Microsoft Intune Licensing Decoded: PIM, PAM, EPM, LAPS & SSPR — P1 vs P2 Explained

If you have worked in an enterprise IT environment, you have almost certainly hit this wall — a feature your organisation needs is locked behind a license you do not have. Microsoft's licensing stack is deep, overlapping, and constantly evolving. The names change (Azure AD is now Entra ID), the bundles shift, and new add-ons appear every year.

This guide cuts through all of that. We will map every major security feature — PIM, PAM, EPM, LAPS, and SSPR — to the exact license that unlocks it, explain how P1 and P2 differ in practice, and show you how they all connect architecturally.

---

The Microsoft License Landscape — A Quick Map

Before we go feature by feature, you need to understand the two product families that matter here.

Family 1 — Microsoft Entra ID (formerly Azure AD)

This handles identity. Think users, passwords, groups, authentication methods, and conditional access.

Family 2 — Microsoft Intune

This handles devices and endpoints. Think MDM, MAM, compliance policies, and endpoint configuration.

How They Bundle Into M365

---

Architecture — How the Licenses Layer Together

The diagram below shows how Entra ID and Intune licensing layers sit on top of each other, and which features live at each level.

Each layer depends on the one below it. You cannot enforce Conditional Access policies (P1) for a device that is not enrolled in Intune (Plan 1). You cannot use EPM (Plan 2) without Intune Plan 1. And PAM/PIM (P2) requires P1 as a foundation.

---

SSPR — Self-Service Password Reset

What it does

SSPR lets users reset their own passwords from the login screen or a web portal — without calling the helpdesk. They verify their identity via a secondary method (authenticator app, phone call, email, security questions) and reset immediately.

How it works

License Requirement

---

PAM — Privileged Access Management

What is PAM?

PAM (Privileged Access Management) is a cybersecurity strategy and discipline focused on controlling, monitoring, and auditing access to an organisation's most sensitive systems and accounts — specifically the accounts that hold elevated or administrative privileges.

Think of it this way: in any organisation, most users have standard accounts that can read emails and open documents. But a small number of accounts — IT admins, security engineers, database administrators — have the power to delete data, change configurations, install software, or access every user's mailbox. These are privileged accounts. If any one of them is compromised, the damage can be catastrophic.

PAM exists to make sure that:

• Privileged access is granted only when needed and revoked immediately after
• Every privileged action is logged and audited
• The blast radius of a compromised account is minimised

Why PAM Matters

Without PAM, the typical enterprise looks like this:

• IT admins have permanent Global Admin or Domain Admin accounts used every day
• Those accounts are used for both privileged tasks (changing firewall rules) and routine tasks (checking email)
• A phishing email that captures the admin's credentials gives an attacker permanent, unlimited access
• There is no audit trail of what the account did once compromised

With PAM in place:

• Admin roles are held only during the specific window they are needed
• Every access request requires justification and optionally manager approval
• All privileged sessions are logged — what was accessed, changed, or deleted
• A compromised account has zero standing privilege and cannot do admin-level damage without triggering an approval workflow

Core Principles of PAM

PAM in the Microsoft Ecosystem

Microsoft implements PAM through Privileged Identity Management (PIM) in Microsoft Entra ID. In the Microsoft world, when an organisation says they have PAM, they almost always mean they have enabled PIM.

---

PIM — Privileged Identity Management

What it is

PIM (Privileged Identity Management) is a Microsoft Entra ID feature that controls who has access to powerful admin roles, when they have it, and for how long. It is the Microsoft implementation of the broader concept of Privileged Access Management (PAM).

Without PIM, admin roles are permanent — a user assigned as Global Administrator has that role 24 hours a day, every day of the year. If that account is ever compromised, an attacker has full, permanent elevated access to your entire tenant.

With PIM, admin roles are just-in-time (JIT). A user is made eligible for a role but does not hold it actively. When they need admin access, they request activation, state a reason, complete MFA, and receive the role for a limited time window (e.g., 2 hours). When the window expires, the role is automatically removed.

PIM vs PAM — Clarified

In Microsoft's ecosystem, when you enable PAM, you are enabling PIM. They refer to the same feature — PIM is simply the product name Microsoft uses in the Entra portal.

How PIM Works

Key PIM Capabilities

License Requirement

---

LAPS — Local Administrator Password Solution

What it is

Every Windows device has a local administrator account. By default, organisations often set this to the same password across all machines — a catastrophic security risk. If an attacker compromises one machine, they have the local admin password for every machine in the fleet.

