Windows 11 Pro for business endpoints

Check the underlying licence before buying keys for a fleet

Start with entitlement, not activation. For each endpoint, record its installed edition, original licence source and whether the proposed purchase is a full licence or an upgrade. Many Windows licences supplied through Microsoft's commercial licensing programmes are upgrade licences and require a qualifying underlying operating system. A successful activation does not establish that those requirements have been met. Check the applicable Microsoft Software License Terms or Product Terms for the actual product and purchasing channel.

Transfer rights also depend on how Windows was acquired. Under Microsoft's standard terms, preinstalled Windows normally stays with the licensed device and can transfer to another owner only with that device. Standalone retail software generally permits transfer to another device, provided it is removed from the previous one and the other conditions are satisfied. For an MSP, keep each customer's entitlement records separate; possessing a reusable deployment image or activation key does not license additional customer endpoints.

• Retain invoices, licence descriptions and records linking each entitlement to its device or user.
• Check qualifying-OS requirements before buying a commercial Windows upgrade.
• Treat MAK and KMS as activation methods, not evidence of unlimited installation rights.
• Confirm transfer rights before moving a licence from a retired PC.
• Price commercial agreements against actual requirements; there is no universal seat count at which they become cheaper.

Choose an identity and enrolment model before provisioning

Decide whether devices will use an on-premises Active Directory domain, Microsoft Entra join or a hybrid arrangement before creating your deployment process. Microsoft Entra registration, commonly used when adding a work account to a personally owned PC, is not the same as joining the device. Entra-joined PCs can use organisational accounts for Windows sign-in without joining an on-premises domain. Hybrid join combines an existing Active Directory domain join with a device identity in Microsoft Entra ID.

Windows Pro supports these organisational join options, but buying the operating system does not include an Intune subscription. Automatic Intune enrolment through Microsoft Entra requires appropriate Intune licensing and Microsoft Entra ID P1 or P2. Microsoft 365 Business Premium includes Intune Plan 1 and Entra ID P1, subject to its subscription limits and terms. For a new rollout, configure enrolment scope and restrictions first, then test one representative device from initial setup through policy application and application installation.

• Choose Microsoft Entra join for cloud-first devices unless a verified dependency requires domain join.
• Do not treat adding a work account as proof that a device is joined or managed.
• Confirm user licensing, enrolment permissions and tenant device limits before deployment.
• Where supported, use Windows Autopilot to streamline provisioning; it does not supply the required licences.
• Avoid configuring conflicting settings through both Group Policy and Intune.

Make encryption recovery a tested operational process

Encryption is only manageable if authorised staff can recover a locked device. Before enabling BitLocker across the fleet, choose where recovery information will be stored and who can retrieve it. Domain-managed devices can back up recovery information to Active Directory Domain Services; appropriately configured cloud-managed devices can back it up to Microsoft Entra ID. Configure the relevant policy before encryption begins, rather than assuming that joining a domain or enrolling in management automatically protects every existing recovery key.

Use a pilot device to verify the complete workflow: confirm encryption status, locate its recovery password in the intended directory, and check that the displayed recovery key identifier matches the device's recovery information. Existing encrypted PCs need a separate audit because applying a new policy does not prove their recovery passwords were previously escrowed. Restrict helpdesk access, document how staff verify a requester's identity, and rotate a recovery password after disclosure where your management tooling supports it.

• For AD-managed deployments, configure the policy that prevents BitLocker enablement until recovery information is stored in AD DS.
• Inventory encryption state as well as recovery-key backup status.
• Test recovery only on a pilot with verified backups and an approved procedure.
• Review BitLocker suspension requirements before firmware or TPM changes; do not clear a TPM casually.
• Maintain separate data backups: a recovery password cannot restore a failed or erased drive.

Build update rings around support deadlines and hardware eligibility

Treat feature-version support as a fleet deadline, not simply an update preference. Windows 11 Home and Pro feature releases have a 24-month servicing lifecycle, so a supported operating-system family can still contain devices running an out-of-support release. Inventory edition, version and hardware eligibility, then assign devices to pilot, broad deployment and exception groups. Deferral policies help sequence updates, but they do not extend a release's support period or remove the need to test business-critical applications.

For PCs that cannot move to Windows 11, assess replacement, workload migration or a time-limited Extended Security Updates plan. Eligible Windows 10 22H2 business devices can receive commercial ESU coverage for up to three years beyond standard support, with annual licensing and cumulative purchase requirements when joining in a later year. ESU is a security bridge, not a feature-upgrade programme or a replacement for general support. Avoid treating Windows 11 installations that bypass hardware requirements as a supported fleet strategy.

• Use Microsoft's release-health and lifecycle pages to track each deployed version's end date.
• Pilot updates on representative hardware, VPN clients, security agents and line-of-business applications.
• Investigate safeguard holds rather than routinely overriding them.
• Assign an owner and replacement date to every unsupported-hardware exception.
• Check commercial ESU prerequisites and current Microsoft terms before budgeting coverage.

Windows Pro identity models and their management implications