- IT Resources
- Windows Server
- System Center
- Microsoft Edge
- Exchange Server
- SharePoint Products
- Skype for Business
- See all products »
- Channel 9 Video
- Evaluation Center
- Learning Resources
- Microsoft Tech Companion App
- Microsoft Technical Communities
- Microsoft Virtual Academy
- Script Center
- Server and Tools Blogs
- TechNet Blogs
- TechNet Flash Newsletter
- TechNet Gallery
- TechNet Library
- TechNet Magazine
- TechNet Wiki
- Windows Sysinternals
- Virtual Labs
- Cloud and Datacenter
- Virtualization
- Service Packs
- Security Bulletins
- Windows Update
- Windows Server 2016
- System Center 2016
- Windows 10 Enterprise
- SQL Server 2016
- See all trials »

Related Sites
- Microsoft Download Center
- Microsoft Evaluation Center
- Expert-led, virtual classes
- Training Catalog
- Class Locator
- Free Windows Server 2012 courses
- Free Windows 8 courses
- SQL Server training
- Microsoft Official Courses On-Demand
Certifications
- Certification overview
- Special offers
- MCSE Cloud Platform and Infrastructure
- MCSE: Mobility
- MCSE: Data Management and Analytics
- MCSE Productivity
Other resources
- Microsoft Events
- Exam Replay
- Born To Learn blog
- Find technical communities in your area
- Azure training
- Official Practice Tests
Support options
- For business
- For developers
- For IT professionals
- For technical support
- Support offerings
More support
- Microsoft Premier Online
- TechNet Forums
- MSDN Forums
- Security Bulletins & Advisories
Not an IT pro?
- Microsoft Customer Support
- Microsoft Community Forums
- Forums home
- Browse forums users
- Remove From My Forums
How to assign Intune device-based licenses?
As announced from Microsoft a few months ago, you can now use device-based Intune subscriptions.
https://techcommunity.microsoft.com/t5/Enterprise-Mobility-Security/Microsoft-Intune-announces-device-based-subscription-for-shared/ba-p/280817
Unfortunately I don't know how to assign the license to a device...
I thought it would work like a user license.
For example: Connect the license in AAD with a group, assign the device to this group
But it doesn't work as the license is still available when I'm checking in "Licenses - All products" (Assigned - 0)
Is there someone who knows how to assign Intune Device licenses?
Thanks in advance
All replies
According to the announcement, it sounds like that you should purchase the Intune device licenses firstly.
For more information, I would recommend to contact the Microsoft representative and visit https://www.microsoft.com/en-us/licensing/product-licensing/products
Best regards,
Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact [email protected] .
Thanks for your answer.
I've already purchased a device license. I can see the license under "Licenses - All products" next to the others.
But as described on the top the license is listed as available (assigned = 0)
Intune Device License assignment

Wonder if someone out there with a bit more knowledge of the Intune device license assignment can help me with this one as I've been struggling to find an answer on it - Apologies if it is a bit of a simple one.
We have a number of iOS devices that will be deployed without user affinity as kiosks running a single app, I've purchased Intune device licenses for these however I'm unsure how these actually get assigned to the devices. Do I simply need to just purchase licenses in line with how many devices I have and just hold them or am I missing something extremely obvious on where to add these, License assignment does not increase as devices are being enrolled.

You don’t need to assign the licenses. You just need to have enough license for the number of devices you’re deploying.
Awesome! Appreciate the help
"You can't assign an Intune device license, usage is based on trust."
( https://docs.microsoft.com/en-us/troubleshoot/mem/intune/device-licenses-introduction )
In the Microsoft Endpoint Manager admin center , select Users > All Users > choose a user > Licenses > Assignments . Each user that you assign a user software license to may access and use the online services and related software (including System Center software) to manage applications and up to 15 MDM devices. See: https://docs.microsoft.com/en-us/mem/intune/fundamentals/licenses-assign
What happens with device based licenses though
About Community

