Introduction to Windows 10 subscriptions in the Cloud Solution Provider program

Executive summary

As a partner in the Cloud Solution Provider (CSP) program, you go beyond reselling licenses to providing managed services that are tailored to the unique needs of your customers.

Whether your customer has 20, 200, or 20,000 seats; provides gardening services, or designs fighter planes for the military; there is a Windows subscription to suit, with the flexibility of cloud-delivered, per user, per month billing.

From Microsoft 365 Business, an end-to-end security and productivity suite designed for small businesses, to Windows 10 Enterprise, the edition of Windows used by the US Department of Defense, there is a subscription for every customer and every scenario.

This document provides general technical guidance to help you sell, deploy, and manage these solutions.

Windows 10 in the CSP Program

The CSP program provides a pay-as-you-go subscription model with per-user, per-month pricing that enables businesses to scale up or down from month to month as their needs change. By working with an expert CSP partner, even companies with limited or no IT staff can stay secure, productive, and in control.

Benefits for customers

Quickly and easily attach other Microsoft cloud-based products and services, such as Microsoft Office 365, Microsoft Azure services, or Microsoft Dynamics 365.
Automatically deploy subscriptions at login. Deploying a Windows subscription license using CSP is quick and simple. When you use Azure Active Directory (Azure AD) credentials to log in to a device, that device automatically "steps up" from Windows 10 Pro to the subscribed edition or service. No downloads, installations, or reboots are required.
Eliminate the need for imaging. Devices can be shipped to users with the OEM Windows 10 Pro installation, without the need for any re-imaging.
Fall back to Windows 10 Pro at subscription end. If a subscription ends, is cancelled, or is reassigned from one user to another, previously deployed devices seamlessly fall back to Windows 10 Pro functionality.
Upgrade benefits to Windows 10 for devices still running Windows 7, Windows 8, or Windows 8.1. Users with active Windows CSP subscriptions can upgrade existing Windows 7 or Windows 8/8.1 devices to Windows 10 at no extra cost. All subscriptions that include Windows also include Windows 10 upgrade benefits for devices running Windows 7 or Windows 8/8.1.

IMPORTANT

All subscriptions in the CSP program use Azure AD identity management for license activation.

Customers who adopt Windows in CSP subscriptions must use Azure AD, either by cloud domainjoining devices and authenticating with Azure AD credentials or by enabling Azure AD Connect to synchronize an on-premises Active Directory instance with Azure AD.

Azure AD Connect is the best way to connect an on-premises directory with Azure AD. Azure AD Connect is a service you can install on-premises or in an Azure Virtual Machine.

Customers unable to use Azure AD in any scenario will be unable to deploy Windows 10 subscriptions in the CSP program or via other programs that require Azure AD for license activation, and should therefore evaluate other licensing solutions.

Benefits for CSP partners

As a CSP partner, you also benefit from new ways to grow your business. Through deeper engagement with customers, you get an insider's view of their businesses and the opportunity for additional revenue:

Increased profitability. Open new revenue streams such as support and billing services (either on your own or with help from an indirect provider).
Added value. Because you're partnering with Microsoft, you can bundle solutions with our industry-leading products.
Managed services. As the cloud market continues to soar, you'll be well positioned to meet customer demand for managed services.

Delivering Windows subscriptions in CSP

The CSP program currently enables subscriptions to Microsoft products and services. Windows subscriptions in CSP are for Windows editions and services that build on an existing installation of Windows 10 Pro (Anniversary Update, version 1607, also known as RS1). Windows is available in CSP as part of a Windows 10 Enterprise or Microsoft 365 subscription. Standalone, perpetual licensing and delivery of Windows 10 Pro and Home versions or Long-Term Servicing Channel (LTSC) are not currently available through the CSP program.

Windows 10 Enterprise Editions

There are two major Windows 10 Enterprise subscriptions and several options under the E3 subscription.

