deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-18 03:43:39 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge branch 'main' into ap-reliability-report-022624

Browse Source
This commit is contained in:
Tiara Quan
2024-03-11 09:03:23 -07:00
committed by GitHub
parent 80f3d7cf9a dbda201328
commit a6b1cccbc0
210 changed files with 2225 additions and 18090 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
windows/deployment/TOC.yml
View File

@ -386,6 +386,8 @@
href: /windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json
- name: Additional Windows Update settings
href: update/waas-wu-settings.md
- name: Update other Microsoft products
href: update/update-other-microsoft-products.md
- name: Delivery Optimization reference
href: do/waas-delivery-optimization-reference.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json
- name: Windows client in S mode

127
windows/deployment/deploy-enterprise-licenses.md
View File

@ -11,7 +11,7 @@ ms.topic: how-to
ms.collection:
- highpri
- tier2
ms.date: 02/13/2024
ms.date: 03/04/2024
zone_pivot_groups: windows-versions-11-10
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
@ -65,7 +65,7 @@ To update contact information and resend the activation email, use the following
1. Update the contact information, then select **Update Contact Details**. This action triggers a new email.
## Preparing for deployment: reviewing requirements
## Prepare for deployment: reviewing requirements
- Devices must be running a supported version of Windows Pro.
- Microsoft Entra joined, or hybrid domain joined with Microsoft Entra Connect. Customers who are federated with Microsoft Entra ID are also eligible.
@ -82,7 +82,7 @@ For more information about integrating on-premises AD DS domains with Microsoft
- [What is hybrid identity with Microsoft Entra ID?](/azure/active-directory/hybrid/whatis-hybrid-identity)
- [Microsoft Entra Connect and Microsoft Entra Connect Health installation roadmap](/azure/active-directory/hybrid/how-to-connect-install-roadmap)
## Assigning licenses to users
## Assign licenses to users
After the Windows subscription is ordered, an email is sent with guidance on how to use Windows as an online service. The following methods are available to assign licenses:
@ -292,15 +292,15 @@ Once the **System > Activation** pane is open:
1. Under **Activation state**, verify that Windows is activated. It should display the message:
`Windows is activated with a digital license`
`Windows is activated with a digital license`
1. Under **Subscription**, verify that the Windows 11 Enterprise subscription is active. It should display the message:
`Windows 11 Enterprise subscription is active`
`Windows 11 Enterprise subscription is active`
> [!NOTE]
>
> If the Windows Enterprise subscription hasn't yet been applied, the **Subscription** pane isn't displayed.
> [!NOTE]
>
> If the Windows Enterprise subscription hasn't yet been applied, the **Subscription** pane isn't displayed.
::: zone-end
@ -340,24 +340,24 @@ A device is healthy when both the subscription and activation are active. If the
1. To get basic licensing information, run the following command at the command prompt:
```cmd
slmgr /dli
```
```cmd
slmgr /dli
```
A window with output similar to the following opens:
A window with output similar to the following opens:
```console
Name: Windows(R), Professional edition
Description: Windows(R) Operating System, RETAIL channel
Partial Product Key: 3V66T
License Status: Licensed
```
```console
Name: Windows(R), Professional edition
Description: Windows(R) Operating System, RETAIL channel
Partial Product Key: 3V66T
License Status: Licensed
```
To instead get detailed licensing information, run the following command:
To instead get detailed licensing information, run the following command:
```cmd
slmgr /dlv
```
```cmd
slmgr /dlv
```
For more information on **Slmgr**, see [Slmgr.vbs options for obtaining volume activation information](/windows-server/get-started/activation-slmgr-vbs-options).
@ -368,11 +368,11 @@ In some instances, users might experience problems with activation of the Window
- The Windows Enterprise E3 or E5 subscription has lapsed, was removed, or isn't applied.
- Windows Pro was never activated.
When there are problems with Windows Enterprise E3 or E5 subscription activation, the following are errors can occur in the [Activation](ms-settings:activation) pane:
When there are problems with Windows Enterprise E3 or E5 subscription activation, the following are errors can occur in the [**Activation**](ms-settings:activation) pane:
- **Windows Pro isn't activated**
When Windows Pro isn't activated on a device, the following message is displayed for **Activation** in the [Activation](ms-settings:activation) pane:
When Windows Pro isn't activated on a device, the following message is displayed for **Activation** in the [**Activation**](ms-settings:activation) pane:
`Windows is not activated`
@ -389,7 +389,7 @@ When there are problems with Windows Enterprise E3 or E5 subscription activation
- **Windows Enterprise subscription isn't active**
When a device with a Windows Enterprise subscription has lapsed or has been removed, the following message is displayed for **Subscription** in the [Activation](ms-settings:activation) pane:
When a device with a Windows Enterprise subscription has lapsed or has been removed, the following message is displayed for **Subscription** in the [**Activation**](ms-settings:activation) pane:
`Windows Enterprise subscription isn't valid.`
@ -482,45 +482,75 @@ Use the following guides to verify each one of these requirements:
- **Make sure the Microsoft Entra user has been assigned a license**.
For more information, see [Assigning licenses to users](#assigning-licenses-to-users).
For more information, see [Assigning licenses to users](#assign-licenses-to-users).
## Known issues
## Recommended practices
- If a device isn't able to connect to Windows Update, it can lose activation status or be blocked from upgrading to Windows Enterprise. Make sure that Windows Update isn't blocked on the device:
### Adding Conditional Access policy
- Using `gpedit.msc` or group policy editor in the domain, make sure that the following group policy setting is set to **Disabled** or **Not Configured**:
When a device has been offline for an extended period of time, the Subscription Activation might not reactivate automatically on the device. To resolve this issue, use Conditional Access policies to control access by excluding one of the following cloud apps from their Conditional Access policies using **Select Excluded Cloud Apps**:
::: zone pivot="windows-11"
- [Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications).
**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Manage updates offered from Windows Server Update Service** > **Do not connect to any Windows Update Internet locations**
- [Windows Store for Business, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications).
::: zone-end
Although the app ID is the same in both instances, the name of the cloud app depends on the tenant.
::: zone pivot="windows-10"
For more information about configuring exclusions in Conditional Access policies, see [Application exclusions](/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa#application-exclusions).
**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Do not connect to any Windows Update Internet locations**
<!-- 8605089 -->
::: zone-end
Setting this Conditional Access policy ensures that Subscription Activation continues to work seamlessly.
If this policy is set to **Enabled**, it must be changed to **Disabled** or **Not Configured**.
Starting with Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later, users are prompted for authentication with a toast notification when Subscription Activation needs to reactivate. The toast notification will show the following message:
- In the following registry key:
> **Your account requires authentication**
>
> **Please sign in to your work or school account to verify your information.**
`HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate`
Additionally, in the [**Activation**](ms-settings:activation) pane, the following message might appear:
check if the value `DoNotConnectToWindowsUpdateInternetLocations` exists. If the value does exist, verify that it has a REG_DWORD value of `0`. If the value is instead set to `1`, it must be changed to `0`. The value can be changed by running the following command from an elevated command prompt:
> **Please sign in to your work or school account to verify your information.**
```cmd
