Microsoft 365 Unlicensed Product: A Read-First License, Account, Activation Mode, and Token Triage

Helpdesk: "Dana's Word says UNLICENSED PRODUCT across the top and won't let her edit. The front-desk PC everyone shares says 'a shared computer license isn't available.' Sam, who moved over from the acquired company's tenant last week, gets 'We couldn't find any Office products.' And the laptop we re-imaged for the new hire says 'Your organization has disabled this device.' Can you just reinstall Office on all of them?"

Don't reinstall yet. "Microsoft 365 Unlicensed Product" is usually one broken layer in a documented chain, not broken Office: the user has no license that includes the desktop apps (or the apps were switched off inside the license) → Office is signed in with the wrong account, or a second work account is in the way → the PC is in a different activation mode than you think (user, shared computer, device-based, viewer mode) or still holds an old activation → the device identity or the token broker is broken (disabled device object, blocked BrokerPlugin, no PRT) → the PC can't reach the Office Licensing Service (proxy, firewall, TLS, NCSI, more than 30 days offline). The admin center, the Activations report, File → Account, Microsoft's vnextdiag.ps1, dsregcmd /status, and a few read-only network checks are the sources for that chain. Running Microsoft's broadest cleanup on a Workplace Joined PC removes single sign-on for every app in that Windows session and unregisters the device.

If the message is "Your organization has disabled this device" (often with 135011), start with "Your Organization Has Disabled This Device" (AADSTS135011). If Office never installed in the first place, use Intune Microsoft 365 Apps Not Installing. This post covers "Office is installed, but the title bar says Unlicensed Product (or a related activation message), and you need a read-first path before you reset activation, remove accounts, or reinstall."

TL;DR

• Read the exact banner text first. "We couldn't find any Office products," "a shared computer license isn't available," "LICENSE REQUIRED," and "Your organization has disabled this device" are different layers with different fixes.
• License first, and check the apps inside it. Microsoft: removing a user's license puts their installs into reduced functionality mode and they see Unlicensed Product. A license whose Microsoft 365 Apps service is switched off behaves the same way. Business Basic has no desktop apps at all.
• Microsoft 365 Apps stays activated only if the PC reaches the Office Licensing Service at least once every 30 days. Past that, it drops into reduced functionality mode until it reconnects.
• Find out which mode the PC is in before you touch anything. File → Account → About shows a License ID starting with EWW (Microsoft 365 Apps), "Shared Computer Activation," or "Belongs to: This device" (device-based). vnextdiag.ps1 -action list shows the license type, state, the email that activated it, and the tenant ID.
• ospp.vbs no longer reports Microsoft 365 Apps activation (since Version 1910). Use vnextdiag.ps1. ospp.vbs is still the tool for volume-licensed Office (LTSC 2021, 2019).
• Reset activation last, and pick the narrow method. vnextdiag.ps1 -action remove resets one product. Microsoft's full cleanup (OLicenseCleanup, sign out of WAM accounts, WPJ cleanup) is broader. WPJ cleanup removes single sign-on for every app in that Windows session and unregisters the device.

Where in the chain did it break?

Step 1: Capture the exact symptom (read-only)

Write these facts on the ticket before anyone resets activation or reinstalls Office:

Step 2: The license and the apps inside it (read-only)

Microsoft's licensing overview is direct: users need a Microsoft 365 Apps license before they can install and activate, and if you remove a user's license, their installs enter reduced functionality mode. Microsoft's license-assignment page adds that a user who loses the license and still has the apps installed sees Unlicensed Product.

In the Microsoft 365 admin center → Users → Active users → the user → Licenses and apps, check three things:

1. A license that includes the desktop apps. Microsoft notes that Microsoft 365 Business Basic has no Office desktop apps to install, only the web apps.
2. The app inside the license is on. Admins can turn apps and services on or off within a license. A license with the Microsoft 365 Apps service switched off reads as "licensed" at a glance and still produces Unlicensed Product.
3. No assignment errors. In Billing → Licenses → the product → Errors & Issues, Microsoft lists the common reasons a license didn't land: no available licenses, conflicting services or license plans, and an invalid usage location.

