Windows 10: Cannot activate Windows 10 Enterprise subscription license for Azure AD Joined device

CharlieBrown22 · Oct 2, 2019

Here is the current situation:

I have a Windows 10 Enterprise device that I cannot activate: https://imgur.com/1pqQf89

Error message: We can't activate Windows on this device as we can't connect to your organization's activation server. Make sure you're connected to your organization's network and try again. If you continue having problems with activation, contact your organization's support person. Error code 0x8007007B (DNS name does not exist).

My device is indeed Azure AD Joined, and is not Domain Joined: https://imgur.com/3NYDbzr

Comment: because I’m not domain-joined any more, this computer should not try to “connect to my organization’s activation server” any more, and should just reach out to the cloud for activation through Azure AD – right?

I do have my company's Azure AD account registered with this device: https://imgur.com/Ygtya2L

My device is in version 1903: https://imgur.com/hWIx3fG

My device does show up as being registered under my Azure AD account: https://imgur.com/Mt8AYHh

And lastly, my Azure AD account does have a Windows 10 Enterprise E5 license assigned to it: https://imgur.com/DknbpaY

Even after removing the original product key from the registry, my detailed license information says “VOLUME_KMSCLIENT channel” under “Description”: https://imgur.com/Sctgfz4

Comment: As per this, the "Description" field should contain something like "RETAIL channel Partial Product Key " when using the Windows 10 E3 or E5 license.

:)

Igor Leyko · Oct 2, 2019

How to activate Windows 10 Enterprise E3

Sorry, I've used a wrong word.

Who manage this subscription - you or your cloud solution provider?

Requirements

For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), you must have the following:

•Windows 10 (Pro or Enterprise) version 1703 or later installed and activated on the devices to be upgraded.

•Azure Active Directory (Azure AD) available for identity management.

•Devices must be Azure AD-joined or Active Directory joined with Azure AD Connect. Workgroup-joined devices are not supported.

For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 Enterprise E3 or E5 through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses,

Brink · Oct 2, 2019

Modernizing Windows Deployment with Windows 10 Subscription Activation

Back in June when we announced Windows AutoPilot, we also talked about another feature to automatically step up from Windows 10 Pro to Windows 10 Enterprise on Azure AD user logon, a key requirement to be able to use an off the shelf OEM device as soon as it comes out of the box, without reimaging.

So how exactly does this work? Many assume that this is done by Intune (or other MDM services) pushing down a policy to change the Windows 10 product key, either using a MAK key or a KMS key. And while that’s certainly possible to do, that approach is not ideal: MAK keys have limited activation counts, so you have to make sure you don’t run out of activations, and KMS requires periodic connectivity to the corporate network as well as on-premises infrastructure.

That’s where the new Windows 10 Subscription Activation feature comes in. By leveraging Azure Active Directory, you can eliminate product keys altogether. Instead, you can assign Windows 10 Enterprise E3 or E5 licenses directly to Azure AD users (just like you would with Office 365 or EMS) so that when a user logs onto a Windows 10 Pro device, it automatically steps up to Windows 10 Enterprise, making all the enterprise features instantly available. You can see the result of this step-up in the Settings app, where it shows you that the subscription is active:

The device will check with Azure Active Directory to ensure that the user still has a valid subscription license, so periodic internet access is required. If the license is removed or if the device is unable to check after a period of trying, it will step down to Windows 10 Pro automatically.

This also works for traditional Active Directory-joined devices too, as long as you have (Note that using the “Add work account” process to associate your Azure Active Directory account with a device is not supported, since these devices are assumed to be personal ones.)

If you have an active per-user Windows 10 Enterprise E3 or E5 or Windows VDA E3 or E5 subscription, there are some steps that need to be performed to make the license available in Azure Active Directory: a corresponding $0 Add-On license, which starts the process of adding the license to Azure AD, and then your designated volume licensing admin (online services contact) will receive and process some e-mailed instructions. For more information on that, see the Windows 10 Subscription Activation documentation. Once this is done, you can see the license in Azure Active Directory:

Note that this is not designed as a straight replacement for KMS or MAK activation. Windows 10 Subscription Activation requires that the original Windows 10 Pro OS is already activated (typically through OEM activation using the key embedded in the firmware of the device) – this enables automatic compliance for the underlying Pro edition licensing requirement to deploy Windows .

