Students cannot activate Office 365

[Matt Strickland]

Hi all,

Another nagging issue, some of our students for which have new/refreshed devices, download & install office and sign in successfully, but are prompted that they are in 'view only' mode, and are unlicensed and need to contact their admin.

All students are assigned A5 licences by licence group (in Azure AD > Licences)

"Microsoft 365 A5 for students use benefit" for which "Microsoft 365 Apps for Enterprise" is enabled (all 41/41 services plans)

In Office activation I don't see any activation's of office for these students, but I do see recent activation's from other students, and staff.

Student's can see their activation's in their profile but have not used more than 5 devices.

How do I go about finding the cause?

Matt

[David Keenleyside]

Do you use device licenses?

In which case you may need to put these devices into the group to which those apply.

Regards,

David Keenleyside, BSc CS & IS, CTech
ITP Associate
EFF Member
ICT Technician
Glenfield College
PO Box 40176 (Kaipatiki Rd)
Glenfield, Auckland City 0629

Ph:       +64 9 444 9066 ext 677
DDI:    +64 9 441 9779
Email:    d.keen...@gc.ac.nz
https://itp.nz/CTech/NZ160799
https://www.linkedin.com/in/david-keenleyside-626871/
The Three O’s of Backup: Online, Offline, Offsite.
The Three RA’s of Cloud: Run Anywhere, Run Anytime, Run Agnostic.

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/499389ae-f681-42a4-a09c-00edb0d056c2n%40googlegroups.com.

[Matt Strickland]

School devices for staff use shared activation, school devices for students use device activation (particularly any used for SAC 'computer use' exams)

But these are just the user based licences assigned to students, limited to 5 devices.

With a test student I assigned a licence, opened word and signed in and it said 'Unlicensed Product', but knows what the subscriptions 'contains'

After 2-3 close/opens its now licenced. But this hasn't been the case for some students, its unlicenced for days or weeks.

I don't see the activation in the portal yet - these lag several days.

[Marlon Yu]

Are these students signing in on shared devices?

 

Marlon

 

From: 'Matt Strickland' via Techies for schools <techies-f...@googlegroups.com>
Sent: Monday, 18 July 2022 5:38 pm
To: Techies for schools <techies-f...@googlegroups.com>
Subject: Re: [techies-for-schools] Students cannot activate Office 365

 

CAUTION: This email originated from outside of Rangitoto College. Be careful about clicking on links or opening attachments. If in doubt, ask IT.

 

School devices for staff use shared activation, school devices for students use device activation (particularly any used for SAC 'computer use' exams)

But these are just the user based licences assigned to students, limited to 5 devices.

 

With a test student I assigned a licence, opened word and signed in and it said 'Unlicensed Product', but knows what the subscriptions 'contains'

After 2-3 close/opens its now licenced. But this hasn't been the case for some students, its unlicenced for days or weeks.

 

I don't see the activation in the portal yet - these lag several days.

 

 

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/ba649723-ed1c-4f92-aed8-ad487e37da78n%40googlegroups.com.

*** RANGITOTO COLLEGE EMAIL DISCLAIMER ***

The contents of this email and any attachments are confidential and may be legally privileged. If you are not the intended recipient please advise the sender immediately and delete the email and attachments. Any use, dissemination, reproduction or distribution of this email and any attachments by anyone other than the intended recipient is prohibited.

*** RANGITOTO COLLEGE EMAIL DISCLAIMER ***

[Jono Green]

I'm not in front of my PC for the correct link but have you checked the dstatus? https://docs.microsoft.com/en-us/answers/questions/313449/unable-to-check-o365-subscription-license-status-w.html

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/SYXPR01MB13605CD789F8101611399DA0B88C9%40SYXPR01MB1360.ausprd01.prod.outlook.com.

[Matt Strickland]

These are all student owned/BYOD devices.

The latest one a new Mac - students sign into office.com with their school account, click the install office button, go through the process and sign in.

Sign in is successful, document history is loaded, but office is read only.

I don't have devices in front of me until next week. I don't recall ever looking at activation status on mac apart from within the application.

Matt

[aje...@timarugirls.school.nz]

I had a similar problem on my Mac at home. The only solution I found was to create a new local user (machine login) and then sign into Office. Once that was working I transferred all my Mac documents from the old local user account to the new one.

BYOD Windows PC's can also get confused between personal and school (work) O365 login's, especially if the user logs into the machine using a personal Microsoft account, so I always create a local user (machine login) for "School/Work" on a BYOD and then login to the School O365 user account from within that. That ensures there isn't any mixing of School and Personal settings.

