Assigning Windows 10/11 Enterprise Subscription Activation Licences to Hybrid Azure AD Joined Devices
Starting with Windows 10, version 1703, Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro to Windows 10 Enterprise automatically if they are subscribed to Windows 10 Enterprise E3 or E5.
The Subscription Activation feature eliminates the need to manually deploy Windows 10 Enterprise or Education images on each target device, then later standing up on-prem key management services such as KMS or MAK based activation, entering GVLKs, and subsequently rebooting client devices.
It’s important to note that the Windows 10 Enterprise subscription activation is designed to “step-up” a device from Windows 10 Pro to Windows 10 Enterprise. Therefore, your device is required to have a Windows 10 Pro license activated as a baseline.
For Windows 10 Enterprise Subscription Activation to function, there a several prerequisites which need to be in place. This blog is aimed for organisations which have Active Directory on premises and synchronise their AD objects to Azure AD via AD Connect.
The below provide a summary breakdown of the prerequisites required in the setup on AAD Connect:
- AAD Connect | Setup Check/Update
- AAD Connect | Hybrid Azure AD Join
- AAD Connect | Review/Amend OU Sync Scope
- Client Device | Internet Access to Azure AD via SYSTEM Account
- Client Device | Internet Access to Azure AD via User Account
- Client Device | SSO IE Local Intranet Settings
- Client Device | Windows 10 Pro Licensed and Activated
- Azure AD | Valid Subscription Present
- Azure AD | Applicable Users Licensed with Windows 10 Enterprise
AAD Connect | Setup Check/Update
- Version of 1.1.819.0 or above (you need to be v2 now anyway)
- Hybrid Azure Active Directory Join enabled and configured
- Sync scope to include the OU’s which contain the applicable computer objects
AAD Connect | Hybrid Azure AD Join
Below is an example of the where the SCP shows in Active Directory:
AAD Connect | Review/Amend OU Sync Scope
- Internet Access to Azure AD via SYSTEM account
- Internet Access to Azure AD via User Account
- SSO IE Local Intranet Settings
- Device licensed and activated with Windows 10 Pro
Client Device | Internet Access to Azure AD via SYSTEM Account
- Your ADFS server address if you have one e.g. https://sts.company.com
Automatic Device Join Scheduled Task
AAD Connect Device Sync Rule Filter
Test Azure AD Connection for SYSTEM account
Manually setting proxy for SYSTEM account
Azure AD Hybrid Azure AD Join status
Client Device | Internet Access to Azure AD via User Account
Client Device | SSO IE Local Intranet Settings
In order to provide Seamless SSO for the license subscription to works silently, the following URL’s should be added into the users Local Intranet zone in Internet Explorer:
Push Out Settings via Group Policy
You can push out the Local Intranet Settings to users via a Group Policy. Below is an example of the settings which need to be configured under the user context:
Client Device | Windows 10 Pro Licensed and Activated
For the step-up in license from Windows 10 Pro to Enterprise to occur, you’re required to have your device licensed and activated with Windows 10 Pro as a foundation.
Note, Windows 10, version 1803 enables pulling activation keys directly from firmware where the device support firmware-embedded keys. It is no longer necessary to run a script to perform the activation step on Windows 10 Pro prior to activating Enterprise.
Windows Edition Check
Below is an example of how the Windows 10 Pro license should display prior to step-up in license. Disregard the partial product key as this may be different prior to the step-up in licensing:
- An applicable license plan in the Azure AD/Office 365 tenant
- A license assigned to the applicable users for the step-up in licensing
Azure AD | Valid Subscription Present
Azure AD | Applicable Users Licensed with Windows 10 Enterprise
Enable Licence Subscription
Windows 10 Subscription Activation
- Note, in some places the license will still appears as Windows 10 Pro.
- Note, that the partial product key should show with the value 3V66T.
- Note, a user can license up to 5 devices with their user account. The activation is like a queue, the 1st activated device will drop off the list when a 6th one is activated etc.
- At the present time, there’s no documented way to verify which and how many devices have been licensed by user account in Azure AD.
- Upon revoking the license from the user in Azure AD/Office 365, the license will downgrade back to Windows 10 Pro.