Windows 10 Enterprise E3. This subscription gives users access to the Enterprise edition of Windows 10 on as many as five devices. Windows 10 Enterprise E3 is available in three offerings that include different levels of virtualization use rights.
Windows 10 Enterprise E3 (local only) includes Windows 10 Enterprise E3 usage rights for as many as five devices but does not include virtualization use rights.
Windows 10 Enterprise E3 includes Windows 10 Enterprise E3 usage rights for as many as five devices, and virtualization use rights for access to Windows 10 Enterprise virtual machines from Windows Pro devices. Users can mix and match a total of five device installations and virtual machine instances.
Windows 10 Enterprise E3 with VDA includes Windows 10 Enterprise E3 usage rights for as many as five devices, and virtualization use rights for access to Windows 10 Enterprise virtual machines from any device, including non-Windows Pro devices (for example, Windows consumer devices, Apple devices, Linux/Chrome/Android devices). Users can mix and match a total of five device installations and virtual machine instances.
Windows 10 Enterprise E5 includes Windows 10 Enterprise E3 usage rights for as many as five devices and virtualization use rights for access to Windows 10 Enterprise virtual machines from Windows Pro devices. Users can mix and match a total of five device installations and virtual machine instances. Windows 10 Enterprise E5 also includes the Windows Defender Advanced Threat Protection service.

Microsoft 365 offerings

There are three major Microsoft 365 subscriptions.

Microsoft 365 Business. This single platform and security solution is designed for small businesses. This option keeps things simple by bringing together the best of what Microsoft offers: the security features and innovation of Windows 10, the power and familiarity of Microsoft Office 365, and easy cloud-based management tools. This option supports a maximum of 300 seats.
Microsoft 365 F1. A complete, intelligent, secure solution for the firstline worker, this platform brings together the best offerings from across the Microsoft Office, Windows 10, and the Microsoft Enterprise Mobility + Security (EMS) line of products.
Microsoft 365 Enterprise E3 and E5. Built for larger organizations with more than 300 users, this platform includes all the features of Microsoft 365 Business: advanced device and data security capabilities, modern voice experience with cloud PBX, and flexible on-premises or cloud identity options. Microsoft 365 Enterprise includes Windows 10 Enterprise and Office 365 ProPlus and is managed with Enterprise Mobility + Security (EMS).

The following table outlines all Windows CSP subscription options.

Subscription	Total concurrent installations (devices + virtual machines)	Maximum local device installations	Maximum virtual machines accessed from Windows Pro devices	Maximum virtual machines accessed from non-Windows Pro devices
Windows 10 Enterprise E3 (local only)	5	5	N/A	N/A
Windows 10 Enterprise E3	5	5	5	N/A
Windows 10 Enterprise E3 with VDA	5	5	5	5
Windows 10 Enterprise E5	5	5	5	N/A
Microsoft 365 Business	5	5	N/A	N/A
Microsoft 365 Enterprise E3	5	5	5	N/A
Microsoft 365 Enterprise E5	5	5	5	N/A
Microsoft 365 F1	5	5	N/A	N/A

To help determine which subscription is right for them, your customers can refer to these website resources:

Technical guidance

The following steps outline the tasks necessary to deploy a Windows subscription in CSP, including the phases and additional resources you need to complete each task:

Perform discovery and prepare the customer environment.
Purchase subscriptions and assign them to users.

Microsoft 365 Business subscribers: Configure functionality specific to Microsoft 365 Business customers.

Upgrade or update devices to Windows 10 Pro Anniversary Update or later (if devices are not already upgraded or updated).
Activate subscription on end-user devices.
Configure newly accessible functionality on end-user devices (as necessary).

Windows 10 Enterprise subscribers: Configure new functionality now accessible on devices with active subscriptions.

1. Perform discovery and prepare the customer environment

Before purchasing a Windows subscription in CSP, you must prepare the customer's management environment:

Verify that the customer's identity-management needs are compatible with Azure AD.
Determine whether devices are Azure AD-joined.

Migrate to Azure AD or configure Azure AD Connect, as needed. (This excludes Microsoft 365 Business subscribers, who can use only Azure AD.)

For Microsoft 365 Business subscribers, verify or complete additional prerequisites.

