SysAdmins Frustrated With Microsoft Licensing

“Not sure if this is allowed, but we currently use MaaS360 to manage iOS devices. It is expensive and the support stinks. Otherwise, it works for us. I have been thinking about moving to InTune for a few different reasons. Cost - for us, InTune would be about 50% cheaper, and to have things on one platform. Wondering if anyone else out there has made this switch and, if so, do you regret it or have any suggestions? It is hard to really compare platforms. I am going to try a trial but that is goin”

“MS tend not to enforce their patents too hard. As long as you pay up the license costs yes :) per core, per vm? per desktop/laptop? depends on your specific contract with them probably ... [re: ZKCBDC Patented by Microsoft]”

“Long story short, am License manager/SAM guy at company (6000 employees), we have our licenses under control, even though our workstations aren't allowed to have any agent running other than SCCM. I'm proud of that, even though we have limited visibility. The Witch-King of Workstations has declared that only SCCM will run because other agents "take too much resources". Bullshit, but whatever. We had an unauthorized SaaS event, someone bought a subscription to an AI tool (used h”

“I agree, there are great community tools but Tenant Manager gives you a supported, polished all-in-one experience, rather than stitching together and maintaining several free community tools yourself.”

“This actually comes from the behavior of Microsoft employees themselves. Necessary password rotation with a remembered history used to be the recommendation for the industry, so Microsoft employees would create Batch scripts that would rotate their own password through a list of nonsense that exhausted the history before they got back to their "normal" password. This option was introduced in Group Policy as a result. Can't script it anymore!”

“before the agent 365 question, check what management means by copilot pro: it's a consumer subscription on personal microsoft accounts, it hasn't been sold since october 2025, and microsoft's support page says its support ended august 1, 2026. the business license is microsoft 365 copilot (recently renamed microsoft copilot, which won't help the confusion). one setting to decide on now: "multiple account access to copilot for work documents" in cloud policy is allowed u”

We do all of our Microsoft licensing through Connection.

“Just off the back of an MS support ticket, We got some info but left with more questions than answers, as MS are reluctant to explain out of the bounds of the break fix. So we are currently using the default MS passkey with both types and no attestation. I am trying to make specific keys for certain types of users. I believe this is the correct way? I am looking at making the following Auth Strengths EA Admin Auth (with Attestation)? Using YubiKey Flows Microsoft Authenticator (iOS”

Great info, was wondering about Powershell.

“Hello! I help with the IT in one of four offices for a small company. We've been planning to move away from MS products for a while. We slowly started to get that ball rolling by replacing Outlook with Thunderbird in three of the four offices recently - the office I'm at is still on Outlook. One thing that's very important for our work is a smoothly working calendar. Outlook has actually been pretty good in that regard. Since the switch to Thunderbird, the other three offices have st”

“In the US and Canada we have corporate officers registered for all entities which is generally what's used. In the UK we have corporate officers registered for 99.9% (probably higher actually...) of organisations, which is always a concern for those of us in the 0.01%”

“We are having a lot of delays provisioning new Microsoft licenses for our clients. From 30 minutes to 2 hours. Is anyone else having trouble? submitted by /u/Savings_Property6422 [link] [comments]”

“What's the difference (if there is any) between these 2 licenses? The first costs ~$28/mo and the latter is ~$22 but doesn't include Outlook and office apps. submitted by /u/NSFW_IT_Account [link] [comments]”

“If the child company isnt too huge maybe look at just migrating all of your systems over to their networks. It may be more work but it's cleaner.”

“Well, if you only need office and a File share On Prem makes no sense since MS forces you to pay for their cloud stuff anyway :D (Unless you buy the ltsc apps but I digress)”

“I resell through TD SYNNEX. I can quote Business Premium and compare it to your current Microsoft pricing.”

“Hi, Currently we purchase our licenses directly through Microsoft. It's extremely easy. As we are about to move to Business Premium we got a quote from reseller (CDW) and are considering that move. Does any one have any insights into the pros & cons of buying direct vs a reseller. Thank you T submitted by /u/JustaWelshMan [link] [comments]”

“As long as MS has Active Directory / Entra, and the Office suite, they're never going to be hurting. That's a significant cash flow, most people probably cannot fathom. Especially now that nearly everything enterprise is a subscription.”