# Read-only (Microsoft Graph PowerShell)
# Connect-MgGraph -Scopes 'User.Read.All'
Get-MgUserLicenseDetail -UserId 'dana@contoso.com' |
  Select-Object SkuPartNumber -ExpandProperty ServicePlans |
  Where-Object ServicePlanName -like 'OFFICESUBSCRIPTION*' |
  Select-Object SkuPartNumber, ServicePlanName, ProvisioningStatus

OFFICESUBSCRIPTION is the service plan name Microsoft's "Product names and service plan identifiers" reference lists for the Microsoft 365 Apps desktop apps in the common enterprise SKUs. If nothing comes back, drop the Where-Object line, list every plan, and confirm against that reference for your SKU. Read ProvisioningStatus: Microsoft documents Success, Disabled (service turned off), Error, PendingInput, PendingActivation, and PendingProvisioning.

Two timing notes from Microsoft:

• New license, same day: Microsoft recommends assigning the license 24 hours before you deploy, so it's provisioned when the user first opens an app.
• License removed and re-added: Microsoft's activation articles list unassigning and reassigning the license as a troubleshooting step. That's a change, so it belongs in Step 8, not here.

How many devices has this user activated? Microsoft allows each license on up to five PCs or Macs, five tablets, and five phones. Since Version 1910, a user isn't prompted to deactivate another device. If they activate on more than 10 devices, the one unused for the longest time is deactivated automatically (Windows only), and that device drops into reduced functionality mode. The admin view is Reports → Usage → Microsoft 365 apps → Activations: product licenses, last activated date (UTC), counts per platform, and Used Shared Computer Activation. User names are hidden in usage reports by default until an admin turns on user details.

Step 3: Which account is Office signed in with? (read-only on the PC)

Most "I'm licensed, Office says I'm not" tickets are the wrong identity:

# Read-only, as the user: work or school accounts Windows knows about
dsregcmd /status | Select-String 'AzureAdJoined','WorkplaceJoined','TenantName'

# Read-only: cached Office credentials (names only)
cmdkey /list | Select-String 'MicrosoftOffice'

# Read-only: OneAuth account files (Microsoft says to read account_hints before changing anything)
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\OneAuth\accounts" -ErrorAction SilentlyContinue |
  Select-Object Name, LastWriteTime

Step 4: Which activation mode is the PC in? (read-only on the PC)

Microsoft 365 Apps can run in several licensing modes, and a PC set up for one while you troubleshoot another wastes the afternoon:

Microsoft's newer activation method (since Version 1910) has three tells: the EWW License ID, values of 2 under HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext, and per-product license files under %localappdata%\Microsoft\Office\Licenses. Shared computer tokens live in %localappdata%\Microsoft\Office\16.0\Licensing (or the roaming folder you configured).

# Read-only, as the user
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -ErrorAction SilentlyContinue |
  Select-Object SharedComputerLicensing, *DeviceBasedLicensing*, SCLCacheOverride, SCLCacheOverrideDirectory

Get-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext' -ErrorAction SilentlyContinue

Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Office\Licenses" -Recurse -ErrorAction SilentlyContinue |
  Select-Object FullName, LastWriteTime
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Office\16.0\Licensing" -ErrorAction SilentlyContinue |
  Select-Object Name, LastWriteTime

# Microsoft's activation report (included with Microsoft 365 Apps Version 2104+). 'list' only reads.
$od = 'C:\Program Files\Microsoft Office\Office16'
if (-not (Test-Path "$od\vnextdiag.ps1")) { $od = 'C:\Program Files (x86)\Microsoft Office\Office16' }
& "$od\vnextdiag.ps1" -action list

Microsoft says vnextdiag.ps1 -action list shows, per product: the license type (for example User|Subscription), the product (for example O365ProPlusRetail), the state (for example Licensed), the email of the user who activated it, and the tenant ID. Shared computer activation and device-based licensing show up there too. The 32-bit-on-64-bit path is the Program Files (x86) folder, as above.

Step 5: Device identity and the token broker (read-only on the PC)

On Entra joined, hybrid joined, and Workplace Joined PCs, Office activates through Web Account Management (WAM). Microsoft's reset article uses dsregcmd /status to tell them apart:

WorkplaceJoined : YES in the User State section means the device is Workplace Joined (Microsoft Entra registered).

# Read-only: device and user state that activation depends on
dsregcmd /status | Select-String 'AzureAdJoined','EnterpriseJoined','DomainJoined','WorkplaceJoined','DeviceAuthStatus','AzureAdPrt '

# Read-only: is the BrokerPlugin package present for this user?
Get-AppxPackage -Name 'Microsoft.AAD.BrokerPlugin' | Select-Object Name, Version, Status

Step 6: Can the PC reach the licensing service? (read-only on the PC)

Microsoft: each day, or each time the user signs in, the PC contacts the Activation and Validation Service. If it goes more than 30 days without connecting, Microsoft 365 Apps enters reduced functionality mode until it reconnects, and the user may have to sign in again. Microsoft 365 Apps won't work on PCs that are completely cut off from the internet. For those, Microsoft points at Office LTSC with KMS or Active Directory-based activation instead.