Verifying compatible identity management needs

Because all subscriptions in the CSP program use Azure AD identity management for license activation, end-user devices must authenticate against Azure AD to deploy a Windows subscription that is licensed using CSP. This authentication can be performed in one of two ways:

Join devices to the cloud domain and log in with an Azure AD user account.
Join devices to the on-premises domain and log in with domain credentials synchronized to Azure AD using Azure AD Connect.

IMPORTANT

If the customer's identity management needs are incompatible with Azure AD, or the devices are not compatible with Windows 10 Pro Anniversary Update or later, then the customer cannot adopt Windows subscriptions using CSP. For more information about authenticating against Azure AD, see The role of Azure Active Directory in Windows 10 cloud subscriptions.

To determine whether a device is Azure AD-joined

Open a Command Prompt window.
Type dsregcmd /status.
Review the output under Device State.

If the AzureAdJoined status is YES, the device is Azure AD-joined.

For information about preparing the AD environment for Windows 10 subscriptions, review the following resources:

Migrating to Azure AD or configure Azure AD Connect

To integrate and synchronize on-premises AD with Azure AD, customers use the Azure AD Connect tool, which can be downloaded when using Azure or from the Microsoft Download Center. Azure AD Connect is a service you can install on-premises or in an Azure Virtual Machine.

Microsoft 365 Business subscribers can use only Azure AD.

Meeting additional requirements for Microsoft 365 Business

Mobile devices must run Apple iOS 8.0 or later or Google Android 4.0 or later (including Samsung Knox Standard 4.0 or later), and you must remove all devices from any mobile management solutions to which they might be connected (for example, MobileIron or VMware AirWatch). These devices will be enrolled in Microsoft 365 Business mobile management.

To learn more about these requirements and other prerequisites for Microsoft 365 Business subscribers, review the following resources:

2. Purchase subscriptions and assign to users

After preparing the customer environment for identity management and any other prerequisites, purchase subscriptions using Microsoft Partner Center for direct CSP partners or using an indirect provider's cloud marketplace.

Note: The screenshots in this section are only applicable for direct providers transacting through Microsoft Partner Center. Partners purchasing through an indirect provider will need to refer to that indirect provider's web site and guidance/documentation.

The necessary steps vary slightly depending on whether you are purchasing subscriptions for new or existing CSP customers. The general steps are outlined in this table and detailed in the following sections.

Task	Action	New CSP Customers	Existing CSP Customers
A	Create tenant.	Must complete as part of subscription purchase process.	(Completed)
B	Add and verify domains.	Optional as part of subscription purchase process.	(Completed)
C	Create user accounts.	Must complete as part of subscription purchase process (import via Azure AD Connect, if applicable).	(Completed)
D	Purchase subscriptions.	Must complete.	Must complete.
E	Assign licenses to end user accounts. For Microsoft 365 Business subscribers: Configure functionality specific to Microsoft 365 Business.	Must complete.	Must complete.

To purchase subscriptions for a new customer

In the Microsoft Partner Center portal dashboard, under Customers, click Add customer.

On the New subscription page, under Catalog, select the Small business tab, and then select Microsoft 365 Business.
Type in the number of licenses you need.

Note: The maximum number of licenses for Microsoft 365 Business is 300.

4. Complete the remaining steps to add the new customer:

Add and verify domains if required.
Create user accounts.
Purchase the subscriptions.

To purchase subscriptions for an existing customer

In the Microsoft Partner Center portal dashboard, under Customers, select the company, and then click Add subscriptions.

On the New subscription page, select the desired subscription (and other offerings, as required):
- Microsoft 365 Business
- Microsoft 365 Enterprise E3
- Microsoft 365 Enterprise E5
- Microsoft 365 F1
- Windows 10 Enterprise E3
- Windows 10 Enterprise E5

After you add the subscription, it appears on the Subscriptions page.

Alternatively, you can add a subscription when you create a new customer.

To assign Windows 10 Enterprise E3 licenses

Windows 10 licenses are included with Microsoft 365 subscriptions, so for Microsoft 365 subscribers, you do not need to assign Windows 10 licenses separately.

In the Microsoft Partner Center portal dashboard, from the License management page, select the user.

Assign a Windows 10 Enterprise E3 license to the user.
Repeat steps 1 and 2 to assign Windows 10 Enterprise E3 licenses to the remaining users, as identified by the customer.