“Renewed our Microsoft Partner Expanded Benefits earlier this week! While going through the yearly ritual of redeeming all the licenses included in the package, which admittedly was a LOT easier this time*, I noticed that the Business Premium license wasn't EEA but only _after_ I already redeemed it. We're in the EEA so we need the EEA SKU, right? So here I go and open a ticket with Microsoft support, expecting at least a week for it to get fixed. Ended up in a Teams call with a rep withi”

“We're getting sent in circles by our MS team regarding RPA virtual machines. What are you all doing for these types of things? Here's our use case: We have an RPA software script (think Selenium or similar) configured set that runs software on a virtual machine that is Windows 11, local users only, no humans involved RPA software doesnt use any part of 365. Right now they are all using unique local users on each device. Dont even need a windows license Currently sitting at ~300 VM's”

“Well in True Zero Trust you can't have all your core services handled by one provider so you need to move each functional area off M365.”

Back when I used the old open licenses, in the remote desktop licensing manager I needed to select the program "OPEN License". Then enter a license number which was the License-ID from…

If they have admin rights they already control the device

“I'm really sorry that that is the position you're in. See if you can sell upper manage to the business of operating this way. Make them understand that it will cost them money in the long run and if you can't leave. Dust off your resume. See what else is out there. No the market's hard but it's not impossible”

“Spin up a test user and try it.. you will not have to guess... you will know ..”

“SID - but yes, agreed. Can't stand when people permanently delete users and then NTFS perms somewhere just shows S-1-5-12345-67890... Like wtf”

“Nope! We have M365 E5 licenses currently and we were told we needed E365 E7 for those features 🙄. Good old Microsoft. I don’t think we’re going to upgrade our licenses for that, but if that fits your needs it may be worth it. We were told that only the admins setting the policies need the E7 license.”

“You don't check manually you check with powershell and api's. It is narrow minded to just check 365 when accounts and licensing in other systems exists and require removal.”

“I've inherited some Windows machines that were set up using Intune, and have for some reason gotten stuck at various Office versions from the past few months, such as 2605 on Monthly Enterprise Channel. Windows update and the built-in update checker in the Office applications say that they are up-to-date and don't find anything new. I've tried to find if there are any specific versions set in the registry: Cloud Update policy: HKLM\SOFTWARE\Policies\Microsoft\Cloud\Office\16.0\Common”

“Office license, like in physical per seat/device? With 300+ endpoints you should have been on volume licensing 30+ years ago. Ziploc bags kill me. Had a Dir of Finance that printed and filed any important e-mails. At least it helped when we canned an incomputent Dir of IT.”

“Another example confirming that to truly own data you need to have proper backup in place and at least some recovery plan to restore business services without Microsoft. This sucks but, if it were to happen to my environment it would probably mean we would bite the bullet and move away from M365 entirely. It would suck, it would be painful and there would be chaos for the first 2 weeks (luckily to restore basic business functionality we’d only need to move email and import most recent project da”

“That usage based part is what worries me too. License count used to be relatively straightforward, now you also need to understand actual usage before you can tell a customer what they’ll realistically spend Two weeks to figure that out across a whole tenant is pretty rough.”

“the wildest part of microsoft licensing isn’t the complexity it’s getting 3 different answers from 3 different reps. At this point, I’d trust the documentation before I trust “my rep said it’s fine"”

“non-profit You might not want to hear this but MS doesn't really give a fuck if your a non-profit or not. If you can't pay their premium support don't expect premium support.”

“I mean they could look at invoice history, account creation history, number of licenses held, as well as just any custom domain tied to the account. Most of these could probably be verified with a few hours. If it is at the point where we assume an attacker is standing up all of this and maintaining reasonable activity (adding licenses as the organization grows, creating new users, sensing and recieving mail to said accounts, and setting up custom domains (the legitimate domain of a organization”

“Oh yea, direct partners are a different beast, and they need to buy unified regardless.”

“Agreed there, Pax8 doesn't hold the Microsoft partner support services designation so I wouldn't hold my breath.”

“I wouldn’t hold my breath on Pax8 or equivalent being able to unravel a mess like this.”

