Helpdesk: "Dana's Word says UNLICENSED PRODUCT across the top and won't let her edit. The front-desk PC everyone shares says 'a shared computer license isn't available.' Sam, who moved over from the acquired company's tenant last week, gets 'We couldn't find any Office products.' And the laptop we re-imaged for the new hire says 'Your organization has disabled this device.' Can you just reinstall Office on all of them?"
Don't reinstall yet. "Microsoft 365 Unlicensed Product" is usually one broken layer in a documented chain, not broken Office: the user has no license that includes the desktop apps (or the apps were switched off inside the license) → Office is signed in with the wrong account, or a second work account is in the way → the PC is in a different activation mode than you think (user, shared computer, device-based, viewer mode) or still holds an old activation → the device identity or the token broker is broken (disabled device object, blocked BrokerPlugin, no PRT) → the PC can't reach the Office Licensing Service (proxy, firewall, TLS, NCSI, more than 30 days offline). The admin center, the Activations report, File → Account, Microsoft's vnextdiag.ps1, dsregcmd /status, and a few read-only network checks are the sources for that chain. Running Microsoft's broadest cleanup on a Workplace Joined PC removes single sign-on for every app in that Windows session and unregisters the device.
If the message is "Your organization has disabled this device" (often with 135011), start with "Your Organization Has Disabled This Device" (AADSTS135011). If Office never installed in the first place, use Intune Microsoft 365 Apps Not Installing. This post covers "Office is installed, but the title bar says Unlicensed Product (or a related activation message), and you need a read-first path before you reset activation, remove accounts, or reinstall."
TL;DR
- Read the exact banner text first. "We couldn't find any Office products," "a shared computer license isn't available," "LICENSE REQUIRED," and "Your organization has disabled this device" are different layers with different fixes.
- License first, and check the apps inside it. Microsoft: removing a user's license puts their installs into reduced functionality mode and they see Unlicensed Product. A license whose Microsoft 365 Apps service is switched off behaves the same way. Business Basic has no desktop apps at all.
- Microsoft 365 Apps stays activated only if the PC reaches the Office Licensing Service at least once every 30 days. Past that, it drops into reduced functionality mode until it reconnects.
-
Find out which mode the PC is in before you touch anything. File → Account → About shows a License ID starting with EWW (Microsoft 365 Apps), "Shared Computer Activation," or "Belongs to: This device" (device-based).
vnextdiag.ps1 -action listshows the license type, state, the email that activated it, and the tenant ID. -
ospp.vbsno longer reports Microsoft 365 Apps activation (since Version 1910). Usevnextdiag.ps1.ospp.vbsis still the tool for volume-licensed Office (LTSC 2021, 2019). -
Reset activation last, and pick the narrow method.
vnextdiag.ps1 -action removeresets one product. Microsoft's full cleanup (OLicenseCleanup, sign out of WAM accounts, WPJ cleanup) is broader. WPJ cleanup removes single sign-on for every app in that Windows session and unregisters the device.
Where in the chain did it break?