Note: To view current billing information for a customer (for example, current billing, billing history, and reconciliation files), in the Microsoft Partner Center portal dashboard, select the Billing panel.

Alternatively, you can use any of these methods to assign Windows 10 Enterprise licenses to users:

Use group-based licensing. This is the preferred method for companies with an Azure AD subscription.
Sign in to office.com with the account that has admin permissions and manually assign licenses.
Upload a spreadsheet with licenses.
Use the per-user PowerShell scripted method.
Use synchronized AD groups to automatically assign licenses.

Microsoft 365 Business subscribers: Configure functionality

If the customer chooses Microsoft 365 Business, you must configure functionality now. Your configuration steps are likely to include the following:

Install or uninstall Office on Windows 10 devices.
Set app protection settings for mobile devices (for example, Android and iOS).
Set device protection and app configurations for Windows 10 devices.
View policies and devices.
Remove company data from devices.
Reset Windows 10 devices to their factory settings.

Note: These configuration steps can be completed directly by a customer IT administrator. However, a Microsoft CSP partner must be the first point of contact for any technical support issues involving Windows 10 subscriptions in Microsoft 365 Business actions (see Microsoft 365 Business documentation and resources).

You will complete the following configuration steps in the Microsoft 365 Admin center.

To sign in to the Microsoft Admin center

In the Admin center, launch the Microsoft 365 Business setup wizard to streamline initial setup by clicking Start setup.

Find details about the setup process in Set up Microsoft 365 Business by using the setup wizard.

The setup process includes the following four tasks:

Personalize sign-in.
Add users.
Connect your domain.
Protect data and devices.

Note: This phase is optional; if you use the .onmicrosoft.com domain, you can skip this step.

3. Upgrade or update devices to Windows 10 Pro Anniversary

Update or later

To deploy a Windows subscription using CSP, devices must run Windows 10 Pro Anniversary Update (version 1607, also known as RS1) or later versions. This release is the first to enable cloud domain-join and device login using Azure AD user credentials, which are required for deployment and consumption of a Windows 10 subscription in CSP. For customers who are not already running Windows 10 Pro Anniversary Update or later, you must upgrade or update devices to the current version of Windows 10.

Customers with devices that run an earlier release of Windows 10 Pro (for example, versions 1507 or 1511) must update those devices to Windows 10 Pro Anniversary Update (version 1607) or later.

Customers with devices that run Windows 10 consumer editions such as Windows 10 Home must purchase an upgrade to Windows 10 Pro.

For active Windows subscribers in the CSP program, Windows 10 upgrade benefits are included at no extra cost for users with devices running Windows 7, Windows 8/ 8.1.

To determine which Windows version a device is running, follow these steps:

Open a Command Prompt window.
Type winver.

A message window appears, displaying the Windows 10 version number and detailed OS build information.

To determine whether a device can support an update to Windows 10 Pro Anniversary Update, see Windows 10 Specifications & Systems Requirements. For more information about upgrading devices to Windows 10, review the following resources:

To update customer devices running Windows 10 Pro releases earlier than Anniversary Update (version 1607)

On the device to be updated, open Settings.
Navigate to Update & Security, and then click Windows Update.
In Windows Update, click Check for updates.

When the most recent update appears, click the update to begin the download and installation.

Alternatively, you can manually update the device:

Go to the Microsoft Software Download center.
Choose the most recent Windows 10 Pro version.
Click Update now.

To upgrade customer devices running Windows 10 Home

On the device to be updated, open Settings.
Navigate to Update & Security, and then click Activation.
Select Go to Store.

From the Windows Store, purchase the upgrade to Windows 10 Pro.

For more information about upgrading, see Upgrade Windows 10 Home to Windows 10 Pro.

To update customer devices running Windows 7 or Windows 8/8.1

Determine the upgrade path:

In-place upgrade. Select Install upgrade, and then on the software download site, click Update now.
Boot to USB or DVD. Select Create installation media and follow the instructions that appear. You can use that media to upgrade a device, or you can wipe and reload the OS. However, be aware that the latter option might require re-activation of the Windows Pro license using the original OEM Pro license key.