reg.exe add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v DoNotConnectToWindowsUpdateInternetLocations /t REG_DWORD /d 1 /f
```
The prompt for authentication usually occurs when a device has been offline for an extended period of time. This change eliminates the need for an exclusion in the Conditional Access policy for Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later. A Conditional Access policy can still be used with Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later if the prompt for user authentication via a toast notification isn't desired.
> [!NOTE]
>
> Make sure to first check the group policy of **Do not connect to any Windows Update Internet locations**. If the policy is **Enabled**, then this registry key will eventually be reset back to `1` even after it's manually set to `0` via `reg.exe`. Setting the policy of **Do not connect to any Windows Update Internet locations** to **Disabled** or **Not Configured** will make sure the registry value remains as `0`.
### Make sure Windows Update isn't blocked
- Delay in the activation of Enterprise license of Windows.
If a device isn't able to connect to Windows Update, it can lose activation status or be blocked from upgrading to Windows Enterprise. Make sure that Windows Update isn't blocked on the device:
There might be a delay in the activation of the Enterprise license in Windows. This delay is by design. Windows uses a built-in cache when determining upgrade eligibility. This behavior includes processing responses that indicate that the device isn't eligible for an upgrade. It can take up to four days after a qualifying purchase before the upgrade eligibility is enabled and the cache expires.
- Using `gpedit.msc` or group policy editor in the domain, make sure that the following group policy setting is set to **Disabled** or **Not Configured**:
::: zone pivot="windows-11"
**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Manage updates offered from Windows Server Update Service** > **Do not connect to any Windows Update Internet locations**
::: zone-end
::: zone pivot="windows-10"
**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Do not connect to any Windows Update Internet locations**
::: zone-end
If this policy is set to **Enabled**, it must be changed to **Disabled** or **Not Configured**.
- In the following registry key of the registry:
`HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate`
check if the value `DoNotConnectToWindowsUpdateInternetLocations` exists. If the value does exist, verify that it has a REG_DWORD value of `0`. If the value is instead set to `1`, it must be changed to `0`. The value can be changed by running the following command from an elevated command prompt:
```cmd
reg.exe add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /v DoNotConnectToWindowsUpdateInternetLocations /t REG_DWORD /d 1 /f
```
> [!NOTE]
>
> Make sure to first check the group policy of **Do not connect to any Windows Update Internet locations**. If the policy is **Enabled**, then this registry key will eventually be reset back to `1` even after it's manually set to `0` via `reg.exe`. Setting the policy of **Do not connect to any Windows Update Internet locations** to **Disabled** or **Not Configured** will make sure the registry value remains as `0`.
### Delay in the activation of Enterprise license of Windows
There might be a delay in the activation of the Enterprise license in Windows. This delay is by design. Windows uses a built-in cache when determining upgrade eligibility. This behavior includes processing responses that indicate that the device isn't eligible for an upgrade. It can take up to four days after a qualifying purchase before the upgrade eligibility is enabled and the cache expires.
## Virtual Desktop Access (VDA)
@ -528,6 +558,7 @@ Subscriptions to Windows Enterprise are also available for virtualized clients.
Virtual machines (VMs) must be configured to enable Windows Enterprise subscriptions for VDA. Active Directory-joined and Microsoft Entra joined clients are supported. For more information, see [Enable VDA for Enterprise subscription activation](vda-subscription-activation.md).
## Related articles
## Related content
- [Windows subscription activation](windows-subscription-activation.md).
- [MDM enrollment of Windows devices](/windows/client-management/mdm-enrollment-of-windows-devices).