Ranked by Size
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Transferring Intune iOS devices from one user to another
I have ~10 iOS iPads and iPhones, enrolled by installing Intune Portal App, not through Apple Business DEP. How I can transfer iPad from one user to another in case the old user leaves the company?
This is not described in the documentation (only the use of shared devices). So I still see the following algorithm:
- Sign out user in Intune Portal App.
- Remove Intune license from the old user.
- Remove device from the old user devices in Azure AD and from list in MS Endpoint Management Center.
- Assign this Intune license to the new user.
- Login as this new user in the Intune Portal App, download and apply the new profile.
If you do not delete a device in the Azure AD/EMC, then when you add a device, it will be duplicated. And EMC will show you two completely identical devices but with different UPN users...
So maybe there is another, easier way?
Microsoft Intune Enrollment Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities. Enrollment: The process of requesting, receiving, and installing a certificate. 889 questions Sign in to follow
Microsoft Intune A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities. 2,299 questions Sign in to follow
Issue with wiping a device is when you have a high proportion of starters and leavers due to role changes. This creates a massive admin overhead. Changing the primary user would be a much more efficient and seamless way of re-purposing the devices. Is this something that will be available in future?
Device will need to be re-enrolled. Wipe the device and make the new user go through the enrollment process.
1 additional answer
@Allan Stark Thanks for posting in our Q&A.
For this issue, I agree with RahulJindal. In our official article, it describes that wipe action is useful for resetting a device before you give the device to a new user. https://learn.microsoft.com/en-us/mem/intune/remote-actions/devices-wipe#wipe
Please try to wipe the device and re-enroll the device for the new user.
Hope the above information will help.
If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Assign licenses to users so they can enroll devices in Intune
- 4 minutes to read
- 7 contributors
Whether you manually add users or synchronize from your on-premises Active Directory, you must first assign each user an Intune license before users can enroll their devices in Intune. For a list of licenses, see Licenses that include Intune .
Users assigned Intune app protection policy and not enrolling their devices into Microsoft Intune will also require an Intune license to receive policy.
Assign an Intune license Microsoft Intune admin center
You can use the Microsoft Intune admin center to manually add cloud-based users and assign licenses to both cloud-based user accounts and accounts synchronized from your on-premises Active Directory to Azure AD.
In the Microsoft Intune admin center , select Users > All Users > choose a user > Licenses > Assignments .
Choose the box for Intune > Save . If you want to use the Enterprise Mobility + Security E5 or other license, choose that box instead.

The user account now has the permissions needed to use the service and enroll devices into management.
Assign an Intune license by using Azure Active Directory
You can also assign Intune licenses to users by using Azure Active Directory. For more information, see the License users in Azure Active Directory article .
Use School Data Sync to assign licenses to users in Intune for Education
If you are an educational organization, you can use School Data Sync (SDS) to assign Intune for Education licenses to synced users. Just choose the Intune for Education checkbox when you're setting up your SDS profile.

When you assign an Intune for Education license, make sure that Intune A Direct license is also assigned.

See this overview of School Data Sync to learn more about SDS.
How user and device licenses affect access to services
- Each user that you assign a user software license to may access and use the online services and related software (including System Center software) to manage applications and up to 15 MDM devices.
- You can purchase licenses for any devices separately from user licenses. Device licenses do not need to be assigned to the devices. Each device that accesses and uses the online services and related software (including System Center software) must have a device license.
- If a device is used by more than one user, each device requires a device based software license or all users require a user software license.
- If you remove a license from a user that has managed devices, it may affect the compliance or management of those devices.
How to restore users accidentally unlicensed
- If you have accidentally removed the license for one or more users, you can restore their device compliance and management by re-assigning the license for those users. For more information, see Assign Microsoft Intune licenses .
Understanding the type of licenses you have purchased
How you purchased Intune determines your subscription information:
- If you purchased Intune through an Enterprise Agreement, you can find your subscription information in the Volume License portal under Subscriptions .
- If you purchased Intune through a Cloud Solution Provider, check with your reseller.
- If you purchased Intune with a CC# or Invoice, then your licenses will be user-based.
Look up current licenses using PowerShell
To view the number of free and used licenses on a Microsoft Intune subscription, you can use the following steps to run PowerShell commands.
From a PowerShell prompt, run the following command:
A pop-up window will prompt for credentials. Enter your Microsoft Intune credentials.
Run the following command:
A list of the Account ID , the Active Units , and the Consumed Units will appear. Note that this will also display any Microsoft Office 365 licenses on the subscription.
To confirm your Azure Active Directory Premium and Microsoft Intune using Microsoft Intune admin center, see Confirm your licenses .
Use PowerShell to selectively manage EMS user licenses
Organizations that use Microsoft Enterprise Mobility + Security (formerly Enterprise Mobility Suite) might have users who only require Azure Active Directory Premium or Intune services in the EMS package. You can assign one or a subset of services using Azure Active Directory PowerShell cmdlets .
To selectively assign user licenses for EMS services, open PowerShell as an administrator on a computer with the Azure Active Directory Module for Windows PowerShell installed. You can install PowerShell on a local computer or on an ADFS server.
You must create a new license SKU definition that applies only to the desired service plans. To do this, disable the plans you don't want to apply. For example, you might create a license SKU definition that does not assign an Intune license. To see a list of available services, type:
You can run the following command to exclude the Intune service plan. You can use the same method to expand to an entire security group or you can use more granular filters.
Example 1 Create a new user on the command line and assign an EMS license without enabling the Intune portion of the license:
Verify with:
Example 2 Disable the Intune portion of EMS license for a user that is already assigned with a license:

Submit and view feedback for

Additional resources
VPP Licensing with Intune
In Intune there are two ways to assign VPP licenses. You can use either user or device VPP licensing. Both license types have advantages and disadvantages. In this post I will describe some of the differences and challenges with VPP licencing types. The main difference between the VPP licensing types is quite obvious, with user licensing the users are linked to the user and with device licensing to the device.
Differences between Licensing types
Most of these differences between VPP Licensing types can be found on the Volume-purchased iOS apps page , but I’ve added some additional differences I could not find on the page. I also tried to describe some things more clearly.
How to change VPP Licensing type
By default, the license type is “User Licencing”. You can modify this by selecting “Device Licensing”.
User Notifications
Depending on the ownership, license model and whether the device is supervised, the notifications the user receives differ. This is something to keep in mind, because every prompt can cause an error if the user doesn’t accept (see Intune: VPP Error 0x87D13B92 ). In this overview you can see when which notification applies.
User licensing
When using user licensing, the licenses are linked to a user’s associated Apple ID. The user can use one license to deploy an application to a maximum of 5 devices. You can only associate one active Apple ID to each user account. When you a user enrolls a device with a different Apple ID logged in, this Apple ID will become active after accepting the user assignment. Because of this If an user enrolls multiple Apple devices in Intune with different Apple IDs this will cause issues.
App assignment
Before you can use user licenses on a device, you need be logged in to the App Store with a unique Apple ID. This can be either a personal Apple ID or a managed Apple ID. This Apple ID will be associated to the user account in the Itunes database (Picture 3).
To associate the Apple ID with the Company Portal will use the Apple ID that is used on the device to access the App Store. To allow this the user needs to allow that App and Books are assigned (See picture 4).
When a user registers multiple devices with different apple ids to the same user account in Intune, problems will occur. One of the issues I’ve noticed is:
Users may also recieve App Store notifications that licenses are no longer assigned to them (Picture 9).
Device licensing
In contrast to user licenses, device licenses are assigned to a device. Therefore you need a license for each device. Because the apps are assigned to the device, there is no need for an association with an Apple ID. That is why you should use device-based licenses for multi user scenarios such as kiosk mode devices.
8 thoughts on “ VPP Licensing with Intune ”
Leave a reply cancel reply.
- No suggested jump to results
- Notifications
Name already in use
Memdocs / memdocs / intune / fundamentals / licenses-assign.md.
- Go to file T
- Go to line L
- Copy permalink
- Open with Desktop
Assign licenses to users so they can enroll devices in Intune
Whether you manually add users or synchronize from your on-premises Active Directory, you must first assign each user an Intune license before users can enroll their devices in Intune. For a list of licenses, see Licenses that include Intune .
[!NOTE] Users assigned Intune app protection policy and not enrolling their devices into Microsoft Intune will also require an Intune license to receive policy.
Assign an Intune license Microsoft Intune admin center
You can use the Microsoft Intune admin center to manually add cloud-based users and assign licenses to both cloud-based user accounts and accounts synchronized from your on-premises Active Directory to Azure AD.
In the Microsoft Intune admin center , select Users > All Users > choose a user > Licenses > Assignments .
Choose the box for Intune > Save . If you want to use the Enterprise Mobility + Security E5 or other license, choose that box instead.