| Step | What should be true | Typical symptom when it breaks |
|---|---|---|
| 1. Symptom captured | Exact banner text, user, PC, activation mode, what changed | "Office is unlicensed" with no detail |
| 2. License | A license that includes Microsoft 365 Apps, with that app turned on, no assignment errors | Unlicensed Product for one user after a license change; "couldn't verify the subscription" |
| 3. Account | Office signed in with the licensed work account, one account per tenant | "We couldn't find any Office products"; "another account from your organization is already signed in" |
| 4. Activation mode | The PC is in the mode you meant (user, shared, device), with no leftover activation | Works for one user, not the next; the wrong email in vnextdiag after a migration |
| 5. Device and token | Device object enabled, BrokerPlugin not blocked, PRT present on joined PCs | "Your organization has disabled this device"; repeated sign-in prompts |
| 6. Network | WinHTTP proxy and firewall allow the activation endpoints, TLS 1.2, NCSI says Internet | "We're having trouble activating Office"; works at home, fails in the office |
| 7. Shared and device-based | Plan supports the mode, token stored and renewed, device in the licensed group | "Shared computer license isn't available"; "LICENSE REQUIRED"; "CAN'T VERIFY LICENSE" |
| 8. Reset | Only after Steps 1–7 agree, using the narrowest method | Every PC reset and still unlicensed |
Step 1: Capture the exact symptom (read-only)
Write these facts on the ticket before anyone resets activation or reinstalls Office:
| Fact | Why it matters |
|---|---|
| Exact message and where it appears | Title bar, yellow banner under the ribbon, or an activation dialog. Each message maps to a layer (table below) |
| User, PC, and time | You need the user's licenses, the PC's join state, and when it last activated |
| Who else uses this PC | One user, a shared front-desk PC, an RDS host, or VDI changes the licensing mode |
| File → Account → About | License ID (EWW / CWW), Product ID, "Shared Computer Activation," or "Belongs to: This device" |
| Can the user still open and print? | Reduced functionality mode and viewer mode both allow view and print. Viewer mode shows its own banner |
| What changed | License removed or swapped, user migrated between tenants, PC re-imaged or handed to a new user, PC offline for weeks, new proxy or firewall rule |
| Message the user sees | Likely layer |
|---|---|
| "Unlicensed Product" or "Non-commercial use / Unlicensed Product" in the title bar | Any of them. Start at Step 2 |
| "We couldn't find any Office products" | Wrong account signed in to Office (Step 3) |
| "We couldn't verify the subscription" / "Unable to verify the account" / "Couldn't verify account... Most features will be turned off on (date)" | License, account, or proxy (Steps 2, 3, 6) |
| "Sorry, another account from your organization is already signed in on this computer" | Account store on the PC (Step 3) |
| "Your organization has disabled this device" | Entra device object (Step 5) |
| "We're having trouble activating Office." | Network (Step 6) |
| "The products we found in your account cannot be used to activate Office in shared computer scenarios." | The plan doesn't support shared computer activation (Step 7) |
| "UNLICENSED PRODUCT Most features are turned off because a shared computer license isn't available." | Shared computer token wasn't obtained (Step 7) |
| "LICENSE REQUIRED Your admin needs to assign an Office license to this device so you can edit your files." | Device-based licensing (Step 7) |
| "CAN'T VERIFY LICENSE We're having trouble verifying the Office license for this device." | Device-based licensing can't reach the licensing service (Steps 6, 7) |
| Banner says Office is in viewer mode | By design for an unlicensed user when viewer mode is enabled (Step 4) |
Step 2: The license and the apps inside it (read-only)
Microsoft's licensing overview is direct: users need a Microsoft 365 Apps license before they can install and activate, and if you remove a user's license, their installs enter reduced functionality mode. Microsoft's license-assignment page adds that a user who loses the license and still has the apps installed sees Unlicensed Product.
In the Microsoft 365 admin center → Users → Active users → the user → Licenses and apps, check three things:
- A license that includes the desktop apps. Microsoft notes that Microsoft 365 Business Basic has no Office desktop apps to install, only the web apps.
- The app inside the license is on. Admins can turn apps and services on or off within a license. A license with the Microsoft 365 Apps service switched off reads as "licensed" at a glance and still produces Unlicensed Product.
- No assignment errors. In Billing → Licenses → the product → Errors & Issues, Microsoft lists the common reasons a license didn't land: no available licenses, conflicting services or license plans, and an invalid usage location.
# Read-only (Microsoft Graph PowerShell)
# Connect-MgGraph -Scopes 'User.Read.All'
Get-MgUserLicenseDetail -UserId 'dana@contoso.com' |
Select-Object SkuPartNumber -ExpandProperty ServicePlans |
Where-Object ServicePlanName -like 'OFFICESUBSCRIPTION*' |
Select-Object SkuPartNumber, ServicePlanName, ProvisioningStatus
OFFICESUBSCRIPTION is the service plan name Microsoft's "Product names and service plan identifiers" reference lists for the Microsoft 365 Apps desktop apps in the common enterprise SKUs. If nothing comes back, drop the Where-Object line, list every plan, and confirm against that reference for your SKU. Read ProvisioningStatus: Microsoft documents Success, Disabled (service turned off), Error, PendingInput, PendingActivation, and PendingProvisioning.