“TLDR: Offline activation via https://aka.ms/aoh requires a captcha, MS account login and 2FA once per client, with ~80 to go. Any tips on speeding this up? I'm just kinda curious about the opinion of other Sysadmins that have to work with Windows clients. I work as a sysadmin at the factory of a fairly large company, where we mainly use Windows for our production floor clients. To extend the amount of support we get for each client, we have a standardized image, which gets updated every few”

In similar veins to the following two recent Reddit posts, I'm posting here because it appears they gained traction with Microsoft and ultimately reached someone who could help. I'm hoping someone from…

“No - as long as all the domain controllers have a minimum OS version that matches the domain function level, you'll be fine. If you're looking to upgrade your controllers, it's normal to get new DC's (with newer OS version) online and replicating, roles shifted, get the old DC's decommed, then upgrading the functional level to whatever version OS you upgraded to.”

Just swap to intune?

“I think you’re overcomplicating it a bit. If SASE is always on and devices are already trusted before MFA, I’d focus on giving them the minimum AD connectivity they actually need rather than trying to make everything work pre-MFA.”

“CAL licensing can definitely be confusing. It’s worth checking the exact Microsoft licensing terms.”

“Seen the same uptick the last couple weeks. Check the Service Health Dashboard in the M365 admin center first; there have been intermittent identity service hiccups that throw those generic validation errors. Are your affected users on shared machines or their own dedicated laptops?”

“Recently I've seen a pretty significant uptick in users experiencing various errors relating to not being able to validate their office license. So far I've seen: Account Validation Error Code 0x0 Something went wrong. tag [7ita9] Something went wrong. tag [5fcl8] Context: We upgraded to 365 in the later part of last year and have had hardly any issues since the upgrade. These all started happening within the last 2 weeks and up until now I've never had issues with users accessing 36”

“yh. all im saying is that there doesnt need to be an apple ID signed in on the apple device for it to get apps (When pushed via intune)”

“I'll be upfront: I run a small nonprofit and I am very much not a tech person. Our IT guy left earlier this year and since then I've been the one fielding all the Microsoft-related issues for our organization. We use a bunch of Microsoft products, Teams, SharePoint, some Azure stuff I barely understand, and when things break I genuinely don't know where to turn. Someone on our board mentioned we should look into Microsoft Unified Support as a way to get professional help when things”

“I think it got an option in the installer to join at install time by then. You used to have to install with a local account, then join the domain with a tool they wrote.”

“This. If you have M365, Microsoft recently started adding Cloud PKI support into some licenses rather than charging $3/user to enable it.”

“Why would you want an AD replacement if you’re not using Windows? You’d simply use any one of a number of MDM platforms that supports macOS instead. As for the rest, you can absolutely do it. Macs with ADE/DEP and MDM. Google Workspace and Zoom. Synology. I’ve got clients that run this exact stack.”

“There are a lot of LDAP solutions, but you have to find one that works with okta or fa solution. Then you bring in something line duo to come in and do smart card auth or biometric, then you bring in Google Docs that has very basic capabilities where you need to track on quite a bit And I haven’t even really touched security, infrastructure, dlp yet. This is what I mean by home brew, you are Frankensteining solutions together.”

“Hey mate perhaps you can assist me then I cannot for the life of me get policies deployed to enrolled devices no matter what I do”

“Yeah - and my point is that at least Exchange on-premises has a 'leg up' in terms of auditing, litigation holds, eDiscovery etc, compared to other products, and Microsoft could be pressured to bring the advanced DLP capabilities on-premises. It should be easier for them to do this than anyone else.”

“We had the same issue with clients not automatically checking in at some point. Either you tell users to open the Intune app every time they log on, or create a systemd timer that automatically triggers a sync (i believe I saw this exact solution somewhere here on r/sysadmin ).”

👀 why, what are you paying and is it remote

“Some industries not only still use on premise AD but require it because of compliance requirements making it so only the appropriate Microsoft 365 licenses make it more cost prohibitive. Other examples include companies who prefer purchasing hardware because 1. They own it (compared with a cloud solution which essentially they rent monthly/annually forever) 2. Because they own the hardware they may be able to depreciate the cost over time (this is a potential tax benefit for businesses). And the”

“I plan once my company’s ERP change goes through to convince my boss to move to full intune and get rid of hybrid. He wants to go full cloud but wants to put a DC in the cloud to authenticate which can work but I more so think we should get rid of it. But he wants proof first that intune and full entra can do the needed group policies he wants so that will be my next focus after more familiarization with Azure fully”

“You will see them a lot more soon with windows 365. It works well enough and with intune supporting is identical to standard machines mostly.”