The user account now has the permissions needed to use the service and enroll devices into management.
Assign an Intune license by using Azure Active Directory
You can also assign Intune licenses to users by using Azure Active Directory. For more information, see the License users in Azure Active Directory article .
Use School Data Sync to assign licenses to users in Intune for Education
If you are an educational organization, you can use School Data Sync (SDS) to assign Intune for Education licenses to synced users. Just choose the Intune for Education checkbox when you're setting up your SDS profile.

When you assign an Intune for Education license, make sure that Intune A Direct license is also assigned.

See this overview of School Data Sync to learn more about SDS.
How user and device licenses affect access to services
- Each user that you assign a user software license to may access and use the online services and related software (including System Center software) to manage applications and up to 15 MDM devices.
- You can purchase licenses for any devices separately from user licenses. Device licenses do not need to be assigned to the devices. Each device that accesses and uses the online services and related software (including System Center software) must have a device license.
- If a device is used by more than one user, each device requires a device based software license or all users require a user software license.
- If you remove a license from a user that has managed devices, it may affect the compliance or management of those devices.
How to restore users accidentally unlicensed
- If you have accidentally removed the license for one or more users, you can restore their device compliance and management by re-assigning the license for those users. For more information, see Assign Microsoft Intune licenses .
Understanding the type of licenses you have purchased
How you purchased Intune determines your subscription information:
- If you purchased Intune through an Enterprise Agreement, you can find your subscription information in the Volume License portal under Subscriptions .
- If you purchased Intune through a Cloud Solution Provider, check with your reseller.
- If you purchased Intune with a CC# or Invoice, then your licenses will be user-based.
Look up current licenses using PowerShell
To view the number of free and used licenses on a Microsoft Intune subscription, you can use the following steps to run PowerShell commands.
From a PowerShell prompt, run the following command:
A pop-up window will prompt for credentials. Enter your Microsoft Intune credentials.
Run the following command:
A list of the Account ID , the Active Units , and the Consumed Units will appear. Note that this will also display any Microsoft Office 365 licenses on the subscription.
[!NOTE] To confirm your Azure Active Directory Premium and Microsoft Intune using Microsoft Intune admin center, see Confirm your licenses .
Use PowerShell to selectively manage EMS user licenses
Organizations that use Microsoft Enterprise Mobility + Security (formerly Enterprise Mobility Suite) might have users who only require Azure Active Directory Premium or Intune services in the EMS package. You can assign one or a subset of services using Azure Active Directory PowerShell cmdlets .
To selectively assign user licenses for EMS services, open PowerShell as an administrator on a computer with the Azure Active Directory Module for Windows PowerShell installed. You can install PowerShell on a local computer or on an ADFS server.
You must create a new license SKU definition that applies only to the desired service plans. To do this, disable the plans you don't want to apply. For example, you might create a license SKU definition that does not assign an Intune license. To see a list of available services, type:
You can run the following command to exclude the Intune service plan. You can use the same method to expand to an entire security group or you can use more granular filters.
Example 1 Create a new user on the command line and assign an EMS license without enabling the Intune portion of the license:
Verify with:
Example 2 Disable the Intune portion of EMS license for a user that is already assigned with a license:

Core 11.2.0.0 powered by MobileIron
Apply the Intune license to device users
Core customers must have a valid subscription to Microsoft Intune and assign a Microsoft Intune license to device users supported by this integration.
To bulk assign licenses to existing device users, follow the instructions listed below.
Group based assignment
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-groups-assign
Powershell based assignment
https://docs.microsoft.com/en-us/microsoft-365/enterprise/assign-licenses-to-user-accounts-with-microsoft-365-powershell?view=o365-worldwide
Next steps
Adding Core as a compliance partner
Was this article useful?
Copyright © 2021 , Ivanti . All rights reserved.
Privacy and Legal