Two timing notes from Microsoft:
- New license, same day: Microsoft recommends assigning the license 24 hours before you deploy, so it's provisioned when the user first opens an app.
- License removed and re-added: Microsoft's activation articles list unassigning and reassigning the license as a troubleshooting step. That's a change, so it belongs in Step 8, not here.
How many devices has this user activated? Microsoft allows each license on up to five PCs or Macs, five tablets, and five phones. Since Version 1910, a user isn't prompted to deactivate another device. If they activate on more than 10 devices, the one unused for the longest time is deactivated automatically (Windows only), and that device drops into reduced functionality mode. The admin view is Reports → Usage → Microsoft 365 apps → Activations: product licenses, last activated date (UTC), counts per platform, and Used Shared Computer Activation. User names are hidden in usage reports by default until an admin turns on user details.
Step 3: Which account is Office signed in with? (read-only on the PC)
Most "I'm licensed, Office says I'm not" tickets are the wrong identity:
| Check | What Microsoft documents |
|---|---|
| File → Account → the signed-in user | Office has to be signed in with the account that holds the license. Using the wrong address produces "We couldn't find any Office products." Work users need the work or school account, not a personal Microsoft account |
| Settings → Accounts → Access work or school | If the account used for office.com is listed but isn't the account used to sign in to Windows, Microsoft's step is to disconnect it. Read the list now; disconnecting is a change |
| Credential Manager → Windows Credentials | Entries for MicrosoftOffice16 are cached Office credentials. Microsoft's fix removes them. Read only for now |
| "Another account from your organization is already signed in" | Expected if a second account from the same tenant is signed in. If only one account is used, Microsoft points at the OneAuth account store in %localappdata%\Microsoft\OneAuth\accounts
|
| After a tenant-to-tenant migration | Microsoft lists tenant migration and repurposing a device for a new user as reasons to reset activation. Step 4's vnextdiag output shows which email and tenant ID actually activated Office |
# Read-only, as the user: work or school accounts Windows knows about
dsregcmd /status | Select-String 'AzureAdJoined','WorkplaceJoined','TenantName'
# Read-only: cached Office credentials (names only)
cmdkey /list | Select-String 'MicrosoftOffice'
# Read-only: OneAuth account files (Microsoft says to read account_hints before changing anything)
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\OneAuth\accounts" -ErrorAction SilentlyContinue |
Select-Object Name, LastWriteTime
Step 4: Which activation mode is the PC in? (read-only on the PC)
Microsoft 365 Apps can run in several licensing modes, and a PC set up for one while you troubleshoot another wastes the afternoon:
| Mode | How Microsoft says to recognize it |
|---|---|
| User-based subscription (the default) | File → Account → About shows a License ID starting with EWW. Consumer Microsoft 365 starts with CWW. Volume-licensed Office shows a Product ID instead |
| Shared computer activation | About shows Shared Computer Activation under the version, instead of a Product ID. Registry SharedComputerLicensing = 1 under HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
|
| Device-based licensing | File → Account → Product Information shows Belongs to: This device |
| Viewer mode | A banner under the ribbon says Office is in viewer mode, and the Activate Product button under File → Account is hidden |
Microsoft's newer activation method (since Version 1910) has three tells: the EWW License ID, values of 2 under HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext, and per-product license files under %localappdata%\Microsoft\Office\Licenses. Shared computer tokens live in %localappdata%\Microsoft\Office\16.0\Licensing (or the roaming folder you configured).
