Intune vs Entra ID: Device Management vs Identity, and Why You Need Both

Microsoft Entra ID decides who someone is and whether a sign-in is allowed; Microsoft Intune manages the laptops, phones and apps they sign in from. Intune doesn't store user accounts or authenticate anyone itself: it relies on Entra ID for sign-in, groups and Conditional Access, and reports each device's compliance back to Entra ID so an unmanaged or unencrypted device can be refused. Most small businesses don't pick one over the other, because Microsoft 365 Business Premium includes both.

The confusion is understandable. Both appear in the Microsoft 365 admin experience, both touch devices, and Entra ID used to be called Azure Active Directory, which is why the question often comes up as Intune vs Azure. This guide explains which job belongs to which service, how they connect, and what each costs as of October 2026. Our Intune management service sets up both halves for clients.

Prices are Microsoft list prices per user per month with an annual commitment.

What is the difference between Intune and Entra ID?

Entra ID is the identity system behind every Microsoft 365 tenant. It holds user accounts and groups, checks passwords and MFA at sign-in, provides single sign-on to cloud apps, and, with an Entra ID P1 license, runs the Conditional Access policies that decide whether a given sign-in gets through.

Intune is Microsoft's cloud endpoint management service. Microsoft says you use it to "enroll, configure, secure, and update devices, deploy and protect apps" across Android, iOS and iPadOS, Linux, macOS and Windows, with no on-premises infrastructure. Its documentation is direct about the dependency: Intune "doesn't store user identities or perform authentication" and relies on Entra ID for authentication, for the users and groups that policies target, and for Conditional Access.

How do Intune and Entra ID work together?

The link is device compliance. A typical setup runs in four steps:

1. A laptop or phone gets a device identity in Entra ID by being registered or joined. Microsoft lists device identity as a prerequisite for device-based Conditional Access and for Intune management.
2. The device enrolls in Intune, which applies settings and checks compliance rules such as encryption, a passcode and a minimum OS version.
3. Intune sends the result, compliant or not, to Entra ID.
4. A Conditional Access policy in Entra ID requires a device marked compliant before it allows access to email, Teams or files.

Without Intune, Entra ID with P1 can still demand MFA and block sign-ins from countries you never work in, but it has no compliance signal to tell a managed, encrypted laptop from an unmanaged one. Without Entra ID P1, Intune can still configure and wipe devices, but nothing stops an unmanaged device from opening the same mailbox in a browser. That's why the two are sold together in Business Premium, and why Microsoft's Conditional Access documentation says the feature requires Entra ID P1, while noting Business Premium customers can use it too.

Is Intune part of Azure?

Not in the way the question suggests. Azure is Microsoft's cloud platform for servers, storage and databases. Entra ID used to be named Azure Active Directory, which is where the Intune vs Azure question usually comes from, and Microsoft renamed it in 2023. Intune is a separate cloud service that you manage in the Intune admin center. What it needs is Entra ID, which every Microsoft 365 tenant already includes; you don't buy Azure servers or storage to use it.

Do you need Entra ID P1 to use Intune?

Not to license Intune: Microsoft sells Intune Plan 1 on its own at $8.00 per user per month. But the result most businesses buy Intune for, refusing access from devices that aren't compliant, is a Conditional Access policy, and that requires Entra ID P1. Policies that react to a risky sign-in or a leaked password go a step further and need Entra ID P2. In practice the two licenses are bought together, most cheaply inside Business Premium. Our Entra ID P1 vs P2 guide covers the identity side of that choice.

Which fits a small team?

• Under 300 users on Microsoft 365: Business Premium, which includes Entra ID P1 and Intune Plan 1 at $22.00 per user per month.
• On Business Basic or Standard and not ready to switch: add Entra ID P1 ($7.00) and Intune Plan 1 ($8.00). That's $15.00 on top of the plan: $22.00 a user on Basic, the same as Premium, and $29.00 on Standard, so moving to Premium costs the same or less and adds Defender for Business.
• Email on another platform, Windows PCs to manage: Intune Plan 1 on its own, which comes with the free tier of Entra ID, plus Entra ID P1 if Conditional Access should protect Microsoft apps.
• Personal phones only: Intune app protection policies guard company data inside Outlook and Teams without enrolling the phone, and Conditional Access can require them.

Larger organizations get both in Microsoft 365 E3 and E5, which since July 2026 also include Intune Plan 2, Remote Help and Advanced Analytics.

What does each cost?

As of October 2026, Microsoft lists Entra ID P1 at $7.00 and P2 at $10.00 per user per month, and Intune Plan 1 at $8.00, all with an annual commitment. Entra ID Free comes with every Microsoft 365 subscription. Business Premium, at $22.00, includes Entra ID P1 and Intune Plan 1 along with Defender for Business. Intune add-ons such as Remote Help ($3.50) and Endpoint Privilege Management ($3.00) are priced separately, and our Intune Plan 1 vs Plan 2 guide lists each one.

The licenses are the small part. Writing compliance policies, enrolling existing devices, testing Conditional Access in report-only mode and handling the exceptions is the real work, and it's where rollouts tend to stall. Microsoft licenses Intune per user or per device, and its documentation notes that administrators can manage Intune without a license of their own.

How does NetSys help?

We set up and run both halves. On the Intune side, that means an enrollment path for each kind of device, compliance rules, app packaging and Windows Autopilot, proven on a pilot group before wider rollout. On the Entra ID side, it means Conditional Access policies reviewed together with those compliance rules, and policy changes made through change approval so an edit doesn't lock anyone out. A device that falls out of compliance gets fixed under agreed remediation and escalation rules rather than just blocked.

Book a call with a NetSys engineer if you're licensed for Intune and Entra ID P1 but not sure they're connected, and we'll check how your compliance and Conditional Access policies fit together.

Frequently asked questions

Can I use Intune without Entra ID?

No. Intune relies on Entra ID for sign-in and for the users and groups its policies target. Every Microsoft 365 tenant already has Entra ID, so in practice this only matters if your email and identity live with another provider.

Can I use Entra ID without Intune?

Yes. Entra ID handles sign-in, MFA and single sign-on whether or not devices are managed. Without a management tool reporting compliance, though, Conditional Access can't require a device marked compliant. Microsoft also accepts compliance data from certain third-party device management partners, and its partner documentation says those users still need Intune licenses.

Is Entra ID the same as Azure AD?

Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023 with no change to features or pricing. It's a different product from on-premises Windows Server Active Directory, which kept its name.

How does Intune compare with ManageEngine Endpoint Central?

They compete; Entra ID doesn't. Endpoint Central is a third-party endpoint management product that patches Windows, Mac, Linux and third-party applications and deploys Windows, with editions that start at $795 a year for 50 endpoints as of October 2026. A Microsoft 365 business that chooses it still uses Entra ID for identity, and as of October 2026 Endpoint Central isn't on Microsoft's list of compliance partners, so its device status doesn't feed Conditional Access the way Intune's does.

Which admin center do I use for each?

Entra ID is managed in the Microsoft Entra admin center at entra.microsoft.com, where Conditional Access sits under Entra ID. Intune is managed in the Microsoft Intune admin center. Because a change in one so often depends on the other, the same person or team should own both, with a written record of which policy lives where.

What does it take to set up Intune and Entra ID together?

The right licenses, then a sequence: device enrollment for each platform, compliance policies, a pilot group, Conditional Access in report-only mode, and enforcement once the reports look clean. Break-glass admin accounts should exist before any policy is enforced. Plan for someone to own exceptions afterward, because new devices and staff keep arriving.