🚀 Overview: Device-Based Licensing for Microsoft 365 Apps

For organizations managing shared workstations—such as those in computer labs, clinics, or manufacturing floors—Microsoft 365 Apps for enterprise offers a device-based licensing model. Unlike traditional user-based subscriptions where the license follows the identity, this model ties the license directly to the physical hardware. This ensures that any user who signs into a specific, authorized device can access the full suite of Office applications without requiring an individual per-user license.

While this streamlines management for shared environments, it requires specific configuration within Microsoft Entra ID and the Microsoft 365 Apps admin center. Troubleshooting these deployments involves verifying hardware identity, ensuring proper group synchronization, and managing the transition from previous activation states like Shared Computer Activation (SCA).

⚙️ Key Technical Details

• Licensing Verification: To confirm a device is correctly licensed, navigate to File > Account within any Office application (e.g., Word). Under the Product Information section, the application should explicitly state Belongs to: This device.
• Administrative Monitoring: IT Admins can track deployment health and identify failed activations by visiting the Microsoft 365 Apps admin center. Navigate to Health > Licensing to view a detailed list of devices that have encountered activation errors.
• Microsoft Entra ID Requirements: For a device to receive a license, it must be properly joined to Microsoft Entra ID (formerly Azure AD). Admins should verify the Join Type in the Azure Portal under Microsoft Entra ID > Devices. If a device is missing, users must manually join via Settings > Accounts > Access work or school > Connect.
• The 90-Day Heartbeat: Device-based licenses operate on a 90-day cycle. While constant internet connectivity isn’t mandatory, the device must communicate with the Office Licensing Service periodically to renew its status. If the service is unreachable for an extended period, the license will expire.
• Diagnostic Scripting: Admins can verify the local activation state by executing the PowerShell script vnextdiag.ps1, which is located in the following directory:
  
  C:\Program Files\Microsoft Office\Office16.
• Proxy Configurations: If your environment utilizes a proxy, ensure the SYSTEM account is configured to bypass or authenticate through it. While user-level proxy settings may be correct, the licensing service runs under the SYSTEM context. Use the BITSAdmin tool to apply these configurations.

🛡️ Impact on Users and Administrators

⚠️ Reduced Functionality Mode: If the device fails to authenticate its license, Microsoft 365 Apps will enter a “Reduced Functionality” state. In this mode, users can open and print existing documents, but they are strictly prohibited from creating new files, editing existing ones, or saving changes.

📅 Error Messaging and Resolution:

• “LICENSE REQUIRED”: This banner typically appears if the device is not a member of the Entra ID group assigned the Office licenses. Note that there is often a synchronization delay of approximately one hour after adding a device to a group before the license becomes active.
• “CAN’T VERIFY LICENSE”: This warning usually surfaces 10 days before the 90-day license period expires. It indicates the device cannot reach the Office Licensing Service over the internet due to firewall restrictions or network configuration issues.

🖥️ Remote Desktop Services (RDS) Considerations:
Device-based licensing is fully compatible with RDS environments. However, admins must ensure the number of licenses purchased matches the number of unique clients connecting to the RDS server. Because this model does not support license token roaming, a recommended best practice is to deploy a startup script that launches an Office application (like Word or Excel) upon device boot to trigger the license acquisition silently.

🔄 Transitioning Existing Deployments:
If a machine was previously activated via user-based subscriptions or Shared Computer Activation (SCA), the previous license state must be purged. Administrators should use the official “Reset activation state for Microsoft 365 Apps for enterprise” methodology to ensure a clean transition to device-based licensing.

---

Official Source: Read the full article on Microsoft.com