apps, and the limits of auto-update
Microsoft Intune
Device management and endpoint security
MDM Solutions Dubai
Device management across Windows, Apple and Android
Endpoint Security
Defender for Endpoint and Intune managed
Windows Autopilot Dubai
Zero-touch laptop deployment, supplier registration onward
Apple Device Management
Mac and iPhone fleets, encryption, patching and the September cycle
M365 Licensing
Optimize your Microsoft 365 licensing costs