Intune licensing India: what a 250-seat Pune fintech actually pays per seat
The CFO asked which Microsoft 365 plan is cheapest. That is not actually the question. The question is which plan each role on the floor actually needs, and where the company-wide flat rate is paying for capability that ninety of the two hundred and fifty seats will never touch.
This is the call we had with a 250-seat Pune fintech last week. The IT head, Ritika, had the renewal quote in her inbox on a Monday morning. The CFO, Vivek, had a budget meeting on Wednesday. They asked me to sit on the renewal conversation with the Microsoft partner. What follows is the math we walked through.
The flat Business Premium quote on the table
The partner had quoted Business Premium for all 250 seats. Flat. One SKU, one price, one renewal date. On paper this is the clean answer. Business Premium covers Intune for device management, Defender for Business for endpoint protection, Azure AD P1 for conditional access, and Information Protection P1 for label-based DLP. For a company that wants one plan and one invoice, it is a defensible choice.
Vivek read the line item and asked the only question that matters at renewal. “Do all two hundred and fifty seats need this, or is some of this capability landing on people who will never open the Intune portal?”
Ritika’s answer was honest. She had not done the per-role split. Nobody had asked her to. The previous renewal was Business Premium flat, the renewal before that was Business Premium flat, and the partner had quoted the same shape because nobody had pushed back. Achha, said Vivek. That is the problem we are solving today.
Need this same per-role licensing audit on your M365 estate? We sit on the renewal call, do the SKU mapping by role, and give you the math your partner will not volunteer. Response within 24 working hours.
200+ Indian businesses use Sirius Star for M365 and Intune renewals.
Three buckets of users, three different SKUs
We split the 250 seats into three groups on a whiteboard. Ninety were operations, customer support, and field collections. One hundred and thirty were back-office knowledge workers, including marketing, product, and admin. Thirty were senior management, finance, and the engineering team that touches the production code.
Each bucket has a different licensing fit. The ops bucket runs mostly on shared kiosks and personal phones with limited desktop time. The middle bucket lives in Outlook, Excel, and Teams all day. The seniors and engineers handle financial models and code repositories that the company actually cannot afford to leak.
The Microsoft SKU library has a tier for each. The trick is reading the small print. F3 frontline includes Intune for mobile and a web-only Office experience. Business Premium covers the standard knowledge-worker stack. E3 unlocks Azure AD P1 plus broader compliance. E5 adds Defender for Endpoint P2 and the rest of the Purview suite, which most fintechs do not need on every seat.
The frontline tier question
F3 looks like a steal on paper. The per-seat number for frontline is a fraction of what Business Premium costs. For 90 operations and support staff, the saving on flat-rate maths to roughly seven figures a year. So the obvious move is to drop them to F3 and pocket the difference.
The catch sits in the Intune scope. F3 gives you Intune for mobile devices and shared Windows 10 Enterprise in kiosk mode. It does not give you full desktop policy on a primary laptop that the user owns. If your ops staff each have a company-issued laptop they sign into every morning, F3 is the wrong SKU. You will pay the headline rate, then discover the conditional-access policy you wanted does not apply, and the team will quietly slide back to Business Premium six months later anyway.
Vivek asked the question I was waiting for. “Matlab, we save on 90 seats but the policy breaks if we go F3?” Yes, I said, if those 90 seats use personal-issued laptops. If they share kiosks and use mobile for everything else, F3 holds. The Pune ops team turned out to be roughly forty kiosk plus mobile, fifty personal laptops. Forty seats to F3, fifty staying on Business Premium. Bas, the saving was smaller than the flat-F3 scenario but defensible.
Why Business Premium is still the middle-tier answer
For the 130 knowledge workers, Business Premium does the job and the math works. The per-seat number is higher than F3, but the bundle of Intune plus Defender for Business plus AAD P1 plus Information Protection makes sense at this tier. The other option is buying these as standalone subscriptions on a cheaper base SKU, and the per-month delta is almost always worse once you add three or four add-ons.