Alan

[Alistair Baird]

I'm wondering if it's a microsoft account thing where you are asked to create a microsoft account to activate windows (even if you only use a local user, they still ask you to create one to activate it) and thus they are still logged in on their browser or machine in the background. Alternately they have an old hotmail account or a new outlook.com account they use to check their private email - once logged in to that (even if using a web Outlook), you are using that MS account, not your school one. Had that on a mac user once. When you open word, it shows the 'other' account logged in, I kept logging them out and back in on the school credentials, only for them to complain a week later and I saw they were logged in with their hotmail. They said they just click on an email attachment like Word or Excel and when it opened, they needed their hotmail to open the file or something.

Convinced them to use Firefox for hotmail, then chrome for everything else.

As you say, until you are in front of a machine, difficult to work through.

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/cbfdd4be-e4ec-4b77-846e-9b8705ee9ca1n%40googlegroups.com.

--

Kind regards,
Alistair Baird
IT Manager

P  06 354 4198 stpeterspn.school.nz   @stpeterspn 1 Holdsworth Avenue, Milson Palmerston North, 4414

[Matt Strickland]

Once I see a screen ill take a look... but I do have our O365 logon branded with logo, back image etc so its clearly obvious when its a School/Workplace account vs a Microsoft/Personal one.

On PC I don't get the option to choose when signing into office, at least using a students email address.

But I do for my school account; I do have a Microsoft account associated with my Workplace email address.

I'f someone knows if I can track activation attempts as an admin without needing the client, let me know. I only know of reporting in the Admin center, which looks to only log successful activations.

Matt

[Alistair Baird]

Do you use Azure? You'll get access to endpoint manager as well which should give you all the stats.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/22c61c96-4bba-4b4d-9363-c53a69420d9en%40googlegroups.com.

[Jono Green]

MEM is hosted off the Azure portal but the rights are included within the A3/A5. I had a similar thought but wasn't sure if it would show activations. 

I'll have a quick hunt in the morning.

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/22c61c96-4bba-4b4d-9363-c53a69420d9en%40googlegroups.com.

--

Kind regards,
Alistair Baird
IT Manager

P  06 354 4198 stpeterspn.school.nz   @stpeterspn 1 Holdsworth Avenue, Milson Palmerston North, 4414

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/CAKQ0vHosbup1rnVb5idkQ%3Dopn7_qYi9F2B7gSYmgkkmEZF9WXQ%40mail.gmail.com.

[Sam McNeill]

Hi Matt,

Check your AzureAD Sign in Logs for auditing and you can filter by user/application attempting the authentication. Narrow it by approx. time and you should get visibility into this. I've got some reference to these logs for audit purposes in this blog (I show how a student was doing an AAD auth via PowerShell and this is logged):

Friday Fun: Blocking PowerShell (or Graph) Access for Education Tenants – SamuelMcNeill.com

If there is no auth attempts it may be as others have pointed out: they've created an MSA with their school email address and that is what is attempting the auth rather than the AAD account.

Cheers

Sam

[Matt Strickland]

Thanks Sam,

For what I think is the related log, two fails (possibly wrong password) and one successful, for logs not attached to the browser.

18/07/2022, 4:10:43 pm  -   Failure  -   Microsoft Office/OfficeClientService

Error validating credentials due to invalid username or password.

18/07/2022, 4:10:54 pm   -   Failure  -   Microsoft Office/OfficeClientService

Error validating credentials due to invalid username or password.

18/07/2022, 4:11:01 pm   -   Success  -   Microsoft Office/OfficeClientService

But all it tells me is a successful sign-in to Microsoft Office/OfficeClientService, it might still be successful even without a licence, if credentials are correct?

I might have to test with a dummy account or wait till next week.

Matt

[Matt Strickland]

I haven't had much time to resolve this one, it remains unresolved.

I checked today and the student signs out and back into office. The sign in is correct, it has our branding applied to the logon process. (so not a 'Live' account logon)

The user sign's in, the logon is accepted, but office is not licensed and students cannot edit.

10/08/2022, 9:50:08 am - Success - (Application: Microsoft Office, Resource: OfficeClientService)

Ill suggest another local user. also is it worth dumping Office completely and reinstalling? - This is on a Mac.

Could there just be something local blocking activation?

I also haven't tried the same account on another Mac or PC (Our own Mac's are VL'd so id need to revert that to test)

Matt

[Matt Strickland]

Its sorted :)

Tested with a new local user account and it worked. Thanks Alan.