21
windows/deployment/docfx.json
View File

@ -51,18 +51,17 @@
},
"titleSuffix": "Windows Deployment",
"contributors_to_exclude": [
"rjagiewich",
"traya1",
"rmca14",
"claydetels19",
"jborsecnik",
"tiburd",
"garycentric",
"beccarobins",
"Stacyrch140",
"v-stsavell",
"dstrome2",
"rjagiewich",
"American-Dipper",
"shdyas"
"claydetels19",
"jborsecnik",
"v-stchambers",
"shdyas",
"Stacyrch140",
"garycentric",
"dstrome",
"alekyaj"
],
"searchScope": [
"Windows 10"

76
windows/deployment/update/update-other-microsoft-products.md Normal file
View File

@ -0,0 +1,76 @@
---
title: Update other Microsoft products
titleSuffix: Windows Update for Business
description: List of other Microsoft products that are updated when install updates for other Microsoft products (allowmuupdateservice) is used.
ms.service: windows-client
ms.subservice: itpro-updates
ms.topic: reference
author: mestew
ms.author: mstewart
manager: aaroncz
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
ms.date: 02/27/2024
---
# Update other Microsoft products
<!--8743531-->
This article contains a list of other Microsoft products that might be updated when the following policy is used:
- **Group policy**: Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\Configure Automatic Updates
- `Install updates for other Microsoft products` element under Configure Automatic Updates
- **MDM**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowMUUpdateService](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowmuupdateservice)
> [!Note]
> This policy includes drivers. If you need to exclude drivers, use [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update&bc=/windows/deployment/breadcrumb/toc.json#excludewudriversinqualityupdate).
## List of other Microsoft products
The following is a list of other Microsoft products that might be updated:
- Active Directory Rights Management Service
- AppFabric
- Azure File Sync
- Bing Bar
- Bing IME
- BizTalk
- East Asia IME for Windows Content
- Exchange
- IME Dictionary Update
- Live Search
- MED-V
- Microsoft Advanced Threat Analytics
- Microsoft Application Virtualization
- Microsoft Azure StorSimple
- Microsoft Dynamics CRM
- Microsoft Information Protection
- Microsoft Lync Server and Microsoft Lync
- Microsoft Monitoring Agent
- Microsoft SRS Device
- Microsoft StreamInsight
- Mobile and IoT
- MSRC
- Office 2016 (MSI versions of Office)
- PlayReady
- Windows Admin Center
- Silverlight
- Skype for Business
- SQL
- System Center Application Controller
- System Center Configuration Manager
- System Center Data Protection Manager
- System Center Operations Manager
- System Center Orchestrator
- System Center Virtual Machine Manager
- Visual Studio
- Windows Azure Hyper-V Recovery Manager
- Windows Azure Pack - Web Sites
- Windows Azure Pack
- Windows Azure Service Bus
- Windows Embedded Developer Update
- Windows Intune
- Windows Live Sign-in Assistant
- Windows Small Business Server
- Zune

4
windows/deployment/update/waas-configure-wufb.md
View File

@ -16,7 +16,7 @@ appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
ms.date: 11/30/2023
ms.date: 02/27/2024
---
# Configure Windows Update for Business
@ -127,7 +127,7 @@ Starting with Windows 10, version 1703, using Settings to control the pause beha
Quality updates are typically published on the second Tuesday of every month, although they can be released at any time. You can define if, and for how long, you would like to defer receiving quality updates following their availability. You can defer receiving these quality updates for a period of up to 30 days from their release by setting the **DeferQualityUpdatesPeriodinDays** value.
You can set your system to receive updates for other Microsoft products—known as Microsoft updates (such as Microsoft Office, Visual Studio)—along with Windows updates by setting the **AllowMUUpdateService** policy. When you do this, these Microsoft updates will follow the same deferral and pause rules as all other quality updates.
You can set your system to receive updates for other Microsoft products—known as Microsoft updates (such as Microsoft Office, Visual Studio)—along with Windows updates by setting the **AllowMUUpdateService** policy. When you do this, these Microsoft updates will follow the same deferral and pause rules as all other quality updates. For a list of other Microsoft products that might be updated, see [Update other Microsoft products](update-other-microsoft-products.md).
**Policy settings for deferring quality updates**

3
windows/deployment/update/waas-integrate-wufb.md
View File

@ -11,7 +11,7 @@ ms.localizationpriority: medium
appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
ms.date: 12/31/2017
ms.date: 02/27/2024
---
# Integrate Windows Update for Business with management solutions
@ -68,6 +68,7 @@ For Windows 10, version 1607 and later, devices can be configured to receive upd
- Device is configured to defer quality updates using Windows Update for Business and to be managed by WSUS
- Device is configured to **receive updates for other Microsoft products** along with updates to Windows (**Update/AllowMUUpdateService** = enabled)
- For a list of other Microsoft products that might be updated, see [Update other Microsoft products](update-other-microsoft-products.md).
- Admin has also placed Microsoft Update, non-Microsoft, and locally published update content on the WSUS server
In this example, the deferral behavior for updates to Office and other non-Windows products is slightly different than if WSUS weren't enabled.

