MDM cost per device depends on what you already license before it depends on any MDM vendor. Microsoft Intune is included in Microsoft 365 Business Premium and in the enterprise suites, so a business on those plans has already paid for the platform and is budgeting for the labor to run it. A business on a cheaper plan, or one with a fleet of Apple devices that needs Apple-specific tooling, is looking at a standalone subscription priced per user or per device on top. NetSys manages devices in Intune as part of its managed agreements and quotes standalone device management per business, month to month. This guide explains the license options in words, what the labor covers, and what usually lands outside the per-device fee.
What are the licensing options for MDM?
| Option | Who it suits | How it is priced |
|---|---|---|
| Intune inside Microsoft 365 Business Premium | Small businesses already on Premium for its security features | No separate MDM license; the cost is setup and management labor |
| Intune inside Microsoft 365 E3 or E5 | Larger firms on enterprise suites | Included in the suite |
| Standalone Intune Plan 1 | Businesses on Business Basic or Standard, or on other mail platforms | Per user per month, published by Microsoft; one user license covers that person's devices |
| Intune device licenses | Shared, kiosk and frontline devices with no assigned user | Per device per month |
| Intune Suite add-ons | Remote help, endpoint privilege management, advanced analytics | Per user add-on, published by Microsoft |
| Apple-focused MDM platforms | Mac and iPhone fleets wanting deeper Apple integration | Per device per month or per year, published by each vendor |
| Other standalone MDM platforms | Mixed fleets outside the Microsoft ecosystem | Per device or per user, tiered by features |
Microsoft's Intune licensing documentation is the reference for what each plan includes and how many devices a user license covers; it moves often enough that we point to it rather than restating it. Our comparison of Business Premium and Business Standard explains the other security features that arrive with Premium alongside Intune.
What does Intune cost if you already have Business Premium?
Nothing more in license terms for company-owned and personal Windows, Mac, iPhone, iPad and Android devices assigned to licensed users. The Premium bundle also carries Entra ID Plan 1, which provides the conditional access policies that make MDM useful: no compliant device, no access to company mail and files. That combination is the reason most small businesses on Premium should not buy a separate MDM product, and it is the reason NetSys builds its device management on Intune.
What Premium does not include is the work. A tenant with Intune licensed and nothing configured has no device management. Enrollment profiles, compliance policies, configuration baselines, application deployment, update rings, encryption enforcement and the conditional access rules that tie it together are all labor, and so is enrolling the devices that already exist. That labor is the real cost of MDM for a Premium customer, and it is what a managed provider quotes.
What does standalone MDM cost per device?
For businesses outside Premium, the per-device or per-user subscription is published on each vendor's site, and that is the honest place to read a current figure. What the pricing pages do not show is the total: the subscription, plus the labor above, plus whatever identity platform the MDM needs to enforce access. A standalone MDM bolted onto a tenant without conditional access can enforce a passcode and wipe a lost phone, but it cannot stop an unmanaged device from signing into mail. Compare the standalone route against upgrading the affected seats to Premium, where the identity, device and endpoint pieces arrive together, before assuming standalone is cheaper.
Per-device licensing appears in one more place: shared devices. A warehouse scanner, a clinic kiosk or a conference room tablet has no assigned user, and both Intune and most other platforms sell a device license for exactly that case. Count those devices separately when comparing quotes, because a per-user plan quietly excludes them.
How are Apple devices licensed and managed?
Apple devices carry no extra cost for the Apple side of management. Apple Business Manager is free, and it is what lets a business buy Macs and iPhones that enroll into MDM automatically on first power-on and cannot be removed from management by the user. The Apple push certificate that MDM needs is free and renews annually, which is a small but real maintenance task that, when missed, breaks management for every Apple device at once.
Intune manages Mac, iPhone and iPad well for the needs of most small businesses: enrollment, compliance, encryption, app deployment and wipe. Businesses with a large Mac fleet, a design or development team, or an administrator who lives in the Apple ecosystem sometimes choose an Apple-focused platform for deeper configuration and faster support of new macOS releases, at a per-device subscription on top of Microsoft 365. The right question is whether the Apple-specific needs are real or assumed; for a firm with a handful of Macs among Windows laptops, Intune alone is usually the cost-effective answer.
What labor sits behind the license, and what is billed separately?
- Design. Which devices are managed, what compliance means (encryption, passcode, OS version, no jailbreak), and what personal devices are allowed to do.
- Enrollment. Every existing device has to be enrolled, which takes minutes per device and coordination per person. New devices arrive pre-enrolled through Windows Autopilot or Apple Business Manager once those are set up; our Windows Autopilot guide covers that side.
- Applications. Packaging and deploying the software people need, and the updates that follow.
- Policy maintenance. OS updates change what policies can do; conditional access rules need a review when roles change.
- Help desk. Lockouts, lost devices, new phones and departing staff all generate tickets that land on someone.
Hardware, first: MDM does not replace the devices that cannot run a supported operating system, and the compliance policy that blocks them will reveal how many there are. Identity licensing, when the tenant does not already have conditional access. Apple-focused or other third-party platforms when they are chosen. BYOD policy work, including the legal and HR review of what the company may and may not do to a personal phone, described in our BYOD policy FAQ. And on-site time for enrolling devices that cannot be reached remotely, such as a closet full of shared tablets.
How do you compare MDM quotes?
Put both quotes against the same device list, including shared and personal devices, and check whether the license is already inside your Microsoft 365 plan before paying for it twice. Then compare the labor: what the setup includes, whether existing devices are enrolled as part of it, who handles lost-device wipes and lockouts afterward, and whether that ongoing management is inside a monthly agreement or billed by the ticket. A quote that lists a per-device platform fee and nothing else is a software resale, and MDM without configuration is a line on an invoice. For the general questions owners ask, see our mobile device management FAQ.
Frequently asked questions
How much does MDM cost per device?
If your business is on Microsoft 365 Business Premium or an enterprise suite, the MDM platform is Intune and it is already licensed; the cost is the labor to configure and run it, which NetSys quotes per business, month to month. Businesses on other plans pay a standalone subscription per user or per device at rates published by Microsoft or the MDM vendor, plus the same labor. Shared devices without an assigned user need a per-device license in either case.
Is Microsoft Intune free?
No, but for many small businesses it is already paid for. Intune is bundled into Microsoft 365 Business Premium and the enterprise suites, and sold standalone as a per-user plan for tenants on other licenses, as Microsoft's licensing documentation sets out. What is never free is the configuration: a licensed but unconfigured Intune tenant manages nothing. Budget for the setup and the ongoing policy work rather than for the license.
Do we need MDM for employees' personal phones?
If personal phones open company mail or files, yes, in some form. Intune's app protection policies can protect company data inside Outlook and Teams on a personal phone without enrolling the whole device or touching personal photos, and conditional access can require that protection before mail is allowed. Full enrollment of personal devices is a heavier step that many staff resist, and a written BYOD policy decides which approach applies.
Can MDM see personal data on a phone?
Not in the way people fear. On a personally owned device enrolled the standard way, or protected only at the app level, management sees device model, OS version, compliance state and the company apps it manages; it does not read personal messages, photos or browsing. On a company-owned device the organization has broader control because it owns the hardware. Tell staff plainly which case applies to them, in writing, before enrollment; it removes most of the resistance.
Managing devices with NetSys
NetSys builds device management on Microsoft Intune, enrolls every phone, laptop and tablet that touches company data, ties compliance to conditional access, and runs the ongoing work as part of a month-to-month agreement. See our Intune management page for the Microsoft side, and our mobile device management page for the full service across Windows, Mac, iPhone, iPad and Android.
Sources and further reading
- Microsoft Intune licensing, which plans include Intune and how devices per user are counted.
- Apple Business Manager User Guide.
Turn insight into action.
Take a free cybersecurity or AI readiness assessment, or book a call with a NetSys engineer — no obligation, no runaround.