Windows 10 Subscription Activation is supported with Windows 10 Pro 1703 and later releases. Azure Active Directory is also needed, but any Azure AD edition will work. A per-user Windows 10 Enterprise E3 or E5 subscription through an Enterprise Agreement (EA) or Microsoft Products & Services Agreements (MPSA) is also needed. (For SMB customers, similar capabilities were announced last year as part of the Cloud Solution Provider [CSP] channel.)

To learn more about Windows 10 Subscription Activation, check out the Microsoft Ignite session that will be presented next week. (The recording of that session will be available soon after.)
Click to expand...

Source: Modernizing Windows Deployment with Windows 10 Subscription Activation Windows for IT Pros

Brink · Oct 2, 2019

More Azure AD and Windows 10: Enterprise State Roaming public preview

Howdy folks,

I’ve been looking forward to this post for some time now. Those of you who saw our blog series on enterprise functionality in Windows 10 last year would have read that we were working on building an enterprise compliant service to sync OS settings across Azure AD joined Windows 10 devices. Well it’s finally here! Today we are announcing the public preview of Enterprise State Roaming for Windows 10.

I have invited Gunjan Jain, a Program Manager on the Windows Server and Services team to tell you more about it. Give Enterprise State Roaming a try and let us know what you think.
Best Regards,

Alex Simons (@Alex_A_Simons)

Director of Program Management

Microsoft Identity and Security Services Division

——-

Hi Everyone,

I’m Gunjan Jain, one of the PMs in Microsoft’s Windows Server and Services team. I have been working with the Azure AD and Windows client teams to bring Enterprise State Roaming in Windows 10 to life! Today I am really thrilled to announce the public preview of the Enterprise State Roaming for Windows 10.

As you’re probably aware, ‘settings sync‘ has existed since Windows 8 and 8.1. It allows consumers to sync OS settings and Universal Windows Platform application data across all their personal Windows devices. It uses a personal Microsoft Account and a consumer OneDrive folder in the cloud to achieve this. Enterprise State Roaming – or ‘OS State Roaming’ as we referred to it in the Bringing the cloud to enterprise desktops series of blog posts, well before it had a real name – brings the exact same user experience to enterprise users!

The big difference between Enterprise State Roaming and settings sync lies under the hood. As much as the settings sync feature is well loved by consumers, it does not meet many enterprise customers’ needs. IT admins want to retain control of corporate data, even when an employee leaves the company. Enterprises users also want to separate work and personal data on their devices. They don’t want their corporate Wi-Fi passwords syncing to the cloud along with their favorite game’s high score. Enterprise State Roaming in Windows 10 solves these problems for corporate owned devices because data is roamed using Azure AD identities and is backed by storage in the Azure cloud.

Enterprise State Roaming enables a number of benefits for enterprise customers. Among them are:

Separation of corporate and consumer data – No mixing of enterprise data in a consumer cloud account or consumer data in an enterprise cloud account.

Enhanced security – All the data is automatically encrypted before leaving the user’s Windows 10 device by using Azure Rights Management (Azure RMS), and data stays encrypted at rest in the cloud. All content stays encrypted at rest in the cloud, except for the namespaces, like settings names and Windows app names. By the way, you don’t need a separate paid Azure RMS subscription to use this service. Microsoft provides free limited use Azure RMS service restricted for Enterprise State Roaming use.

Better management – More control and visibility over who syncs settings in your organization and on what devices.

Geographic location of data in the cloud – Data will be stored in an Azure region based on the country associated with the Azure AD directory. We understand it is important to some of our enterprise customers to ensure data stays within their geographic boundaries due to the compliance reasons.

Please note at the time of this public preview, this service is available in US and Europe regions only. We do plan to roll service out globally in the near future.

What do I need to deploy Enterprise State Roaming?

All you need to deploy Enterprise State Roaming in your organization is the following:

An Azure Active Directory Premium subscription. Enterprise State Roaming requires an Azure Active Directory Premium subscription. At the time of GA, users will require to have premium licenses assigned to use this service.