# Read-only, as the user
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -ErrorAction SilentlyContinue |
Select-Object SharedComputerLicensing, *DeviceBasedLicensing*, SCLCacheOverride, SCLCacheOverrideDirectory
Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext' -ErrorAction SilentlyContinue
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Office\Licenses" -Recurse -ErrorAction SilentlyContinue |
Select-Object FullName, LastWriteTime
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Office\16.0\Licensing" -ErrorAction SilentlyContinue |
Select-Object Name, LastWriteTime
# Microsoft's activation report (included with Microsoft 365 Apps Version 2104+). 'list' only reads.
$od = 'C:\Program Files\Microsoft Office\Office16'
if (-not (Test-Path "$od\vnextdiag.ps1")) { $od = 'C:\Program Files (x86)\Microsoft Office\Office16' }
& "$od\vnextdiag.ps1" -action list
Microsoft says vnextdiag.ps1 -action list shows, per product: the license type (for example User|Subscription), the product (for example O365ProPlusRetail), the state (for example Licensed), the email of the user who activated it, and the tenant ID. Shared computer activation and device-based licensing show up there too. The 32-bit-on-64-bit path is the Program Files (x86) folder, as above.
| Finding | What it means |
|---|---|
| Email or tenant ID belongs to the old tenant or the previous user | Leftover activation. Microsoft's answer is a reset (Step 8) |
SharedComputerLicensing = 1 on a one-user laptop |
Every user needs their own shared computer token, and the plan has to support it (Step 7) |
| A user activated before shared computer activation was turned on | Microsoft: reset the activation, or shared computer activation won't work |
| Device-based or RPA licensing set alongside shared computer activation | Microsoft's shared computer troubleshooting says to make sure device-based licensing and RPA are disabled |
| Viewer mode and shared computer activation both configured | Microsoft doesn't recommend combining them |
| More than one Office in Programs and Features | Microsoft: multiple copies can cause activation conflicts. Note which one is unused |
Step 5: Device identity and the token broker (read-only on the PC)
On Entra joined, hybrid joined, and Workplace Joined PCs, Office activates through Web Account Management (WAM). Microsoft's reset article uses dsregcmd /status to tell them apart:
| AzureAdJoined | EnterpriseJoined | DomainJoined | Device state |
|---|---|---|---|
| YES | NO | NO | Microsoft Entra joined |
| NO | NO | YES | Domain joined |
| YES | NO | YES | Microsoft Entra hybrid joined |
WorkplaceJoined : YES in the User State section means the device is Workplace Joined (Microsoft Entra registered).
| Finding | What Microsoft documents |
|---|---|
| "Your organization has disabled this device" | Enable the device in Entra ID → Devices. If it was deleted, it has to be re-registered. Microsoft also says to check for a duplicate device blocking activation |
| BrokerPlugin blocked | Some antivirus, proxy, or firewall software blocks Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy. Check that first. Microsoft's next step deletes BrokerPlugin account data, so note it as a change |
| Repeated prompts on a joined PC | Read the PRT (AzureAdPrt) before blaming Office. See AzureAdPrt : NO in dsregcmd /status
|
| Device not enrolled in MDM | Microsoft's disabled-device article lists checking MDM enrollment in the dsregcmd Tenant Details section |
# Read-only: device and user state that activation depends on
dsregcmd /status | Select-String 'AzureAdJoined','EnterpriseJoined','DomainJoined','WorkplaceJoined','DeviceAuthStatus','AzureAdPrt '
# Read-only: is the BrokerPlugin package present for this user?
Get-AppxPackage -Name 'Microsoft.AAD.BrokerPlugin' | Select-Object Name, Version, Status
Step 6: Can the PC reach the licensing service? (read-only on the PC)
Microsoft: each day, or each time the user signs in, the PC contacts the Activation and Validation Service. If it goes more than 30 days without connecting, Microsoft 365 Apps enters reduced functionality mode until it reconnects, and the user may have to sign in again. Microsoft 365 Apps won't work on PCs that are completely cut off from the internet. For those, Microsoft points at Office LTSC with KMS or Active Directory-based activation instead.
Microsoft's network checks, in the order the activation articles give them:
- TLS 1.2 enabled by default in the OS (older systems need an update, and those systems aren't supported for Microsoft 365 Apps anymore).
- Date, time, and time zone set correctly. Microsoft's support article says wrong settings can make activation fail.