Worked out its something in Mac -> Mac transfer messed up the activation part of office. Office apps worked fine, but the activation parts were broken.

Delete office, clean out Libraries and reinstalled. Good to go.

Not sure if other students are related to this, or something different.

I don't know how the activation mechanism works or what it needs to operate within office.

Matt

[Matt Strickland]

I've bounced back on this:

Does anyone on here have Office deployed as a device based license (to the computers you own)?

And is device based licensing still available under the new subscription?

All our kiosk, lab and loan devices have device based licenses. Only Teacher and Student BYOD are using user based licenses. None use shared activation.

Previously device activated devices are coming up with activation errors (see Word in 'Viewer' mode)

But in the Admin console, M365 Apps (Device) for where I *think* I added the group for devices to be assigned licenses, is no longer available.

I used the documentation some years ago: https://docs.microsoft.com/en-us/deployoffice/device-based-licensing

Perhaps we can no longer use device based licences?

(FYI I use these in labs for when we have SAC exams, or any situation where I want the devices offline, or use a generic logon account for no user license is assigned)

Matt

[Sam McNeill]

Hi Matt,

It's called Device Based Subscription now and is available under EES but you need dedicated licenses.

The device must be AADJ/HAADJ

Cheers

Sam

--
You received this message because you are subscribed to a topic in the Google Groups "Techies for schools" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/techies-for-schools/BwGmNwAHQ0M/unsubscribe.
To unsubscribe from this group and all its topics, send an email to techies-for-sch...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/773349ad-e7e4-494f-b554-b7a35a8b4b3en%40googlegroups.com.

--

Sam McNeill
s...@mcneill.co.nz
+64 21 438 726

www.samuelmcneill.com 

[Ben Green]

We've still got them; we requested from Datacom (pre-Cyclone); I suspect that you have to request these Device licences yearly now.

- Ben.

---

From: techies-f...@googlegroups.com <techies-f...@googlegroups.com> on behalf of Sam McNeill <s...@mcneill.co.nz>
Sent: Tuesday, 6 September 2022 3:24 pm
To: techies-f...@googlegroups.com <techies-f...@googlegroups.com>
Subject: Re: [techies-for-schools] Re: Students cannot activate Office 365

 

You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/CAG-XsSmR74Gy9Sz7-Y0dCTnPW3yMOKx2NTqdCR-hOw4jZcA3rg%40mail.gmail.com.

Christchurch Boys' High School phone: +64 3 348 5003 address: 71 Straven Road, Riccarton, Christchurch 8014 postal: PO Box 8157, Riccarton, Christchurch 8440 web: www.cbhs.school.nz

[David Keenleyside]

I've just double-checked this end and have placed a request myself.  Our machines have not timed out and are still functional.

(We have extensive labs.)

Was there an alert about this being a problem during the new licensing round?  [If there was, I don't seem to have received it.]

Regards,
David Keenleyside, BSc CS & IS, CTech
ITP Associate
EFF Member
ICT Technician
Glenfield College
PO Box 40176 (Kaipatiki Rd)
Glenfield, Auckland City 0629

Ph:       +64 9 444 9066 ext 677
DDI: +64 9 441 9779
Email:    d.keen...@gc.ac.nz
https://itp.nz/CTech/NZ160799
https://www.linkedin.com/in/david-keenleyside-626871/

The Three O’s of Backup: Online, Offline, Off-site.

The Three RA’s of Cloud: Run Anywhere, Run Anytime, Run Agnostic.

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/SYBPR01MB5472BBA2FBC4308B263A96F9DB7E9%40SYBPR01MB5472.ausprd01.prod.outlook.com.

[Matt Strickland]

Ok good to know, I thought it was just me and something misconfigured. 

When the end user device still says Microsoft 365 Apps for enterprise "Belongs to: this device" which is misleading.

I don't recall receiving any changes to device licencing for NZ EDU customers.

Matt

[Ben Green]

How is "Belongs to: This device" misleading - it sounds like that is your scenario?

Might you be in the 90-day grace period?

- Ben.

---

From: 'Matt Strickland' via Techies for schools <techies-f...@googlegroups.com>
Sent: Tuesday, 6 September 2022 6:23 pm
To: Techies for schools <techies-f...@googlegroups.com>

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/3aae53a4-40c9-4141-85c3-4eeb3de3c505n%40googlegroups.com.

