Deploy Windows Enterprise licenses

This article describes how to deploy Windows Enterprise E3 or E5 licenses with subscription activation or Enterprise E3 in CSP and Microsoft Entra ID.

These activation features require a supported and licensed version of Windows Pro:

Enable subscription activation with an existing EA

EA customers with an existing Microsoft 365 tenant can use the following steps to enable Windows subscription licenses on the existing tenant:

    Work with the reseller to place an order for one $0 SKU per user. As of October 1, 2022, there are three SKUs available, depending on the current Windows Enterprise SA license:

SKU Description
AAA-51069 Win OLS Activation User Alng Sub Add-on E3
AAA-51068 Win OLS Activation User Sub Add-on E5
VRM-00001 Win OLS Activation User GCC Sub Per User

Note As of October 1, 2022, subscription activation is available for commercial and GCC tenants. It's currently not available on GCC High or DoD tenants.

To update contact information and resend the activation email, use the following process:

  1. Sign in to the Microsoft Volume Licensing Service Center.
  2. Select Subscriptions.
  3. Select Online Services Agreement List.
  4. Enter the agreement number, and then select Search.
  5. Select the Service Name.
  6. In the Subscription Contact section, select the name listed under Last Name.
  7. Update the contact information, then select Update Contact Details. This action triggers a new email.

Prepare for deployment: reviewing requirements

For more information, see Review requirements on devices, later in this article.

Active Directory synchronization with Microsoft Entra ID

If there's an on-premises Active Directory Domain Services (AD DS) domain, identities in the on-premises AD DS domain need to be synchronized with Microsoft Entra ID. This synchronization is required for users to have a single identity that they can use to access their on-premises apps and cloud services that use Microsoft Entra ID. An example of a cloud service is Windows Enterprise E3 or E5.

For more information about integrating on-premises AD DS domains with Microsoft Entra ID, see the following resources:

Assign licenses to users

After the Windows subscription is ordered, an email is sent with guidance on how to use Windows as an online service. The following methods are available to assign licenses:

Explore the upgrade experience

Now that a subscription is established and licenses are assigned to users, devices running supported versions of Windows Pro can be upgraded to Enterprise edition.

This upgrade experience walkthrough assumes Autopilot isn't being used. For the Autopilot experience when joining Microsoft Entra ID, see User-driven Microsoft Entra join: Deploy the device.

Step 1: Join Windows Pro devices to Microsoft Entra ID

The first time the device starts, a Windows Pro device can join Microsoft Entra ID during setup. Existing devices can also join Microsoft Entra ID.

Join a device to Microsoft Entra ID during OOBE when the device is started for the first time

