Troubleshooting Microsoft 365 Apps activation

Most Microsoft 365 Apps installations activate without incident — sign in with a licensed account and the apps light up. But when activation fails the error messages aren't always helpful. Here's the practical diagnostic ladder.

Verify the basics first

Before anything else, confirm:

The user has a Microsoft 365 licence that includes desktop apps (some plans only include web/mobile).
The licence is actually assigned in the Microsoft 365 admin center (not just purchased).
The user has signed into Office at least once with the right account.
The device has internet access to Microsoft activation endpoints.

A surprising fraction of "activation broken" tickets are one of these four.

A common scenario:

User has a personal Microsoft account from years ago.
Office is signed into the personal account.
The work account has the licence.

The user sees "your subscription doesn't include desktop apps" — Office is looking at the wrong account. Sign out and sign back in with the work account through File → Account.

In regedit or in the Account pane, you can see which identities Office knows about. Multiple identities can coexist (work + personal). For business plans, the work account must be the primary signed-in identity.

Shared Computer Activation (SCA)

For VDI, AVD, Windows 365 multi-user, or any multi-user installation of Microsoft 365 Apps, Shared Computer Activation is required. Without it, Office activation tries to bind to the device (5-device limit per user). With SCA, activation is per-session and short-lived.

If you're seeing "you've hit your install limit" on a VDI host, SCA isn't enabled. Configure it via the Office Deployment Tool or Intune configuration profile.

Activation token issues

Office stores activation tokens locally. When tokens get stale or corrupted, activation fails. Reset:

# Windows
cd "C:\Program Files\Microsoft Office\root\Licensing16"
.\ospp.vbs /dstatus  # diagnose
.\ospp.vbs /unpkeyremove:LASTFIVE  # remove problematic keys
# Then sign back in

Or use the Microsoft Support and Recovery Assistant (SaRA) which has dedicated diagnostics for Office activation.

Network and endpoint connectivity

Office needs to reach specific Microsoft endpoints for activation:

licensing.mp.microsoft.com
login.microsoftonline.com
*.officeapps.live.com
*.microsoftonline-p.net

If any of these are blocked by firewall, proxy, or SSL inspection, activation fails. The Microsoft 365 IP and URL list documents every endpoint Office needs. Bypass SSL inspection for Office activation endpoints — TLS inspection breaks the activation handshake in many configurations.

Stale device records

If a user has installed Office on many devices, they may hit the 5-device limit. In their Microsoft 365 home page, they can see their devices and deactivate unused ones. Old devices that no longer exist often need explicit deactivation.

For admin-managed installations through Intune, this is rarely an issue because activation is fleet-aware via the Office Cloud Policy Service.

Office requires Modern Authentication (OAuth) to activate. If a tenant has somehow disabled Modern Authentication for Exchange Online or Office at the tenant level, activation fails. This is rare in 2026 — Microsoft has retired legacy auth for most services — but worth checking on old tenants.

When all else fails

Run SaRA with the Office activation scenario.
Reset Office via Settings → Apps → Microsoft 365 Apps → Modify → Online Repair.
Uninstall and reinstall the apps as a last resort.
Open a support ticket — Microsoft can see activation-side issues you can't.

A working activation experience for users is one of those things that's only visible when it breaks. The good news is the diagnostic ladder is well-understood once you've walked it a few times.