IMAGES
VIDEO
COMMENTS
In the Microsoft Intune admin center, select Users > All Users > choose a user > Licenses > Assignments. Choose the box for Intune > Save. If you want to use the Enterprise Mobility + Security E5 or other license, choose that box instead. The user account now has the permissions needed to use the service and enroll devices into management.
To confirm your Microsoft Intune license or trial, use the following steps: Sign in to Microsoft Intune admin center. Select Tenant administration > Tenant status. Under the Tenant details tab, you will see the MDM authority, the Total licenses users, and the Total Intune licenses. Select Tenant administration > Roles > My permissions.
In the Microsoft 365 admin center, go to the Billing > Licenses page. On the Licenses page, choose Microsoft 365 Apps for Education (device) or Microsoft 365 Apps for enterprise (device). On the next page, choose a subscription, then choose Assign licenses.
Sign in to the Microsoft Intune admin center. Select Devices > Enroll devices. Select Device enrollment managers. Select Add. In the User name field, enter the user principal name of the user you're adding. Select Add. The new device enrollment manager is added to the list of DEM users.
Unfortunately I don't know how to assign the license to a device... I thought it would work like a user license. For example: Connect the license in AAD with a group, assign the device to this group But it doesn't work as the license is still available when I'm checking in "Licenses - All products" (Assigned - 0)
Assign a policy to users or groups Sign in to the Microsoft Intune admin center. Select Devices > Configuration profiles. All the profiles are listed. Select the profile you want to assign > Properties > Assignments > Edit: For example, to assign a device configuration profile: Go to Devices > Configuration profiles. All the profiles are listed.
To assign these licenses, you must be a Global admin. After you go to Billing > Licenses > Subscriptions in the Microsoft 365 admin center, be sure that you select either Microsoft 365 Apps for enterprise (device) or Microsoft 365 Apps for Education (device) (depending on which license you have) to assign those licenses to the group you created.
Unfortunately I don't know how to assign the license to a device... I thought it would work like a user license. For example: Connect the license in AAD with a group, assign the device to this group. But it doesn't work as the license is still available when I'm checking in "Licenses - All products" (Assigned - 0)
In the Microsoft Endpoint Manager admin center, select Users > All Users > choose a user > Licenses > Assignments. Each user that you assign a user software license to may access and use the online services and related software (including System Center software) to manage applications and up to 15 MDM devices.
Intune Device Licensing? We're recently started looking at enrolling dedicated Android devices on Intune using Google Enterprise, which works great as we can setup Android devices without google accounts and the devices can be shared between users as there not linked to a single Microsoft Account.
A good practice would be to create a dedicated user and assign an Intune license to this user. Then assign the Device Enrollment Role to it. This allows you to enroll up to 1000 devices. If you have Azure AD Joined devices, they are already enrolled in Intune (Endpoint Manager).
Assign this Intune license to the new user. Login as this new user in the Intune Portal App, download and apply the new profile. If you do not delete a device in the Azure AD/EMC, then when you add a device, it will be duplicated. And EMC will show you two completely identical devices but with different UPN users...
In the Microsoft Intune admin center, select Users > All Users > choose a user > Licenses > Assignments. Choose the box for Intune > Save. If you want to use the Enterprise Mobility + Security E5 or other license, choose that box instead. The user account now has the permissions needed to use the service and enroll devices into management.
Assign licenses to users so they can enroll devices in Intune. Whether you manually add users or synchronize from your on-premises Active Directory, you must first assign each user an Intune license before users can enroll their devices in Intune. For a list of licenses, see Licenses that include Intune.
In Intune there are two ways to assign VPP licenses. You can use either user or device VPP licensing. Both license types have advantages and disadvantages. In this post I will describe some of the differences and challenges with VPP licencing types. The main difference between the VPP licensing types is quite obvious, with user licensing the ...
In the Microsoft Intune admin center, select Users > All Users > choose a user > Licenses > Assignments. Choose the box for Intune > Save. If you want to use the Enterprise Mobility + Security E5 or other license, choose that box instead. The user account now has the permissions needed to use the service and enroll devices into management.
Apply the Intune license to device users. Core customers must have a valid subscription to Microsoft Intune and assign a Microsoft Intune license to device users supported by this integration. To bulk assign licenses to existing device users, follow the instructions listed below. Group based assignment