LAPS solves this by automatically rotating the local administrator password to a unique, random password per device, storing it securely, and making it retrievable only by authorised IT staff.

Two Versions of LAPS

Legacy LAPS (the old on-premises version):

• Free download from Microsoft
• Requires on-prem Active Directory
• Stores passwords in AD attributes
• Requires Group Policy for deployment
• Does not support Entra ID joined (cloud-only) devices

Windows LAPS (modern, built into Windows 10/11 and Server 2022):

• Built into the OS (no separate agent needed)
• Supports Entra ID joined, Hybrid joined, and on-prem AD devices
• Managed through Intune or Group Policy
• Passwords stored in Entra ID or on-prem AD (your choice)
• Password history, encrypted storage, and automatic rotation

How Windows LAPS Works (Intune-managed)

License Requirement

---

EPM — Endpoint Privilege Management

What it is

One of the most common enterprise problems: standard users need to run specific applications as administrator, but you do not want to make them local admins.

Traditional approaches — giving users local admin rights, or having IT run installers manually — are either insecure or operationally expensive. Endpoint Privilege Management (EPM) solves this cleanly.

EPM lets you define rules in Intune that allow a standard user to elevate specific apps to run as administrator, on demand, with logging. The user never needs local admin rights on the machine. They right-click a specific approved application, choose "Run with elevated access", optionally provide a business justification, and the app runs elevated. Everything else on the machine runs as a standard user.

How EPM Works

EPM Elevation Types

License Requirement

---

P1 vs P2 — The Full Comparison

Here is everything in one place. This is the table to bookmark.

---

How They All Work Together — A Real-World Scenario

Imagine a 500-person organisation with M365 E3 (which gives P1 + Intune Plan 1). Here is how the features combine in practice.

Day-to-day scenario: A developer's laptop.

1. The developer's laptop is Entra-joined and Intune-enrolled.
2. Intune Plan 1 deploys a Windows Hello for Business configuration profile. The developer sets a 6-digit PIN. From now on, their PIN unlocks a TPM-backed key — no password over the network.
3. Intune Plan 1 deploys a LAPS policy. The local Administrator password is now unique to that machine and rotates every 7 days. If IT ever needs local admin access, they retrieve it from the Intune portal.
4. Entra ID P1 Conditional Access requires that the device is Intune-compliant and uses WHfB authentication before accessing Outlook or SharePoint. Non-compliant or personal devices are blocked.
5. Entra ID P1 SSPR lets the developer reset their own password on a Friday evening without calling the helpdesk.

What this organisation cannot do yet with E3:

• PAM/PIM — their Global Admin accounts have permanent standing access. An attacker who compromises those accounts has full tenant access indefinitely. They need P2 to fix this.
• EPM — their finance team needs to run a legacy accounting app that requires admin rights. Currently IT either runs it for them or the users are local admins. They need Intune Plan 2 to deploy EPM rules.

Upgrading path:

---

Choosing the Right Bundle — Quick Decision Guide

Do you need users to reset their own passwords? → You need Entra ID P1 (included in M365 E3 / Business Premium).

Do you need to enforce which device types can access company data? → You need Entra ID P1 (Conditional Access) + Intune Plan 1 (compliance policies).

Do you need to manage local admin passwords on every device? → You need Intune Plan 1 (Windows LAPS policy). Legacy LAPS (AD-only) is free.

Do you need to protect your admin accounts with just-in-time access? → You need Entra ID P2. This is the single most impactful security upgrade for most organisations.

Do you need standard users to run specific apps as admin without making them local admins? → You need Intune Plan 2 (EPM). Add-on to any existing Intune plan.

---

Summary

The most important takeaways:

• P1 gives you Conditional Access, SSPR, Dynamic Groups, and Hybrid join — the foundation for most enterprise security scenarios.
• P2 adds PIM/PAM, Identity Protection, and Access Reviews — these protect your most sensitive admin accounts and are the single most impactful upgrade for most organisations.
• Intune Plan 1 powers cloud-managed LAPS, compliance policies, and app deployment.
• Intune Plan 2 adds EPM — the answer to the "how do I stop making users local admins" problem.
• These licenses are additive. You can have P2 without Plan 2, or Plan 2 without P2 — they are separate product families.

If you are building a security roadmap: start with P1 (SSPR, Conditional Access, LAPS via Intune), then add P2 to eliminate standing admin access with PIM, and finally add Intune Plan 2 if EPM is needed.

---

Have questions about mapping these licenses to your specific environment? Drop a comment below — I am happy to help you work through the right license combination for your use case.