[Matt Strickland]

If it was in a 90 day grace that would make sense.

But its both, belongs to: this device, and is in viewer mode (by my screenshot), so it currently unlicensed, or lapsed.

I would have expected the belongs to: this device, to have been changed to, "unlicensed product", or whatever it was prior to activating by device.

As per Microsoft's statement on the post I linked:

You can also verify that Microsoft 365 Apps for enterprise is using a device-based license by opening an Office application, such as Word, and going to File > Account. In the Product Information section, you should see Belongs to: This device.

This lead me to dismiss any of the mechanism involved using device based, as in I thought this was still setup correctly and I had some sort of firewall, connectivity, or a block stopping activation.

So yes, for me, misleading.

Matt

[Matt Strickland]

Well my license request came through but its like I only received 1 license?... 

Ill see what happens with end devices.

[David Keenleyside]

After a negotiating for a while, the licenses have come through this end as well, I made sure there was one for each staff member/student.

Please note the expiry date:

So, it is indeed yearly, but with termination within the applied year.  Yet another to keep an eye on, it would be nice to have a checkbox for "recurring".

According to the Cyclone representative, they only received information on the MoE licenses during the changeover, so they are unaware of anything else negotiated outside of that.

With that being the case, I'm wondering what other horrors are lurking for people who have not checked their licensing panels.

As it is, I am wondering for how much longer we will run a Microsoft environment here, our usage figures for Office 365 are not exactly stellar:

Regards,

David Keenleyside, BSc CS & IS, CTech

ITP Associate

EFF Member

ICT Technician

Glenfield College

PO Box 40176 (Kaipatiki Rd)

Glenfield, Auckland City 0629

Ph:       +64 9 444 9066 ext 677

DDI: +64 9 441 9779

Email:    d.keen...@gc.ac.nz

https://itp.nz/CTech/NZ160799

https://www.linkedin.com/in/david-keenleyside-626871/

The Three O’s of Backup: Online, Offline, Off-site.

The Three RA’s of Cloud: Run Anywhere, Run Anytime, Run Agnostic.

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/1f610634-696d-4e10-9bb4-59313b860b55n%40googlegroups.com.

[Matt Strickland]

Our licences also came through tho only the exact amount required, none available to cover new devices but I can switch some existing to shared activation that don't need to be offline for any reason.

Since we're an O365 school our stats are a little more active.

[Sam McNeill]

DBS licenses are allocated on same number as your faculty + student count ie 1:1

Sent from my iPhone

On 10/09/2022, at 5:44 PM, 'Matt Strickland' via Techies for schools <techies-f...@googlegroups.com> wrote:



To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/20ff6ad1-937d-425a-93e8-3511d6ffa782n%40googlegroups.com.

[Matt Strickland]

I'm really wasting some time here - can any one shed some light?

The device based licences have been re-added, but those clients that were unlicensed remain unlicensed. Dstatus shows this:

 ---Processing--------------------------

---------------------------------------
PRODUCT ID: 00202-52810-64710-AA620
SKU ID: 149dbce7-a48e-44db-8364-a53386cd4580
LICENSE NAME: Office 16, Office16O365ProPlusR_Subscription1 edition
LICENSE DESCRIPTION: Office 16, TIMEBASED_SUB channel
BETA EXPIRATION: 1/01/1601
LICENSE STATUS:  ---NOTIFICATIONS---
ERROR CODE: 0xC004FC07
ERROR DESCRIPTION: The Software Licensing Service reported that the validity period expired.
Last 5 characters of installed product key: MR99C
---------------------------------------
PRODUCT ID: 00202-30000-00000-AA853
SKU ID: 3ad61e22-e4fe-497f-bdb1-3e51bd872173
LICENSE NAME: Office 16, Office16O365ProPlusR_Grace edition
LICENSE DESCRIPTION: Office 16, RETAIL(Grace) channel
BETA EXPIRATION: 1/01/1601
LICENSE STATUS:  ---NOTIFICATIONS---
ERROR CODE: 0xC004F009
ERROR DESCRIPTION: The Software Licensing Service reported that the grace period expired.
Last 5 characters of installed product key: VMFTK
---------------------------------------
---------------------------------------
---Exiting-----------------------------

Re-running the device based XML config with the Office Deployment Tool does nothing. (this is used to deploy and configure office config during a fresh deployment)

I tried both rearming/unpkey and retrying the default configuration update using ODT, still the same issue, now no licence keys, and Viewer mode only.