-
WinHTTP proxy. Microsoft's fix uses
netsh winhttp set proxy. Read the current value first. -
Firewall allow list, including
ols.officeapps.live.com/olsc,activation.sls.microsoft.com,odc.officeapps.live.com,officeclient.microsoft.com,login.microsoftonline.com,login.windows.net,enterpriseregistration.windows.net,officecdn.microsoft.com, and thecrl.microsoft.comCRL paths. See Microsoft's activation article for the full list. -
NCSI.
Get-NetConnectionProfileshould show IPv4Connectivity : Internet. NoTraffic or LocalNetwork means Windows doesn't think it's online. - Services running: Network Connected Devices Auto-Setup, Network List Service, Network Location Awareness, and Windows Event Log.
-
External DNS. An MSOID CNAME pointing at
clientconfig.partner.microsoftonline-p.net.cnis only for Microsoft 365 operated by 21Vianet. Anywhere else it causes a "custom domain isn't in our system" error and blocks activation.
# Read-only, on the user's PC
netsh winhttp show proxy
Get-NetConnectionProfile | Select-Object Name, IPv4Connectivity, IPv6Connectivity
Resolve-DnsName dns.msftncsi.com -ErrorAction SilentlyContinue | Select-Object -First 1 Name, IPAddress
Get-Service -DisplayName 'Network Connected Devices Auto-Setup','Network List Service',
'Network Location Awareness','Windows Event Log' | Select-Object DisplayName, Status
# Direct TCP 443 reachability (doesn't go through the WinHTTP proxy; a pass here isn't proof the proxy allows it)
'ols.officeapps.live.com','activation.sls.microsoft.com','odc.officeapps.live.com',
'officeclient.microsoft.com','login.microsoftonline.com' | ForEach-Object {
[pscustomobject]@{ Host = $_; Tcp443 = (Test-NetConnection $_ -Port 443 -WarningAction SilentlyContinue).TcpTestSucceeded }
}
# Read-only: the MSOID record for your custom domain (expect nothing outside 21Vianet)
Resolve-DnsName "msoid.contoso.com" -Type CNAME -ErrorAction SilentlyContinue
Works at home, fails in the office? That's the proxy or firewall, not the license.
Step 7: Shared computer, RDS/VDI, and device-based licensing (read-only)
Shared computer activation
| Check | What Microsoft documents |
|---|---|
| Plan supports it | Any plan that includes Microsoft 365 Apps for enterprise (for example Office 365 E3 or Microsoft 365 E5), desktop Project or Visio plans, and Microsoft 365 Business Premium, which is the only business plan with it. Business Standard includes the apps but not shared computer activation. Education plans with Apps for enterprise qualify. Not available for Office for Mac |
| Every user licensed | Each user needs their own Microsoft 365 Apps license and signs in with their own account. One user activating doesn't activate anyone else |
| Enabled | About shows Shared Computer Activation, or SharedComputerLicensing = 1. Turning it on after install needs a reboot. Microsoft 365 Apps for business doesn't support enabling it through Group Policy |
| Activation succeeded | Text files appear in %localappdata%\Microsoft\Office\16.0\Licensing after the user opens an app. Microsoft: don't edit them |
| Token lifetime | The token is valid for 30 days and renews automatically while the user uses Office. "PRODUCT NOTICE Your shared computer license expires on (date)" means renewal failed. The user keeps full use until that date |
| "Recently used to activate too many computers" | Microsoft limits how many shared computers one user can activate in a period |
RDS or VDI users prompted to activate every session? Microsoft's first answer is licensing token roaming (Version 1704+), set with Group Policy, the Office Deployment Tool (SCLCacheOverride and SCLCacheOverrideDirectory), or the registry. Other documented checks: RDS servers joined to Entra ID with password hash sync and Seamless SSO; EnableADAL = 1 under HKLM\SOFTWARE\Microsoft\Office\16.0\Common\Identity; with FSLogix and SSO, IncludeOfficeActivation = 0 under HKLM\SOFTWARE\Policies\FSLogix\ODFC; and when the FSLogix Office container runs beside another profile solution, exclude the Licensing folder (and the other Office folders Microsoft lists) from that solution.
