Microsoft 365 Apps activation errors: Unlicensed Product, accounts and shared computers

When Microsoft 365 Apps can't confirm a license, the apps drop into a restricted mode and the title bar says Unlicensed Product. The cause is nearly always one of four things: the user isn't licensed for the apps, Office is signed in with the wrong account, the device or network can't complete activation, or a shared computer isn't set up for shared computer activation. In this post I'll show how to tell which one you're facing, fix it, and reset activation cleanly when needed.

Symptoms#

• The title bar of the Office apps shows Unlicensed Product or Non-commercial use / Unlicensed Product, and most features are disabled.
• Signing in to activate ends with We couldn't find any Office products.
• An activation dialog reports There's a problem with your account, Your organization has disabled this device or We are unable to connect right now.
• On a Remote Desktop Services host, a virtual desktop or a shared PC, users can view and print documents but can't create or edit them, or they're asked to activate again on every machine they use.

Why it happens#

Microsoft 365 Apps is licensed per user. On current versions the app caches the user's license in the profile under %localappdata%\Microsoft\Office\Licenses. With shared computer activation (SCA), it instead requests a licensing token for each user on each computer, stored under %localappdata%\Microsoft\Office\16.0\Licensing and valid for 30 days. Older, legacy licenses show up with ospp.vbs. Activation fails when any link breaks:

How to fix it#

1. Confirm the license includes the apps#

In the Microsoft 365 admin center, open Users › Active users, select the user and check Licenses and apps: the product must include Microsoft 365 Apps and the apps must be switched on. With Microsoft Graph PowerShell:

Connect-MgGraph -Scopes 'User.Read.All'
Get-MgUserLicenseDetail -UserId 'user@contoso.com' |
    Select-Object -ExpandProperty ServicePlans |
    Where-Object ServicePlanName -in 'OFFICESUBSCRIPTION', 'OFFICE_BUSINESS' |
    Select-Object ServicePlanName, ProvisioningStatus

You want Success for OFFICESUBSCRIPTION (Microsoft 365 Apps for enterprise, as in E3 and E5) or OFFICE_BUSINESS (Microsoft 365 Apps for business). If a group should have assigned it, see Group-based licensing errors in Microsoft 365.

2. Check which account Office is using#

In any Office app, open File › Account. Under Product Information, Belongs to should show the user's work account, and the account signed in at the top of the window should match. If a personal Microsoft account or another tenant's account is signed in, sign it out and sign in with the work account. If the PC has a second Office installation, such as a copy that came preinstalled, uninstall the one you don't use from Programs and Features and restart.

3. Rule out the device and the network#

• Your organization has disabled this device points at the device's registration in Microsoft Entra ID. Run dsregcmd /status and check the device object in the Microsoft Entra admin center; if it's disabled or was deleted, re-enable it or register the device again (see Dual state, Pending and duplicate device objects).
• We are unable to connect right now and other connection failures: activation needs TLS 1.2, a correct date, time and time zone, and access to the Microsoft 365 endpoints through your proxy and firewall, including any TLS inspection.
• There's a problem with your account or repeated sign-in prompts: sign out of Office and back in first. On Microsoft Entra joined and hybrid joined devices, Office signs in through Web Account Manager (WAM), so check device single sign-on with the Primary Refresh Token checks before you reset anything.

4. Shared computers: turn on shared computer activation#

Any device where several people use Office with their own accounts, such as Remote Desktop Services hosts, pooled virtual desktops and shift PCs, needs SCA. It's available in plans that include Microsoft 365 Apps for enterprise (for example Office 365 E3, Microsoft 365 E5 and Education A3 or A5), plans with desktop Project or Visio, and Microsoft 365 Business Premium, the only business plan that supports it. Business Standard doesn't, and SCA isn't available for Office for Mac.

Enable it with <Property Name="SharedComputerLicensing" Value="1" /> in the Office Deployment Tool configuration, with the Group Policy setting Use shared computer activation (Computer Configuration › Policies › Administrative Templates › Microsoft Office 2016 (Machine) › Licensing Settings), or in the registry. Microsoft 365 Apps for business can't use the Group Policy route. Restart the device afterwards, and reset activation (step 5) for users who activated before SCA was on.

# Should return 1 on a shared computer
Get-ItemPropertyValue 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -Name SharedComputerLicensing

# The signed-in user's SCA licensing tokens
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Office\16.0\Licensing" -ErrorAction SilentlyContinue

Tokens renew automatically while the user works, so the computer needs reliable internet access. On non-persistent virtual desktops, make the token roam: enable Specify the location to save the licensing token used by shared computer activation in the same policy folder and point it at a per-user folder in the roaming profile or on a network share. Single sign-on stops users being asked to activate on every machine.

5. Reset the activation state#

After a tenant-to-tenant migration, before reassigning a device, when switching license mode, or when nothing else helps, clear old licenses and cached accounts. Close all Office apps, then use one of Microsoft's methods:

• One device: the Microsoft 365 activation troubleshooter in the Get Help app, run on the affected Windows 10 or later PC.
• Many devices: the Enterprise (command-line) version of the Microsoft Support and Recovery Assistant, which can be scripted.
• Scripts: run OLicenseCleanup.vbs elevated to remove licenses and cached account data, and signoutofwamaccounts.ps1 to remove Office's WAM accounts without changing the device's join or SSO state. Run WPJCleanUp.cmd only on Workplace Joined devices: removing that registration unenrolls the device from management and ends SSO for the session.

The manual route clears both license folders, legacy keys (cscript ospp.vbs /dstatus, then /unpkey), the HKCU\Software\Microsoft\Office\16.0\Common\Licensing and Identity keys, and Office credentials in Credential Manager.

Verify the fix#

• In Word, File › Account shows the Microsoft 365 Apps subscription product, Belongs to shows the user's work account, and Unlicensed Product has gone from the title bar.
• The user can create and edit documents again, not just view and print them.
• On a shared computer, SharedComputerLicensing is 1 and a new token appears in the user's licensing folder (or your roaming location) after they open an app.

Prevent it next time#

• License the apps through groups and review assignment errors regularly.
• Choose the license mode before deployment: build SCA, token roaming and single sign-on into the build for RDS hosts, pooled desktops and shared PCs, rather than switching after users have activated.
• Add an activation reset to your device-repurposing and tenant-migration runbooks.
• Remove preinstalled consumer Office from your images so devices never carry two copies.

References#

• Unlicensed Product and activation errors in Office
• Overview of shared computer activation for Microsoft 365 Apps
• Reset activation state for Microsoft 365 Apps for enterprise