Microsoft's network checks, in the order the activation articles give them:

• TLS 1.2 enabled by default in the OS (older systems need an update, and those systems aren't supported for Microsoft 365 Apps anymore).
• Date, time, and time zone set correctly. Microsoft's support article says wrong settings can make activation fail.
• WinHTTP proxy. Microsoft's fix uses netsh winhttp set proxy. Read the current value first.
• Firewall allow list, including ols.officeapps.live.com/olsc, activation.sls.microsoft.com, odc.officeapps.live.com, officeclient.microsoft.com, login.microsoftonline.com, login.windows.net, enterpriseregistration.windows.net, officecdn.microsoft.com, and the crl.microsoft.com CRL paths. See Microsoft's activation article for the full list.
• NCSI. Get-NetConnectionProfile should show IPv4Connectivity : Internet. NoTraffic or LocalNetwork means Windows doesn't think it's online.
• Services running: Network Connected Devices Auto-Setup, Network List Service, Network Location Awareness, and Windows Event Log.
• External DNS. An MSOID CNAME pointing at clientconfig.partner.microsoftonline-p.net.cn is only for Microsoft 365 operated by 21Vianet. Anywhere else it causes a "custom domain isn't in our system" error and blocks activation.

# Read-only, on the user's PC
netsh winhttp show proxy
Get-NetConnectionProfile | Select-Object Name, IPv4Connectivity, IPv6Connectivity
Resolve-DnsName dns.msftncsi.com -ErrorAction SilentlyContinue | Select-Object -First 1 Name, IPAddress

Get-Service -DisplayName 'Network Connected Devices Auto-Setup','Network List Service',
  'Network Location Awareness','Windows Event Log' | Select-Object DisplayName, Status

# Direct TCP 443 reachability (doesn't go through the WinHTTP proxy; a pass here isn't proof the proxy allows it)
'ols.officeapps.live.com','activation.sls.microsoft.com','odc.officeapps.live.com',
'officeclient.microsoft.com','login.microsoftonline.com' | ForEach-Object {
  [pscustomobject]@{ Host = $_; Tcp443 = (Test-NetConnection $_ -Port 443 -WarningAction SilentlyContinue).TcpTestSucceeded }
}

# Read-only: the MSOID record for your custom domain (expect nothing outside 21Vianet)
Resolve-DnsName "msoid.contoso.com" -Type CNAME -ErrorAction SilentlyContinue

Works at home, fails in the office? That's the proxy or firewall, not the license.

Step 7: Shared computer, RDS/VDI, and device-based licensing (read-only)

Shared computer activation

RDS or VDI users prompted to activate every session? Microsoft's first answer is licensing token roaming (Version 1704+), set with Group Policy, the Office Deployment Tool (SCLCacheOverride and SCLCacheOverrideDirectory), or the registry. Other documented checks: RDS servers joined to Entra ID with password hash sync and Seamless SSO; EnableADAL = 1 under HKLM\SOFTWARE\Microsoft\Office\16.0\Common\Identity; with FSLogix and SSO, IncludeOfficeActivation = 0 under HKLM\SOFTWARE\Policies\FSLogix\ODFC; and when the FSLogix Office container runs beside another profile solution, exclude the Licensing folder (and the other Office folders Microsoft lists) from that solution.

# Read-only, on the RDS/VDI host
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\Identity' -Name EnableADAL -ErrorAction SilentlyContinue
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\FSLogix\ODFC' -Name IncludeOfficeActivation -ErrorAction SilentlyContinue

Device-based licensing

Switching a PC from user-based or shared computer activation to device-based needs an activation reset first. On RDS, Microsoft says device-based licensing needs enough licenses for the clients that connect, and it doesn't support licensing token roaming or offline activation.