4. Activate subscription on end-user devices

Windows subscriptions licensed using CSP do not require any additional software downloads, installations, or product keys. When end users sign in with Azure AD credentials associated with the subscription license and authenticate devices against Azure AD, the operating system automatically updates to Windows 10 Enterprise and the appropriate Windows 10 Enterprise features are unlocked.

When a user's subscription expires or is transferred to another user, Windows 10 Enterprise features are frozen, and the device reverts seamlessly to Windows 10 Pro functionality (after a grace period of up to 90 days).

For details about various Windows 10 Enterprise E3 and E5 activation scenarios, see Windows 10 Subscription Activation.

Activating the functionality and benefits of Windows 10 subscriptions in CSP becomes even easier when organizational admins simplify device deployment using Windows AutoPilot. With a Windows AutoPilot deployment profile, you can provide a streamlined out-of-box experience (OOBE) for end users with only a few steps and decisions.

Windows AutoPilot can be used with any device that meets the following prerequisites:

Registered to the organization
Runs Windows 10 Creators Update (version 1703) or a recent device that has been factory reset.
Access to the internet
Uses Azure AD Premium
Managed by Microsoft Intune or other MDM services

To activate subscriptions on new devices by using Windows AutoPilot

Create a .csv file that contains device product information, including serial number, OEM name, model name, product ID, and device identifier. For information about preparing this file, refer to Overview of Windows AutoPilot.
From the Partner Center dashboard, go to Customers, select the customer that is receiving the devices, and then click Devices > Add devices.
Name the batch of devices.
Click Browse, select the .csv file, and then click Validate.
From Devices, click Add new profile, and name the profile.
Configure the desired OOBE settings.
Click Submit.
From Devices, in the Assign and delete devices pane, select the devices you want to configure.
Click Apply profile, and then select the profile.
Verify by testing the profile.

For details about Windows AutoPilot and about creating, applying, and testing Windows AutoPilot profiles, review the following resources:

5. Configure newly accessible functionality on end-user devices (as necessary)

After you activate subscriptions, the features and functionality of Windows 10 become available to users when they sign on to their devices and join to Azure AD. If subscribers are using Windows AutoPilot, the process to join to Azure AD is simple. If subscribers are not using Windows AutoPilot, they must complete additional steps.

Users: To complete deployment from the device desktop using Windows AutoPilot

Select the preferred language, region, and keyboard layout or layouts.
Connect to a network.
Enter user account (generally work email address).
Enter password to validate the account.

Device will now be enrolled into Azure Active Directory and applicable MDM policies applied including any functionality specific to M365B such as automatic installation of Office apps.

Users: To complete deployment and join Azure AD on a new device desktop without using Windows AutoPilot

During the initial device setup, on the Who owns this PC? page, select My organization, and then click Next.

On the page, select Choose how you'll connect Join Azure AD, and then click Next.
On the Let's get you signed in page, enter the Azure AD credentials, and then click Sign in.

Note: Do not use a BUILTIN/Administrator account.

Users: To complete deployment on an active device desktop without using Windows AutoPilot

1. Go to Settings and select Accounts.

On the Accounts page, select Access work or school, and then click Connect.

In the Set up work or school account pane, select Join this device to Azure Active Directory.

On the Let's get you signed in pane, enter your Azure AD credentials, and then click Sign in.

Note: Do not use a BUILTIN/Administrator account.

On the Make sure this is your organization pane, click Join.

Wait for the connection confirmation pane to appear.

To verify subscription activation

On the device, open Settings.
Click Update & Security.
Click Activation and confirm that the subscription is active.

Configure functionality for Windows 10 Enterprise subscribers

For Windows 10 Enterprise licenses, after Windows 10 Enterprise E3 or E5 is running on company devices, refer to the following articles to implement features unique to Windows 10 Enterprise editions:

For detailed information about the deployment process for these features, as well as additional resources for each feature, see Windows 10 Enterprise E3 in CSP, Deploy Windows 10 Enterprise features

More resources

Helping customers take advantage of Windows subscriptions is only one way to ensure your customers gain the full value of their investment in the CSP program. For more tips and information, see these resources: