Microsoft Intune Licensing Decoded: PIN, PAM, EPM, LAPS & SSPR — P1 vs P2 Explained

If you have worked in an enterprise IT environment, you have almost certainly hit this wall — a feature your organisation needs is locked behind a license you do not have. Microsoft's licensing stack is deep, overlapping, and constantly evolving. The names change (Azure AD is now Entra ID), the bundles shift, and new add-ons appear every year.

This guide cuts through all of that. We will map every major security feature — PIN enforcement, PAM, EPM, LAPS, and SSPR — to the exact license that unlocks it, explain how P1 and P2 differ in practice, and show you how they all connect architecturally.

---

The Microsoft License Landscape — A Quick Map

Before we go feature by feature, you need to understand the two product families that matter here.

Family 1 — Microsoft Entra ID (formerly Azure AD)

This handles identity. Think users, passwords, groups, authentication methods, and conditional access.

Family 2 — Microsoft Intune

This handles devices and endpoints. Think MDM, MAM, compliance policies, and endpoint configuration.

How They Bundle Into M365

---

Architecture — How the Licenses Layer Together

The diagram below shows how Entra ID and Intune licensing layers sit on top of each other, and which features live at each level.

Each layer depends on the one below it. You cannot enforce Conditional Access policies (P1) for a device that is not enrolled in Intune (Plan 1). You cannot use EPM (Plan 2) without Intune Plan 1. And PAM/PIM (P2) requires P1 as a foundation.

---

SSPR — Self-Service Password Reset

What it does

SSPR lets users reset their own passwords from the login screen or a web portal — without calling the helpdesk. They verify their identity via a secondary method (authenticator app, phone call, email, security questions) and reset immediately.

How it works

License Requirement

---

PIN — Windows Hello for Business

What it is

When people say "PIN" in an enterprise context, they almost always mean Windows Hello for Business (WHfB). This is fundamentally different from a simple Windows local PIN. A WHfB PIN is:

• Device-bound — the PIN only works on the specific device it was set up on
• Backed by a cryptographic key pair stored in the device's TPM chip
• Not a password — it never leaves the device and never travels over the network
• Phishing-resistant by design

A stolen PIN is useless on any other device. This is why WHfB PIN is considered stronger than a traditional password.

Deployment Models

How it works (Cloud Trust — simplest)

License Requirement

---

LAPS — Local Administrator Password Solution

What it is

Every Windows device has a local administrator account. By default, organisations often set this to the same password across all machines — a catastrophic security risk. If an attacker compromises one machine, they have the local admin password for every machine in the fleet.

LAPS solves this by automatically rotating the local administrator password to a unique, random password per device, storing it securely, and making it retrievable only by authorised IT staff.

Two Versions of LAPS

Legacy LAPS (the old on-premises version):

• Free download from Microsoft
• Requires on-prem Active Directory
• Stores passwords in AD attributes
• Requires Group Policy for deployment
• Does not support Entra ID joined (cloud-only) devices

Windows LAPS (modern, built into Windows 10/11 and Server 2022):

• Built into the OS (no separate agent needed)
• Supports Entra ID joined, Hybrid joined, and on-prem AD devices
• Managed through Intune or Group Policy
• Passwords stored in Entra ID or on-prem AD (your choice)
• Password history, encrypted storage, and automatic rotation

How Windows LAPS Works (Intune-managed)

License Requirement

---

PAM — Privileged Access Management

What it is

In Microsoft's context, PAM refers to Privileged Identity Management (PIM) in Entra ID. It controls who has access to powerful admin roles (like Global Administrator, Intune Administrator, or Security Administrator) and for how long.

Without PIM, admin roles are permanent — a user assigned as Global Admin has that role 24/7, every day. If that account is compromised, an attacker has permanent elevated access.

With PIM, admin roles are just-in-time. A user is eligible for a role but not actively assigned to it. When they need admin access, they request activation, provide a reason, and get the role for a limited time window (e.g., 2 hours). The activation can require MFA and manager approval.