4
windows/deployment/update/waas-wufb-group-policy.md
View File

@ -17,7 +17,7 @@ appliesto:
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2022</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2019</a>
- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Windows Server 2016</a>
ms.date: 11/30/2023
ms.date: 02/27/2024
---
# Walkthrough: Use Group Policy to configure Windows Update for Business
@ -65,7 +65,7 @@ You can control when updates are applied, for example by deferring when an updat
Both feature and quality updates are automatically offered to devices that are connected to Windows Update using Windows Update for Business policies. However, you can choose whether you want the devices to additionally receive other Microsoft Updates or drivers that are applicable to that device.
To enable Microsoft Updates, use the Group Policy Management Console go to **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates** and select **Install updates for other Microsoft products**.
To enable Microsoft Updates, use the Group Policy Management Console go to **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates** and select **Install updates for other Microsoft products**. For a list of other Microsoft products that might be updated, see [Update other Microsoft products](update-other-microsoft-products.md).
Drivers are automatically enabled because they're beneficial to device systems. We recommend that you allow the driver policy to allow drivers to update on devices (the default), but you can turn off this setting if you prefer to manage drivers manually. If you want to disable driver updates for some reason, use the Group Policy Management Console to go to **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates** and enable the policy.

2
windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md
View File

@ -62,7 +62,7 @@ An [Microsoft Entra dual state](/azure/active-directory/devices/hybrid-azuread-j
In the dual state, you end up having two Microsoft Entra device records with different join types for the same device. In this case, the Hybrid Microsoft Entra device record takes precedence over the Microsoft Entra registered device record for any type of authentication in Microsoft Entra ID, which makes the Microsoft Entra registered device record stale.
It's recommended to detect and clean up stale devices in Microsoft Entra ID before registering devices with Windows Autopatch, see [How To: Manage state devices in Microsoft Entra ID](/azure/active-directory/devices/manage-stale-devices).
It's recommended to detect and clean up stale devices in Microsoft Entra ID before registering devices with Windows Autopatch, see [How To: Manage stale devices in Microsoft Entra ID](/azure/active-directory/devices/manage-stale-devices).
> [!WARNING]
> If you don't clean up stale devices in Microsoft Entra ID before registering devices with Windows Autopatch, you might end up seeing devices failing to meet the **Intune or Cloud-Attached (Device must be either Intune-managed or Co-managed)** pre-requisite check in the **Not ready** tab because it's expected that these stale Microsoft Entra devices aren't enrolled into the Intune service anymore.