  1. Power on the device for the first time to initiate Windows Setup and the Out of Box experience (OOBE).
  2. In the Is this the right country or region? screen, select the desired country/region and then select the Yes button.
  3. In the Is this the right keyboard layout or input method? screen, select the desired keyboard/input methods and then select the Yes button.
  4. In the Want to add a second keyboard layout? screen, if desired add additional keyboard/input methods by selecting Add layout. Otherwise select the Skip button.
  5. If no network connection is detected, the Let's connect you to a network screen appears. Connect to a wireless or wired network that has Internet access, and then select the Next button.
  6. At this point, updates for Windows Setup might be installed. If updates are installed, the device reboots to finish installing the updates.
  7. In Windows 11 Pro editions, the Let's name your device screen appears. Give the device a name and then select the Next button. After the device is given a name, the device might reboot.
  8. In Windows 11 Pro editions, the How would you like to set up this device? screen appears. Select Set up for work or school and then select the Next button.
  9. In the Let's set things up for your work or school screen:
    1. In the someone@example.com text box under Sign in, enter the username for the Microsoft Entra user account, and then select the Next button. The username is in the email format of user@domain.com.
    2. In the Password text box under Enter password, enter the password for the Microsoft Entra user account, and then select the Sign in button.
    1. Power on the device for the first time to initiate Windows Setup and the Out of Box experience (OOBE).
    2. In the Let's start with region. Is this right? screen, select the desired country/region and then select the Yes button.
    3. In the Is this the right keyboard layout? screen, select the desired keyboard/input methods and then select the Yes button.
    4. In the Want to add a second keyboard layout? screen, if desired add additional keyboard/input methods by selecting the Add layout button. Otherwise select the Skip button.
    5. If no network connection is detected, the Let's connect you to a network screen appears. Connect to a wireless or wired network that has Internet access, and then select the Next button.
    6. At this point, updates for Windows Setup might be installed. If updates are installed, the device reboots to finish installing the updates.
    7. In Windows 10 Pro editions, the How would you like to set up? screen appears. Select Set up for an organization and then select the Next button.
    8. In the Sign in with Microsoft screen, in the someone@example.com text box, enter the username for the Microsoft Entra user account, and then select the Next button. The username is in the email format of user@domain.com.
    9. In the Enter your password screen, in the Password text box, enter the password for the Microsoft Entra user account, and then select the Next button.
    10. The device proceeds with the rest of the Windows setup including configuration of organization specific settings.
    11. In the Choose privacy settings for your device screen, configure privacy settings as desired. Once complete, select the Accept button.
    12. Depending on the device and the configuration of organization specific settings, additional screens might appear. For example, the Windows Hello screen might appear.

    Once Windows Setup finishes, the user is automatically signed in and the device is Microsoft Entra joined to the organization's subscription.

    Join a device to Microsoft Entra ID when the device is already set up with Windows

    Make sure that the user signing in isn't the BUILTIN/Administrator account. That user can't use the + Connect action to join a work or school account.

    Open the Accounts > Access work or school pane in the Settings app by selecting the following link:

    ms-settings:workplace
    1. Right-click on the Start menu and select Settings.
    2. In the Settings app, select Accounts in the left hand pane.
    3. In the Accounts pane, select Access work or school.

    Once the Accounts > Access work or school pane is open:

    1. In the Accounts > Access work or school pane, next to Add a work or school account, select the Connect button.
    2. In the Microsoft account window that opens:
      1. In the Set up a work or school account page, under Alternate actions:, select Join this device to Microsoft Entra ID.
      2. In the Email or phone text box of the Sign in page, enter the username for the Microsoft Entra user account, and then select the Next button. The username is in the email format of user@domain.com.
      3. In the Password text box of the Enter password page, enter the password for the Microsoft Entra user account, and then select the Sign in button.
      4. When the Make sure this is your organization window opens, confirm the information is correct and then select the Join button.
      5. The device joins the organization's Microsoft Entra ID subscription. Once complete, the You're all set! page is displayed. Select the Done button to complete the process.
      1. Right-click on the Start menu and select Settings.
      2. In the Settings app, select Accounts.
      3. In the left hand pane, select Access work or school.

      Once the Access work or school pane is open:

      1. In the Access work or school pane, select the + button next to Connect.
      2. In the Microsoft account window that opens:
        1. In the Set up a work or school account page, under Alternate actions:, select Join this device to Microsoft Entra ID.
        2. In the Email or phone text box of the Sign in page, enter the username for the Microsoft Entra user account, and then select the Next button. The username is in the email format of user@domain.com.
        3. In the Password text box of the Enter password page, enter the password for the Microsoft Entra user account, and then select the Sign in button.
        4. When the Make sure this is your organization window opens, confirm the information is correct and then select the Join button.
        5. The device joins the organization's Microsoft Entra subscription. Once complete, the You're all set! page is displayed. Select the Done button to complete the process.

        The device is now Microsoft Entra joined to the organization's subscription.

        Step 2: Pro edition activation

        Windows Pro has to be activated on the device. However, if the device is running a currently supported version of Windows, most modern devices automatically activates Windows Pro edition using the firmware-embedded activation key.