One footnote the partner had not flagged. Business Premium has a 300-seat cap. The Pune company had 250 today and a growth plan that put them past 300 by next March. If they signed a three-year Business Premium for the middle tier, they would have to migrate that block to E3 mid-contract. Better to write a two-year on Business Premium with a clean break clause, or move the middle tier to E3 now and lock the rate. We chose the two-year break clause.
The E3 / E5 decision for the seniors and engineers
The 30 senior management plus finance plus engineering seats were where the call got interesting. Standard advice is E3 for this tier. It adds the broader compliance and AAD P1 plus longer audit log retention. For a finance team running quarterly board decks, E3 is the right shape.
Then I asked Ritika how the engineering team accessed GitHub. The answer was personal access tokens on company laptops, sometimes the same laptops used for personal email. I came into this call thinking E3 for the engineers. Looking at how those PATs sit on those laptops, I changed my mind. Twelve of those thirty seats needed Defender for Endpoint Plan 2, which means either E5 for those twelve or a P2 add-on bolted onto E3.
The P2 add-on is cheaper than the E5 jump. We bolted it on. Pakka, said Vivek, and that was the call closed on the engineering risk.
What you actually pay, in one table
| Role bucket | Seats | SKU we landed on | Why |
|---|---|---|---|
| Frontline ops (kiosk + mobile) | 40 | F3 | No personal laptop, web Office sufficient |
| Frontline ops (laptop-issued) | 50 | Business Premium | Desktop conditional access required |
| Knowledge workers | 130 | Business Premium (2-year, break clause) | Bundle is cheaper than base plus add-ons |
| Senior + finance | 18 | E3 | Audit retention, AAD P1 on this tier |
| Engineering (GitHub PAT exposure) | 12 | E3 + Defender for Endpoint P2 add-on | Real risk, no need to lift the rest of the team to E5 |
The flat-Business-Premium plan came in around the figure the partner quoted. The role-mix plan came in roughly thirteen and a half lakh a year cheaper, without losing any of the capability the seniors and engineers actually needed. Two-year horizon, the saving covers a hardware refresh on the engineering team.
Sitting on a renewal quote that looks too round? Send us the quote and your role split. We will do the same SKU mapping for your estate and tell you where the avoidable spend sits.
Free 4-hour renewal audit. No card, no contract, no sales call.
One thing to watch on Intune licensing India in 2026
Microsoft has a habit of shifting per-user SKUs every March price book. The frontline tier rules in particular moved in 2024, and a quiet F1-to-F3 rename caught a few Indian companies out. If your partner will write multi-year price-lock language, take it. If they will not, hold the renewal to twelve months and revisit. The number you sign today is not the number you will pay in eighteen months unless the contract says so.
Two other small things worth knowing. The new-commerce-experience monthly billing carries a small premium versus the annual term. Most CFOs miss this until the first invoice. And the Defender for Endpoint add-on is licensed per seat, not per device, so a single user with three devices still pays one add-on rate. We talk through the rest of these footnotes when we do an Intune India pricing review with a client.
Where this fits in the broader Cloud and DLM picture
Intune licensing is one knob on the device-management estate. The other knobs are the MDM you actually run on the devices, the hardware refresh cycle, and the conditional-access policy your CISO will actually enforce. We have written separately on the Hexnode vs Intune bake-off for field teams, which is the question that comes up right after this one, and on the device refresh policy memo a Bengaluru CFO ran with his board. Both are siblings to this conversation.
The full Microsoft cloud and M365 hub covers the wider Sirius Star approach to renewals, role-mix licensing, and the partner discount you should be asking for. We resell Microsoft and support the deployment; we are not on a quota that rewards us for over-licensing a customer.
Renewal sitting on your desk? Send Ritika’s three buckets exercise to your IT head. If the answer is “we have not split the seats by role,” that is your saving. We sit on the call with you.
Reach us on WhatsApp at +91 91375 93228 during 10-7 IST.
P.S. Karthik here. We ran this exact exercise for a Mumbai NBFC last quarter and the saving was closer to nineteen lakh a year because the field-collections team had been on Business Premium for two cycles. The split takes one afternoon. The renewal saves you that on the first invoice. Reply on WhatsApp and we will block thirty minutes on Thursday.