92
windows/deployment/windows-subscription-activation.md
View File

@ -1,6 +1,6 @@
---
title: Windows subscription activation
description: Learn how to dynamically enable Windows Enterprise or Education subscriptions.
description: Learn how to step up from Windows Pro to a Windows Enterprise subscription or from Windows Eduction Pro to a Windows Education subscription.
ms.service: windows-client
ms.subservice: itpro-fundamentals
ms.localizationpriority: medium
@ -10,8 +10,9 @@ manager: aaroncz
ms.collection:
- highpri
- tier2
ms.topic: conceptual
ms.date: 02/13/2024
ms.topic: concept-article
zone_pivot_groups: windows-versions-11-10
ms.date: 03/04/2024
appliesto:
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10</a>
@ -33,17 +34,6 @@ The subscription activation feature eliminates the need to manually deploy Enter
For more information on how to deploy Enterprise licenses, see [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md).
> [!NOTE]
>
> Organizations that use the Subscription Activation feature to enable users to upgrade from one version of Windows to another and use Conditional Access policies to control access need to exclude one of the following cloud apps from their Conditional Access policies using **Select Excluded Cloud Apps**:
>
> - [Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications).
> - [Windows Store for Business, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications).
>
> Although the app ID is the same in both instances, the name of the cloud app depends on the tenant.
>
> For more information about configuring exclusions in Conditional Access policies, see [Application exclusions](/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa#application-exclusions).
## Subscription activation for Enterprise
Windows Enterprise E3 and E5 are available as online services via subscription. Windows Enterprise can be deployed in an organization without keys and reboots.
@ -57,6 +47,34 @@ Organizations that have an enterprise agreement can also benefit from the servic
>
> Subscription activation is available for qualifying devices running currently supported versions of Windows. Subscription activation can't be used to upgrade to a newer version of Windows.
### Adding Conditional Access policy
Organizations that use the Subscription Activation feature to enable users to "step-up" from one version of Windows to another and use Conditional Access policies to control access need to exclude one of the following cloud apps from their Conditional Access policies using **Select Excluded Cloud Apps**:
- [Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications).
- [Windows Store for Business, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications).
Although the app ID is the same in both instances, the name of the cloud app depends on the tenant.
For more information about configuring exclusions in Conditional Access policies, see [Application exclusions](/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa#application-exclusions).
<!-- 8605089 -->
When a device has been offline for an extended period of time, the device might not reactivate automatically if this Conditional Access exclusion isn't in place. Setting this Conditional Access exclusion ensures that Subscription Activation continues to work seamlessly.
Starting with Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later, users are prompted for authentication with a toast notification when Subscription Activation needs to reactivate. The toast notification will show the following message:
> **Your account requires authentication**
>
> **Please sign in to your work or school account to verify your information.**
Additionally, in the [**Activation**](ms-settings:activation) pane, the following message might appear:
> **Please sign in to your work or school account to verify your information.**
The prompt for authentication usually occurs when a device has been offline for an extended period of time. This change eliminates the need for an exclusion in the Conditional Access policy for Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later. A Conditional Access policy can still be used with Windows 11, version 23H2 with [KB5034848](https://support.microsoft.com/help/5034848) or later if the prompt for user authentication via a toast notification isn't desired.
## Subscription activation for Education
Subscription activation for Education works the same as the Enterprise edition. However, in order to use subscription activation for Education, the device must have Windows Pro Education and an active subscription plan with an Enterprise license. For more information, see the [requirements](#windows-education-requirements) section.
@ -71,14 +89,6 @@ To support inherited activation, both the host computer and the VM must be runni
### Windows Enterprise requirements
> [!NOTE]
>
> The following requirements don't apply to general Windows client activation on Azure. Azure activation requires a connection to Azure KMS only. It supports workgroup, hybrid, and Microsoft Entra joined VMs. In most scenarios, activation of Azure VMs happens automatically. For more information, see [Understanding Azure KMS endpoints for Windows product activation of Azure virtual machines](/troubleshoot/azure/virtual-machines/troubleshoot-activation-problems#understanding-azure-kms-endpoints-for-windows-product-activation-of-azure-virtual-machines).
> [!IMPORTANT]
>
> As of October 1, 2022, subscription activation is available for *commercial* and *GCC* tenants. It's currently not available on GCC High or DoD tenants. <!-- 6783128 --> For more information, see [Enable subscription activation with an existing EA](deploy-enterprise-licenses.md#enable-subscription-activation-with-an-existing-ea).
For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), the following requirements must be met:
- A supported version of Windows Pro or Enterprise edition installed on the devices to be upgraded.
@ -87,11 +97,32 @@ For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products &
For Microsoft customers that don't have EA or MPSA, Windows Enterprise E3/E5 or A3/A5 licenses can be obtained through a cloud solution provider (CSP). Identity management and device requirements are the same when using CSP to manage licenses. For more information about getting Windows Enterprise E3 through a CSP, see [Windows Enterprise E3 in CSP](windows-enterprise-e3-overview.md).