# Read-only, on the RDS/VDI host
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\Identity' -Name EnableADAL -ErrorAction SilentlyContinue
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\FSLogix\ODFC' -Name IncludeOfficeActivation -ErrorAction SilentlyContinue
Device-based licensing
| Check | What Microsoft documents |
|---|---|
| License availability | Microsoft 365 Apps for enterprise (device) is sold through Enterprise Agreement / EAS; the Education version only through EES |
| Requirements | Microsoft 365 Apps Version 1907 or later, a supported Windows client (or Windows Server 2019/2022), and a PC that's Microsoft Entra joined or hybrid joined |
| Group | A security group (assigned, or dynamic device membership) or a distribution list. Microsoft 365 groups aren't supported. Licenses go to one group only, and devices in nested groups don't get a license |
| Where it's assigned | Microsoft 365 admin center → Billing → Licenses. Microsoft: you can't assign these licenses in the Azure portal |
| "LICENSE REQUIRED" | The device isn't joined or isn't in the licensed group. Microsoft notes a delay of up to one hour after adding the device |
| "CAN'T VERIFY LICENSE" | The device can't reach the licensing service. The device license lasts 90 days, and this message usually appears about 10 days before it expires. If the user's account has a proxy but SYSTEM doesn't, set the SYSTEM proxy with BITSAdmin |
| Fleet view | Microsoft 365 Apps admin center → Health → Licensing lists devices that failed to activate with a device license |
Switching a PC from user-based or shared computer activation to device-based needs an activation reset first. On RDS, Microsoft says device-based licensing needs enough licenses for the clients that connect, and it doesn't support licensing token roaming or offline activation.
Step 8: Reset activation, the narrow way (only after the read)
Microsoft's reset article is written for three situations: a tenant-to-tenant migration, repurposing a device for a different user, and changing the license mode. Use it when Steps 1–7 point there, from narrowest to broadest:
-
One product, one PC:
vnextdiag.ps1 -action remove -LicenseId <EWW... from the list output>forces reactivation of that product. Microsoft notes that deleting the files in the%localappdata%\Microsoft\Office\Licensessubfolder has the same effect. - The guided path on one PC: the Microsoft 365 activation troubleshooter in Get Help, run on the same PC (Windows 10 or later).
- Many PCs, or PCs you can't reach now: the Enterprise (command-line) version of the Microsoft Support and Recovery Assistant.
-
Microsoft's cleanup scripts:
OLicenseCleanup.vbs(licenses and cached account info) andsignoutofwamaccounts.ps1(Office's WAM tokens and accounts). Microsoft says the WAM script is safe and doesn't change SSO or device state on Entra joined and hybrid joined PCs, and it needs Windows 10 1803 or later.WPJCleanUp.cmdis only for Workplace Joined devices. Microsoft warns that clearing a WPJ account removes SSO for every app in the current Windows session, unenrolls the device from management tools, and unregisters it from the cloud.
Microsoft's activation articles also list registry edits (deleting HKCU\Software\Microsoft\Office\16.0\Common\Identity, adding NoDomainUser, deleting SignedOutADUser) and even temporarily turning UAC to Never notify. Treat those as last-resort, documented-and-reversible steps on one PC, back up the registry first, and put UAC back afterward.
Retest by opening one app as the user, then re-run vnextdiag.ps1 -action list and confirm the right email, tenant, and state before you close the ticket.