How PIM Works

Key PIM Capabilities

License Requirement

---

EPM — Endpoint Privilege Management

What it is

One of the most common enterprise problems: standard users need to run specific applications as administrator, but you do not want to make them local admins.

Traditional approaches — giving users local admin rights, or having IT run installers manually — are either insecure or operationally expensive. Endpoint Privilege Management (EPM) solves this cleanly.

EPM lets you define rules in Intune that allow a standard user to elevate specific apps to run as administrator, on demand, with logging. The user never needs local admin rights on the machine. They right-click a specific approved application, choose "Run with elevated access", optionally provide a business justification, and the app runs elevated. Everything else on the machine runs as a standard user.

How EPM Works

EPM Elevation Types

License Requirement

---

P1 vs P2 — The Full Comparison

Here is everything in one place. This is the table to bookmark.

---

How They All Work Together — A Real-World Scenario

Imagine a 500-person organisation with M365 E3 (which gives P1 + Intune Plan 1). Here is how the features combine in practice.

Day-to-day scenario: A developer's laptop.

1. The developer's laptop is Entra-joined and Intune-enrolled.
2. Intune Plan 1 deploys a Windows Hello for Business configuration profile. The developer sets a 6-digit PIN. From now on, their PIN unlocks a TPM-backed key — no password over the network.
3. Intune Plan 1 deploys a LAPS policy. The local Administrator password is now unique to that machine and rotates every 7 days. If IT ever needs local admin access, they retrieve it from the Intune portal.
4. Entra ID P1 Conditional Access requires that the device is Intune-compliant and uses WHfB authentication before accessing Outlook or SharePoint. Non-compliant or personal devices are blocked.
5. Entra ID P1 SSPR lets the developer reset their own password on a Friday evening without calling the helpdesk.

What this organisation cannot do yet with E3:

• PAM/PIM — their Global Admin accounts have permanent standing access. An attacker who compromises those accounts has full tenant access indefinitely. They need P2 to fix this.
• EPM — their finance team needs to run a legacy accounting app that requires admin rights. Currently IT either runs it for them or the users are local admins. They need Intune Plan 2 to deploy EPM rules.

Upgrading path:

---

Choosing the Right Bundle — Quick Decision Guide

Do you need users to reset their own passwords? → You need Entra ID P1 (included in M365 E3 / Business Premium).

Do you need to enforce which device types can access company data? → You need Entra ID P1 (Conditional Access) + Intune Plan 1 (compliance policies).

Do you need to manage local admin passwords on every device? → You need Intune Plan 1 (Windows LAPS policy). Legacy LAPS (AD-only) is free.

Do you need to protect your admin accounts with just-in-time access? → You need Entra ID P2. This is the single most impactful security upgrade for most organisations.

Do you need standard users to run specific apps as admin without making them local admins? → You need Intune Plan 2 (EPM). Add-on to any existing Intune plan.

---

Summary

The most important takeaways:

• P1 gives you Conditional Access, SSPR, and the foundation for WHfB and LAPS management via Intune.
• P2 adds PIM (your PAM solution), Identity Protection, and Access Reviews — these are the features that protect your most sensitive accounts.
• Intune Plan 1 is the engine for WHfB PIN policies and cloud-managed LAPS.
• Intune Plan 2 adds EPM — the answer to "how do I stop making users local admins."
• These licenses are additive. You can have P2 without Plan 2, or Plan 2 without P2 — they are separate product families.

If you are building a security roadmap, start with P1 features (SSPR, Conditional Access, Intune-managed WHfB and LAPS), then add P2 to lock down admin access with PIM, and finally add Intune Plan 2 if you have the standard-user-elevation problem that EPM solves.

---

Have questions about mapping these licenses to your specific environment? Drop a comment below — I am happy to help you work through the right license combination for your use case.