diff --git a/windows/deployment/images/sa-mfa1.png b/windows/deployment/images/sa-mfa1.png new file mode 100644 index 0000000000..045e5a7794 Binary files /dev/null and b/windows/deployment/images/sa-mfa1.png differ diff --git a/windows/deployment/images/sa-mfa2.png b/windows/deployment/images/sa-mfa2.png new file mode 100644 index 0000000000..1964a7b263 Binary files /dev/null and b/windows/deployment/images/sa-mfa2.png differ diff --git a/windows/deployment/images/sa-mfa3.png b/windows/deployment/images/sa-mfa3.png new file mode 100644 index 0000000000..8987eac97b Binary files /dev/null and b/windows/deployment/images/sa-mfa3.png differ diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 8ceb4e28f5..2c105278f6 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -85,13 +85,26 @@ For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & - Azure Active Directory (Azure AD) available for identity management. - Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. - >[!NOTE] - >An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription. To resolve this issue, the user must either sign in with an Azure Active Directory account, or you must disable MFA for this user during the 30-day polling period and renewal. - For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 Enterprise E3/E5 or A3/A5 through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses, with the exception that Windows 10 Enterprise E3 is also available through CSP to devices running Windows 10, version 1607. For more information about obtaining Windows 10 Enterprise E3 through your CSP, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://blogs.windows.com/business/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/) +#### Muti-factor authentication + +An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription. + +To resolve this issue: + +If the device is running Windows 10, version 1703 or 1709, the user must either sign in with an Azure AD account, or you must disable MFA for this user during the 30-day polling period and renewal. + +If the device is running Windows 10, version 1803 or later: +1. Windows 10, version 1803 must be updated with [KB4497934](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934). Later versions of Windows 10 automatically include this patch. +2. When the user signs in on a Hybrid Azure AD joined device with MFA enabled, a notification will indicate that there is a problem. Click the notification and then click **Fix now** to step through the subscription activation process. See the example below: + +![Subscription Activation with MFA1](images/sa-mfa1.png)
+![Subscription Activation with MFA2](images/sa-mfa2.png)
+![Subscription Activation with MFA2](images/sa-mfa3.png) + ### Windows 10 Education requirements 1. Windows 10 Pro Education, version 1903 or later installed on the devices to be upgraded.