When a change is justified
| Finding | Prefer | Avoid |
|---|---|---|
| No license with the desktop apps, or the Apps service turned off | Assign the right license or turn the app on for that user | Reinstalling Office |
| License assignment error (no seats, conflict, usage location) | Fix that one reason, then Reprocess from Errors & Issues | Removing every license from the user and starting over |
| Wrong account in Office / extra work account | Sign out and in with the licensed account; disconnect the extra account | Resetting activation on the whole PC first |
Old tenant's email in vnextdiag
|
Reset activation for that product, then sign in with the new account | Re-imaging the PC |
| Shared PC without shared computer activation | Enable it (and reset existing activations), then reboot | Giving everyone the same "front desk" account |
| Plan doesn't support shared computer activation | Move those users to a plan that does | Toggling the registry value and hoping |
| RDS/VDI prompts every session | Licensing token roaming; check EnableADAL and FSLogix settings | Resetting activation on every logon |
| "Disabled device" | Enable the Entra device object (or re-register if deleted) | Leaving and rejoining Entra on a hunch |
| Proxy or firewall blocks activation | Allow the documented endpoints; set the WinHTTP proxy | Turning off security defaults tenant-wide to clear one ticket |
| Device-based "LICENSE REQUIRED" | Put the device in the one licensed group; wait up to an hour | Nesting the device group under the licensed group |
FAQ
Why does Microsoft 365 say Unlicensed Product when the user has a license?
The four common reasons Microsoft documents: Office is signed in with a different account than the licensed one, the license doesn't include (or has switched off) the Microsoft 365 Apps service, the PC holds an older activation from another user or tenant, or the PC hasn't reached the Office Licensing Service in more than 30 days. Check them in that order.
How do I check Office activation status from the command line?
For Microsoft 365 Apps, run vnextdiag.ps1 -action list from C:\Program Files\Microsoft Office\Office16 (or the Program Files (x86) folder for 32-bit Office on 64-bit Windows). It's included from Version 2104. ospp.vbs /dstatus is for volume-licensed Office only.
Why does a shared computer say "a shared computer license isn't available"?
Microsoft: the PC didn't get a licensing token for that user. Check that the user is licensed for Microsoft 365 Apps, that they signed in when the Activate Office dialog appeared, and that the PC can reach the internet. Then check that their plan supports shared computer activation.
What is reduced functionality mode?
Microsoft 365 Apps stays installed, but users can only view and print. Editing and creating documents are disabled. It happens when the license is removed, when the install is deactivated, when an unlicensed user opens the apps, or when the PC goes more than 30 days without contacting the licensing service.
Does reinstalling Office fix Unlicensed Product?
Usually not, because the license, the account, the cached activation, and the network all survive a reinstall. Microsoft does list removing extra copies of Office and running an online repair, so do that only when Step 4 shows more than one Office installed or the install itself is damaged.
Related posts
- "Your Organization Has Disabled This Device" (AADSTS135011) (the activation error that's really a disabled Entra device object)
- AzureAdPrt : NO in dsregcmd /status (repeated sign-in prompts on joined PCs, before you blame Office)
- Intune Microsoft 365 Apps Not Installing (when the suite never installed, so there's nothing to activate)
Free checklist
Office activation is an Entra sign-in like any other. Microsoft's activation allow list includes login.microsoftonline.com and enterpriseregistration.windows.net, and "Your organization has disabled this device" is a device-object problem, not an Office one. So a new "require MFA" or compliant-device Conditional Access policy can show up as a wave of activation tickets. Before you enforce, the free Conditional Access pre-enforcement checklist keeps break-glass accounts, pilot groups, and report-only review on one page:
If you want the rest of the Intune runway written down for the team (enrollment hygiene, compliance phasing, break/fix cards and read-only PowerShell snapshots), the Intune & M365 Admin Starter Pack pairs with this triage: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=microsoft-365-unlicensed-product
Admin Pack Studio; not affiliated with Microsoft. Steps 1–7 favor read-only checks: Licenses and apps, Errors & Issues, the Activations report, Get-MgUserLicenseDetail, File → Account → About, vnextdiag.ps1 -action list, registry and folder reads, dsregcmd /status, netsh winhttp show proxy, Get-NetConnectionProfile, and DNS lookups. Assigning or reprocessing licenses, turning services on, disconnecting accounts, removing credentials, enabling shared computer activation or token roaming, editing the registry, changing UAC, and resetting activation are deliberate changes. Change one layer at a time, retest with one app as the user, and check current Microsoft Learn for portal labels and supported versions.
Top comments (0)