> [!NOTE]
>
> These requirements don't apply to general Windows client activation on Azure. Azure activation requires a connection to Azure KMS only. Azure KMS supports workgroup, hybrid, and Microsoft Entra joined VMs. In most scenarios, activation of Azure VMs happens automatically. For more information, see [Understanding Azure KMS endpoints for Windows product activation of Azure virtual machines](/troubleshoot/azure/virtual-machines/troubleshoot-activation-problems#understanding-azure-kms-endpoints-for-windows-product-activation-of-azure-virtual-machines).
> [!IMPORTANT]
>
> As of October 1, 2022, subscription activation is available for *commercial* and *GCC* tenants. It's currently not available on GCC High or DoD tenants. <!-- 6783128 --> For more information, see [Enable subscription activation with an existing EA](deploy-enterprise-licenses.md#enable-subscription-activation-with-an-existing-ea).
### Windows Education requirements
- A supported version of Windows Pro Education installed on the devices to be upgraded.
- A device with a Windows Pro Education digital license. This information can be confirmed under **Settings > System > Activation** or under **Settings > Update & Security > Activation**.
::: zone pivot="windows-11"
- A device with a Windows Pro Education digital license. This information can be confirmed in the [**Activation**](ms-settings:activation)pane of the **Settings** app under **Settings > System > Activation**.
::: zone-end
::: zone pivot="windows-10"
- A device with a Windows Pro Education digital license. This information can be confirmed in the [**Activation**](ms-settings:activation)pane of the **Settings** app under **Settings > Update & Security > Activation**.
::: zone-end
- The Education tenant must have an active subscription to Microsoft 365 with a Windows Enterprise license, or a Windows Enterprise or Education subscription.
- Devices must be Microsoft Entra joined or Microsoft Entra hybrid joined. Workgroup-joined or Microsoft Entra registered devices aren't supported.
> [!IMPORTANT]
@ -104,8 +135,8 @@ With Windows Enterprise or Education editions, an organization can benefit from
To compare Windows editions and review pricing, see the following sites:
- [Compare Windows editions](https://www.microsoft.com/en-us/windows/business/windows-10-pro-vs-windows-11-pro)
- [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/en-us/microsoft-365/enterprise-mobility-security/compare-plans-and-pricing)
- [Compare Windows editions](https://www.microsoft.com/en-us/windows/business/windows-10-pro-vs-windows-11-pro) <!-- Leaving in language reference in URL because URL without it doesn't redirect properly>
- [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/compare-plans-and-pricing)
Benefits of moving to Windows as an online service include:
@ -121,7 +152,7 @@ Benefits of moving to Windows as an online service include:
## How it works
The device is Microsoft Entra joined, for example from **Settings** > **Accounts** > **Access work or school**.
The device is Microsoft Entra joined, for example from the [Access work or school](ms-settings:workplace) pane in the **Settings** app that can be found under **Settings** > **Accounts** > **Access work or school**.
Windows Enterprise is assigned to a user, for example through the Microsoft 365 admin center. When a licensed user signs in to a device that meets requirements using their Microsoft Entra credentials, Windows steps up from Pro edition to Enterprise, or from Pro Education to Education. Once the edition is stepped up, Enterprise/Education features are unlocked. When a user's subscription expires or is transferred to another user, the device reverts seamlessly to Windows Pro or Windows Pro Education edition, once the current subscription validity expires.
@ -167,7 +198,7 @@ With a Microsoft Entra subscription, group-based licensing is the preferred meth
### Existing Enterprise deployments
With currently supported version of Windows, subscription activation automatically pulls the firmware-embedded Windows activation key and activates the underlying Pro license. The license then steps up to Enterprise using subscription activation. This behavior automatically migrates devices from KMS or MAK activated Enterprise to subscription activated Enterprise.
With currently supported versions of Windows, subscription activation automatically pulls the firmware-embedded Windows activation key and activates the underlying Pro license. The license then steps up to Enterprise using subscription activation. This behavior automatically migrates devices from KMS or MAK activated Enterprise to subscription activated Enterprise.
Subscription activation doesn't remove the need to activate the underlying OS. This requirement still exists for running a genuine installation of Windows.
@ -193,7 +224,7 @@ If an organization has an Enterprise Agreement (EA) or Software Assurance (SA):
If an organization has a Microsoft Products & Services Agreement (MPSA):
- New customers are automatically emailed the details of the service. Take steps to process the instructions.
- New customers are automatically emailed the details of the service. Follow the instructions and steps found in the email.
- Existing MPSA customers receive service activation emails that allow their customer administrator to assign users to the service.
@ -209,8 +240,9 @@ Subscriptions to Windows Enterprise are also available for virtualized clients.
Virtual machines (VMs) must be configured to enable Windows Enterprise subscriptions for VDA. Active Directory-joined and Microsoft Entra joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md).
## Related sites
## Related content
- Connect domain-joined devices to Microsoft Entra ID for Windows experiences. For more information, see [Plan your Microsoft Entra hybrid join implementation](/entra/identity/devices/hybrid-join-plan).
- [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md).
- [Plan your Microsoft Entra hybrid join implementation](/entra/identity/devices/hybrid-join-plan).
- [Compare Windows editions](https://www.microsoft.com/windows/business/compare-windows-11).
- [Windows for business](https://www.microsoft.com/windows/business).