Windows 10 (Version 1511, Build 10586 or greater). Devices must either be

Azure AD joined
or

AD Domain Joined with automatic registration to Azure AD

Automatic registration of Windows 10 Domain Joined devices to Azure AD is a separate topic covered in this blog post
by Jairo Cadena (@JairoC_AzureAD).

How do I configure Enterprise State Roaming?

Enterprise State Roaming is also easy to set up – everything can be done in the Azure Admin Portal.

Just login to the Azure Admin Portal, go to Active Directory, select the directory that you want to enable the service for, click on the Configure tab and scroll down to users may sync settings and enterprise app data.

Select All or specify users or Security Groups in the Selected field for the users you want to enable roaming for – and hit Save.

If you don’t see the configuration settings, your tenant probably does not have an Azure AD Premium subscription. Click here to learn more about Azure AD Premium benefits and how to get a subscription.

If you receive an error “Unable to save Device Registration Settings” with details showing “The feature is not yet available in your region,” it is likely your tenant is not setup in one of the supported US and Europe regions.

Once you save these settings, your Windows 10 devices that are joined to Azure AD or domain joined registered with Azure AD will automatically start syncing settings through the Azure cloud using enterprise accounts.

Users can also control which settings roam between their devices using the Sync your settings page in Windows. This can be found by going to the Accounts section of the Settings app.

So, what account is really being used for roaming?

In Windows 8 and Windows 8.1, roaming always happens through a connected Microsoft Account via the consumer OneDrive cloud – even on corporate owned Domain Joined devices. This is still possible today for organizations and users who are willing to allow personal accounts on corporate owned devices. However, the advent of Azure AD Join in Windows 10 gives us the capability to drive cloud services using work or school accounts – even on Domain Joined machines. With Enterprise State Roaming, OS settings use this account to authenticate to the Enterprise State Roaming service back-end (which in turn uses Azure storage) to roam data between devices.

A personal Microsoft Account can still be added to an Azure AD joined Windows 10 machine as a secondary account – allowing personal apps and data to be used on the device. In this configuration however it is important to note that:

The OS settings always roam with the primary account

App state data roams based on the identity of app acquisition

Note that multiple identity support for roaming is not yet available in current builds of Windows 10. So, if you log into a corporate owned device with your enterprise credentials, the OS settings and the state of Windows apps acquired using enterprise account will roam using Azure AD account. The state of the Windows apps acquired using your secondary personal Microsoft Account will not roam. Similarly, if you log into a personally owned device with a Microsoft account, the OS settings and the state of the Windows apps acquired using that Microsoft account will roam via the consumer OneDrive cloud, but the state of the Windows apps acquired using enterprise account will not roam.

Tip – Check the account identity on “Sync your settings” page on device to determine the account that is being used for syncing.

That’s it! If you’ve read this far, thanks a ton for your time! We really appreciate your interest! Please give this feature a try and send us your questions and feedback.

Happy roaming!

Gunjan Jain (@gunjanjain123)

Senior Program Manager

Microsoft Windows Server and Services Division
Click to expand...

Source: More Azure AD and Windows 10 goodness: Enterprise State Roaming public preview! | Active Directory Team Blog

Windows 10: Cannot activate Windows 10 Enterprise subscription license for Azure AD Joined device

Cannot activate Windows 10 Enterprise subscription license for Azure AD Joined device

Cannot activate Windows 10 Enterprise subscription license for Azure AD Joined device

Cannot activate Windows 10 Enterprise subscription license for Azure AD Joined device

Cannot activate Windows 10 Enterprise subscription license for Azure AD Joined device - Similar Threads - Cannot activate Enterprise

Device shows in Intune as Azure AD Joined but MDM is NONE

Device shows in Intune as Azure AD Joined but MDM is NONE

Device shows in Intune as Azure AD Joined but MDM is NONE

WIndows 10 Activation Issue / Azure AD joined device

Activate non-licensed Windows 10 Pro with Windows Enterprise A3 subscription

Windows Autopilot for existing devices supports Hybrid Azure AD Join

RDP to Azure AD joined computer

Dis-Join Azure AD

Join Windows 10 PC to Azure AD

Users found this page by searching for:

autopilot subscription activation