An add-on to Intune Plan 1 for advanced endpoint scenarios, including Microsoft Tunnel (a lightweight VPN gateway for unenrolled mobile app access), Cloud PKI certificate management, and specialty/shared device support — such as conference room equipment, large smart screens, and firmware-over-the-air updates. Built for organisations managing more complex or specialised device fleets beyond standard laptops and phones.