Device-based licensing for Microsoft 365 Apps for enterprise

Commercial customers can use Microsoft 365 Apps for enterprise (device) to assign a Microsoft 365 Apps for enterprise license to a Windows client device instead of to a user. Education customers can do the same thing by using the Microsoft 365 Apps for Education (device) license. This device-based license is designed to simplify management of Microsoft 365 Apps for enterprise on devices shared by many users. Anyone that signs in and uses that device can use Microsoft 365 Apps for enterprise to create and edit documents.

Requirements for using device-based licensing for Microsoft 365 Apps for enterprise

The following are the requirements for device-based licensing for Microsoft 365 Apps for enterprise:

• Version 1907 or later of Microsoft 365 Apps for enterprise.
• Microsoft 365 Apps for enterprise must be installed on a device running a supported version of Windows 11, Windows 10 General Availability Channel, Windows Server 2022, or Windows Server 2019.
• The Windows client device on which Microsoft 365 Apps for enterprise is installed must be Microsoft Entra joined or Microsoft Entra hybrid joined.

To verify that Microsoft 365 Apps for enterprise and the Windows client device meet these requirements, do the following steps:

• On the Windows client device, open an Office application, such as Word, and go to File > Account. The version number of Microsoft 365 Apps for enterprise that is installed on the device appears in the About section of the Product Information section.

• On the Windows client device, from the Start menu or a command prompt, type winver and then hit Enter. The About Windows dialog appears and lists the version of Windows client.

• Sign in to the Microsoft Azure and go to Microsoft Entra ID > Devices. The type of join for your Windows client device is listed in the Join Type column.

  If the Windows client device doesn't appear, sign in to the Windows client device. Then go to Settings > Accounts > Access work or school, choose Connect, and follow the steps to join the device to either Microsoft Entra ID or to a local Active Directory domain.

Steps to configure device-based licensing for Microsoft 365 Apps for enterprise

After you verify that your Windows client devices and Microsoft 365 Apps for enterprise installations meet the specified requirements, you need to do the following tasks:

• Add the Windows client devices to a group that's available in Microsoft Entra ID.
• Assign the appropriate licenses to that group by signing into the Microsoft 365 admin center and going to Billing > Licenses. You can't assign the licenses in the Azure portal.
• Configure Microsoft 365 Apps for enterprise to use device-based licensing instead of user-based licensing.

Add Windows client devices to a group in Microsoft Entra ID and assign that group licenses

To configure device-based licensing, you first need to add your Windows client devices to a group that's available in Microsoft Entra ID. The following table provides information about the types of groups that are supported and where you can create those groups.

For more information about Azure group management, see the following articles:

• Create a basic group and add members using Microsoft Entra ID
• Create a dynamic group and check status
• Microsoft Entra Connect Sync: Understand and customize synchronization

After you create the appropriate group type and assigned the appropriate Windows client devices to the group, you need to assign licenses to that group. For the steps on how to do that, see Manage licenses for devices. You can assign licenses to only one group, but you can nest groups within that one group.

Configure Microsoft 365 Apps for enterprise to use device-based licensing

After you assign licenses to the group in Microsoft Entra ID that contains your Windows client devices, you need to configure Microsoft 365 Apps for enterprise to use device-based licensing instead of user-based licensing. You can do that by using either of the following methods:

• The Office Deployment Tool and the DeviceBasedLicensing setting.
• Group Policy and the "Use a device-based license for Microsoft 365 Apps for enterprise" policy setting

Using the Office Deployment Tool

If you use the Office Deployment Tool to install or configure Microsoft 365 Apps for enterprise, you want to add the following line to your configuration.xml file:

For more information about using the Office Deployment Tool and the configuration options that it supports, see the following articles:

• Overview of the Office Deployment Tool
• Configuration options for the Office Deployment Tool

Using Microsoft Intune

The required policy can be set through a Configuration Profile in Microsoft Intune.

• Navigate to Devices > Configuration Profiles
• Create a new profile, select Windows 10 or later as the platform and Settings Catalog as the profile type.
• Navigate to Microsoft Office 2016 (Machine) > Licensing Settings and select the Use a device-based license for Office 365 ProPlus policy.
• Enable the policy and assign it to group that contains the targeted devices.

Using Group Policy

If you use Group Policy to configure Microsoft 365 Apps for enterprise settings, you can enable the "Use a device-based license for Microsoft 365 Apps for enterprise" policy setting. This policy setting can be found under Computer Configuration\Policies\Administrative Templates\Microsoft Office 2016 (Machine)\Licensing Settings.

Troubleshoot device-based licensing for Microsoft 365 Apps for enterprise

You can view device licensing status by signing in to the Microsoft 365 Apps admin center and going to Health > Licensing. That page shows devices that failed to activate with a device license.

You can also verify that Microsoft 365 Apps for enterprise is using a device-based license by opening an Office application, such as Word, and going to File > Account. In the Product Information section, you should see Belongs to: This device.

A device not configured properly for device-based licensing impacts functionality. When a user tries to use Microsoft 365 Apps for enterprise on the device, Microsoft 365 is in reduced functionality mode. That means the user can open and print existing documents in Office applications, but the user can't create new documents or edit and save existing documents.

In those cases, the user also sees a banner beneath the ribbon in the document with the following message:

LICENSE REQUIRED Your admin needs to assign an Office license to this device so you can edit your files.

Ensure that the device is joined to Microsoft Entra ID and added to the group assigned to the licenses. There could be a delay of up to one hour after adding the device to the group, which could cause this message to appear. Close and reopen the app later to resolve the issue.

In other cases, the user might see this message:

CAN'T VERIFY LICENSE We're having trouble verifying the Office license for this device.

In this case, the device is having problems contacting the Office Licensing Service on the internet. Office tries to contact the Office Licensing Service to ensure the device is properly licensed and to automatically renew a license that is about to expire. A device-based license is set to expire in 90 days, so the device doesn't have to access to internet constantly. The CAN'T VERIFY LICENSE message usually appears about 10 days before the license is about to expire.

Transition from subscription licensing or shared computer activation to device-based licensing

If Microsoft 365 Apps are installed and activated with user-based subscription licensing or shared computer activation, reset the license state on the device before switching to device-based licensing. To reset the activation state, see Reset Microsoft 365 Apps for enterprise activation state.

Make sure the device has access to the internet or that your firewall isn't preventing access to the Office licensing service. For more information about firewall settings, see Office 365 URLs and IP address ranges.