Step 8: Reset activation, the narrow way (only after the read)

Microsoft's reset article is written for three situations: a tenant-to-tenant migration, repurposing a device for a different user, and changing the license mode. Use it when Steps 1–7 point there, from narrowest to broadest:

1. One product, one PC: vnextdiag.ps1 -action remove -LicenseId <EWW... from the list output> forces reactivation of that product. Microsoft notes that deleting the files in the %localappdata%\Microsoft\Office\Licenses subfolder has the same effect.
2. The guided path on one PC: the Microsoft 365 activation troubleshooter in Get Help, run on the same PC (Windows 10 or later).
3. Many PCs, or PCs you can't reach now: the Enterprise (command-line) version of the Microsoft Support and Recovery Assistant.
4. Microsoft's cleanup scripts: OLicenseCleanup.vbs (licenses and cached account info) and signoutofwamaccounts.ps1 (Office's WAM tokens and accounts). Microsoft says the WAM script is safe and doesn't change SSO or device state on Entra joined and hybrid joined PCs, and it needs Windows 10 1803 or later. WPJCleanUp.cmd is only for Workplace Joined devices. Microsoft warns that clearing a WPJ account removes SSO for every app in the current Windows session, unenrolls the device from management tools, and unregisters it from the cloud.

Microsoft's activation articles also list registry edits (deleting HKCU\Software\Microsoft\Office\16.0\Common\Identity, adding NoDomainUser, deleting SignedOutADUser) and even temporarily turning UAC to Never notify. Treat those as last-resort, documented-and-reversible steps on one PC, back up the registry first, and put UAC back afterward.

Retest by opening one app as the user, then re-run vnextdiag.ps1 -action list and confirm the right email, tenant, and state before you close the ticket.

When a change is justified

FAQ

Why does Microsoft 365 say Unlicensed Product when the user has a license?
The four common reasons Microsoft documents: Office is signed in with a different account than the licensed one, the license doesn't include (or has switched off) the Microsoft 365 Apps service, the PC holds an older activation from another user or tenant, or the PC hasn't reached the Office Licensing Service in more than 30 days. Check them in that order.

How do I check Office activation status from the command line?
For Microsoft 365 Apps, run vnextdiag.ps1 -action list from C:\Program Files\Microsoft Office\Office16 (or the Program Files (x86) folder for 32-bit Office on 64-bit Windows). It's included from Version 2104. ospp.vbs /dstatus is for volume-licensed Office only.

Why does a shared computer say "a shared computer license isn't available"?
Microsoft: the PC didn't get a licensing token for that user. Check that the user is licensed for Microsoft 365 Apps, that they signed in when the Activate Office dialog appeared, and that the PC can reach the internet. Then check that their plan supports shared computer activation.

What is reduced functionality mode?
Microsoft 365 Apps stays installed, but users can only view and print. Editing and creating documents are disabled. It happens when the license is removed, when the install is deactivated, when an unlicensed user opens the apps, or when the PC goes more than 30 days without contacting the licensing service.

Does reinstalling Office fix Unlicensed Product?
Usually not, because the license, the account, the cached activation, and the network all survive a reinstall. Microsoft does list removing extra copies of Office and running an online repair, so do that only when Step 4 shows more than one Office installed or the install itself is damaged.

Related posts

• "Your Organization Has Disabled This Device" (AADSTS135011) (the activation error that's really a disabled Entra device object)
• AzureAdPrt : NO in dsregcmd /status (repeated sign-in prompts on joined PCs, before you blame Office)
• Intune Microsoft 365 Apps Not Installing (when the suite never installed, so there's nothing to activate)

Free checklist

Office activation is an Entra sign-in like any other. Microsoft's activation allow list includes login.microsoftonline.com and enterpriseregistration.windows.net, and "Your organization has disabled this device" is a device-object problem, not an Office one. So a new "require MFA" or compliant-device Conditional Access policy can show up as a wave of activation tickets. Before you enforce, the free Conditional Access pre-enforcement checklist keeps break-glass accounts, pilot groups, and report-only review on one page:

👉 https://cashflow4375.gumroad.com/l/ujkqxb?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=microsoft-365-unlicensed-product

If you want the rest of the Intune runway written down for the team (enrollment hygiene, compliance phasing, break/fix cards and read-only PowerShell snapshots), the Intune & M365 Admin Starter Pack pairs with this triage: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=microsoft-365-unlicensed-product

Admin Pack Studio; not affiliated with Microsoft. Steps 1–7 favor read-only checks: Licenses and apps, Errors & Issues, the Activations report, Get-MgUserLicenseDetail, File → Account → About, vnextdiag.ps1 -action list, registry and folder reads, dsregcmd /status, netsh winhttp show proxy, Get-NetConnectionProfile, and DNS lookups. Assigning or reprocessing licenses, turning services on, disconnecting accounts, removing credentials, enabling shared computer activation or token roaming, editing the registry, changing UAC, and resetting activation are deliberate changes. Change one layer at a time, retest with one app as the user, and check current Microsoft Learn for portal labels and supported versions.