---Processing--------------------------

---------------------------------------
<No installed product keys detected>
---------------------------------------
---------------------------------------
---Exiting----------------------------- 

Its like the device based licence lapsed, grace period came and went, and now they are stuck probably without me clearing out licencing or office completely and reinstalling via ODT.

FYI a machine that is still behaving with a device based licences shows this for dstatus:

 

---Processing--------------------------
---------------------------------------
PRODUCT ID: 00346-80000-00010-AA291
SKU ID: 5821ec16-77a9-4404-99c8-2756dc6d4c3c
LICENSE NAME: Office 16, Office16VisioProR_Grace edition
LICENSE DESCRIPTION: Office 16, RETAIL(Grace) channel
BETA EXPIRATION: 1/01/1601
LICENSE STATUS:  ---NOTIFICATIONS---
ERROR CODE: 0xC004F009
ERROR DESCRIPTION: The Software Licensing Service reported that the grace period expired.
Last 5 characters of installed product key: F6YYT
---------------------------------------
---------------------------------------
---Exiting-----------------------------

 

Anyone got some pointers while I try a few other things...

Is it an activation limit again so need more machines to phone home?

Or something with depreciated DBA vs DBS, I’m using the supported tools and generated XML’s so afaik DBS. (fresh deployment appear fine, but could be in grace?)

Is the renewed licence DBA based? Because the new support docs show a different looking licence in the admin portal.

 

Matt

[Alistair Baird]

I see the expiration date as 01/01/1601.... maybe there's a regional date setting somewhere not happy ? 

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/d01bc930-938d-46e2-aabb-0b996b539f4cn%40googlegroups.com.

[Matt Strickland]

I also see that expiry date on working/valid machines (like my own laptop using user based licence activation)

So I've been ignoring it. That same product and date seems to be ok on other DBA/DBS machines.

The Microsoft 365 Apps admin center (because we need another admin center) is a joke at the moment. 

https://config.office.com/officeSettings/

I can see I have 154 activations, but I also have 69 'No licence available'

You can't filter, sort, or search the lists, so that's useful to start with.... ugh

If I click "No licence available" here's the description:

No license available
These devices do not have assigned license. Check Azure AD group membership to ensure below devices are in the group with device license.
Only devices that have activated or checked in during last 30 days are shown

Hang on, so no licence is available in this list, but it only shows activated OR checked in devices? - well no licence is available, so they can't be activated? Or are they activated and can't re-activate?

Or have they just checked in?

I must either be getting old or something so simple should make more sense. All I want to find is devices not activating, or are unable to obtain a licence.

I'm pretty sure they've checked in as I wouldn't know otherwise, so that seems irrelevant as I assume devices not-checked in wouldn't show?

Matt

[Alistair Baird]

Just reading back through the thread, is this just on OSX ? If so, go into the user's keystore and delete anything microsoft - certificates, credentials etc, then reboot for good measure, then log back in.

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/5bc64ee8-6bff-439f-89e5-b746fdeb9009n%40googlegroups.com.

[Jeffrey B]

https://docs.microsoft.com/en-us/office/troubleshoot/activation/reset-office-365-proplus-activation-state#method2

There was a way to use a script to clear and redo the activation under windows, looks like similar methods still exist.

---

From: 'Alistair Baird' via Techies for schools <techies-f...@googlegroups.com>
Sent: Tuesday, September 13, 2022 10:31:45 PM

To: techies-f...@googlegroups.com <techies-f...@googlegroups.com>
Subject: Re: [techies-for-schools] Re: Students cannot activate Office 365

To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/CAKQ0vHovfBR%2B-2SkAbSYuqPfLWVxdU8DqQsoRg526hNNhiCGow%40mail.gmail.com.

[Sam McNeill]

Seems like the thread has pivoted a bit from original post maybe.

Device Based Subscription only works for AADJ (or HADDJ) devices -you won't be able to use this method for student BYOD (unless you AADJ them which I would be surprised to hear) and definitely not for MacOS devices.

For your school owned/managed devices DBS is a good option if you're H/AADJ'ing devices.

For student owned BYOD you're going to need to use user based activation of M365 Apps.

Cheers

You received this message because you are subscribed to a topic in the Google Groups "Techies for schools" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/techies-for-schools/BwGmNwAHQ0M/unsubscribe.
To unsubscribe from this group and all its topics, send an email to techies-for-sch...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/techies-for-schools/SYBPR01MB5919D12CBDA5E37FA41AE518CC479%40SYBPR01MB5919.ausprd01.prod.outlook.com.