        Step 3: Sign in using Microsoft Entra account

        Once the device is joined to Microsoft Entra ID and Windows Setup/OOBE completes, the user signs in with their Microsoft Entra account. Once the user signs in with their Microsoft Entra account, the Windows Enterprise E3 or E5 license associated with the user enables Windows Enterprise edition capabilities on the device.

        Step 4: Verify that Enterprise edition is enabled

        To verify the Windows Enterprise E3 or E5 subscription:

        Open the Activation pane in the Settings app by selecting the following link:

        ms-settings:activation
        1. Right-click on the Start menu and select Settings.
        2. In the Settings app, select System in the left hand pane.
        3. In the System pane, Activation.

        Once the System > Activation pane is open:

        1. In the System > Activation pane, expand Activation state and Subscription to see full details of the activation state and status:
          1. Under Activation state, verify that Windows is activated. It should display the message: Windows is activated with a digital license
          2. Under Subscription, verify that the Windows 11 Enterprise subscription is active. It should display the message: Windows 11 Enterprise subscription is active

          Note If the Windows Enterprise subscription hasn't yet been applied, the Subscription pane isn't displayed.

          1. Right-click on the Start menu and select Settings.
          2. In the Settings app, select Update & Security.
          3. In the left hand pane, select Activation.

          Once the Activation pane is open:

          1. In the Activation pane:
            1. Next to Subscription, verify that the Windows 10 Enterprise subscription is active. It should display the message:

            Windows Enterprise 10 subscription is active

            If the Windows Enterprise subscription hasn't yet been applied, the Subscription field isn't displayed.

            1. Next to Activation, verify that Windows is activated. It should display the message:

            Windows is activated with a digital license

            A device is healthy when both the subscription and activation are active. If there are any problems with the Windows Enterprise E3 or E5 license or the activation of the license, the Activation pane displays the appropriate error message or status. This information can be used to help diagnose the licensing and activation process.

            Verify that Enterprise edition is enabled with slmgr

            Slmgr can also be used to verify the activation information:

            1. Open a command prompt.
            2. To get basic licensing information, run the following command at the command prompt:

            slmgr /dli
            A window with output similar to the following opens: 
            Name: Windows(R), Professional edition Description: Windows(R) Operating System, RETAIL channel Partial Product Key: 3V66T License Status: Licensed

            To instead get detailed licensing information, run the following command:

            slmgr /dlv

            Troubleshoot the user experience

            In some instances, users might experience problems with activation of the Windows Enterprise E3 or E5 subscription. The most common problems that users might experience are the following issues:

            • The Windows Enterprise E3 or E5 subscription has lapsed, was removed, or isn't applied.
            • Windows Pro was never activated.

            When there are problems with Windows Enterprise E3 or E5 subscription activation, the following are errors can occur in the Activation pane:

            • Windows Pro isn't activated When Windows Pro isn't activated on a device, the following message is displayed for Activation in the Activation pane: Windows is not activated Additionally, the following message might be displayed: We can't activate Windows on this device right now. You can try activating again later or go to the Store to buy genuine Windows. Error code: 0xC004F034. Examples where this problem can occur include:
              • The device doesn't have a firmware-embedded activation key.
              • The starting edition of Windows wasn't Windows Pro. For example, the starting edition of Windows was Windows Home.

              In these cases, a Windows Pro key might need to be manually entered.

              Note If the Windows Enterprise subscription has never been applied, the Subscription pane isn't displayed.

              Note If the Windows Enterprise subscription has never been applied, the Subscription field isn't displayed.

              Review requirements on devices

              When there are Windows Enterprise E3 or E5 license activation issues on a device, verify that it meets all of the requirements:

              • Devices must be running a currently supported version of Windows Pro. Versions of Windows Pro that are out support don't support this feature.
              • Devices must be joined to Microsoft Entra ID, or hybrid domain joined with Microsoft Entra Connect. Customers who are federated with Microsoft Entra ID are also eligible.
              • For automatic activation of Windows Pro, the device must have a firmware-embedded activation key.

              Use the following guides to verify each one of these requirements:

              • Determine if the version of Windows is currently supported. To determine if the version of Windows is currently supported:
              • Open a command prompt
              • In the command prompt window, enter:

              winver.exe
              • Windows 11 release information.
              • Windows 10 release information.

              Determine if a device is Microsoft Entra joined.

              To determine if a device is Microsoft Entra joined:

              1. Open a command prompt.
              2. In the command prompt window, enter:

              dsregcmd.exe /status 
              +----------------------------------------------------------------------+ | Device State | +----------------------------------------------------------------------+ AzureAdJoined : YES EnterpriseJoined : NO DomainJoined : NO Virtual Desktop : NOT SET Device Name : Demo-PC 
              (Get-CimInstance -query 'select * from SoftwareLicensingService').OA3xOriginalProductKey

              Recommended practices

              Adding Conditional Access policy

              When a device has been offline for an extended period of time, the Subscription Activation might not reactivate automatically on the device. To resolve this issue, use Conditional Access policies to control access by excluding one of the following cloud apps from their Conditional Access policies using Select Excluded Cloud Apps:

              Note The Microsoft Store for Business and Microsoft Store for Education are retired. For more information, see Microsoft Store for Business and Education retiring March 31, 2023.

              Although the app ID is the same in both instances, the name of the cloud app depends on the tenant.

              For more information about configuring exclusions in Conditional Access policies, see Application exclusions.

              Setting this Conditional Access policy ensures that Subscription Activation continues to work seamlessly.

              Starting with Windows 11, version 23H2 with KB5034848 or later, users are prompted for authentication with a toast notification when Subscription Activation needs to reactivate. The toast notification will show the following message:

              Your account requires authentication

              Please sign in to your work or school account to verify your information.

              Additionally, in the Activation pane, the following message might appear:

              Please sign in to your work or school account to verify your information.

              The prompt for authentication usually occurs when a device has been offline for an extended period of time. This change eliminates the need for an exclusion in the Conditional Access policy for Windows 11, version 23H2 with KB5034848 or later. A Conditional Access policy can still be used with Windows 11, version 23H2 with KB5034848 or later if the prompt for user authentication via a toast notification isn't desired.

              Make sure Windows Update isn't blocked

              If a device isn't able to connect to Windows Update, it can lose activation status or be blocked from upgrading to Windows Enterprise. Make sure that Windows Update isn't blocked on the device:

                Using gpedit.msc or group policy editor in the domain, make sure that the following group policy setting is set to Disabled or Not Configured:

              Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Server Update Service > Do not connect to any Windows Update Internet locations

              Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not connect to any Windows Update Internet locations

              reg.exe add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v DoNotConnectToWindowsUpdateInternetLocations /t REG_DWORD /d 1 /f

              Note Make sure to first check the group policy of Do not connect to any Windows Update Internet locations. If the policy is Enabled, then this registry key will eventually be reset back to 1 even after it's manually set to 0 via reg.exe . Setting the policy of Do not connect to any Windows Update Internet locations to Disabled or Not Configured will make sure the registry value remains as 0 .

              Delay in the activation of Enterprise license of Windows

              There might be a delay in the activation of the Enterprise license in Windows. This delay is by design. Windows uses a built-in cache when determining upgrade eligibility. This behavior includes processing responses that indicate that the device isn't eligible for an upgrade. It can take up to four days after a qualifying purchase before the upgrade eligibility is enabled and the cache expires.

              Virtual Desktop Access (VDA)

              Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Azure or in another qualified multitenant host.

              Virtual machines (VMs) must be configured to enable Windows Enterprise subscriptions for VDA. Active Directory-joined and Microsoft Entra joined clients are supported. For more information, see Enable VDA for Enterprise subscription activation.

              Related content

              • Windows subscription activation.
              • MDM enrollment of Windows devices.