February 25, 2015 - Sven Huisman
How-to configure Office 365 Pro in a non-persistent VDI environment
I’m currently implementing a VMware Horizon View environment with Windows 8.1 non-persistent desktops. The customer has Office 365 licenses for the users and has no right to use a KMS license activation server for Office 2013. Activation of Office 365 Pro is done by the user:
- The Office 365 administrator assigns an Office 365 license to the user.
- User installs Office 365 Pro or logs on to a computer where Office 365 Pro is installed.
- User starts an Office 365 Pro application, Word or Outlook for example.
- User needs to activate Office.
- User enters the Office 365 credentials to login to Office 365.
- A license token is assigned to the user on that computer. The user can use the Office applications on that computer. The license is checked once a month, so an internet connection is required for that computer.
- The user can activate Office on maximum 5 computers.
With non-persistent virtual desktops, that’s a different story. The user will need to activate Office each time the user logs on to a virtual desktop, because each time it will be a different (and refreshed) desktop. The user would use their 5 devices activations very fast. Fortunately, Microsoft has a solution for this problem. You can enable “shared computer activation” during the installation of Office. When a user activates Office on a shared computer, the license doesn’t count for the maximum of 5 machines. This is the “official” Microsoft statement (Technet article):
Activation limits Normally, users can install and activate Office 365 ProPlus only on up to five computers. Using Office 365 ProPlus with shared computer activation enabled doesn’t count against the five computer limit. Microsoft allows a single user to activate Office 365 ProPlus on a reasonable number of shared computers in a given time period. The user gets an error message in the unlikely event the limit is exceeded.
How to install Office 365 Pro in shared computer mode
To enable shared computer activation when you deploy Office 365 ProPlus, you need the following:
- The current version of the Office Deployment Tool, which is available from the Microsoft Download Center.
- At least version 15.0.4631.1002 of Office 365 ProPlus, which was released in July 2014.
Once you have downloaded the Office Deployment Tool, you need to edit the configuration file to enable shared computer licensing. The configuration file could then look like this:
<Configuration> <Add SourcePath="\\server\Office15" OfficeClientEdition="32"> <Product ID="O365ProPlusRetail" > <Language ID="en-us" /> </Product> </Add> <Display Level="None" AcceptEULA="True" /> <Property Name="SharedComputerLicensing" Value="1" /> </Configuration>
More information about the configuration file can be found here.
Next is to download Office 365 Pro to the network-share. This is done by using the “/Download” parameter:
\\server\Office15\setup.exe /download \\server\Office15\configuration.xml
After the download is complete, use the “/configure” parameter to install Office 365 Pro in the golden image:
\\server\Office15\setup.exe /configure \\server\Office15\configuration.xml
After Office 365 Pro is installed you can finalize the golden image to create your desktop-pool.
Office 365 Pro on a shared computer
Here’s what happens after Office 365 ProPlus is installed on a computer that has shared computer activation enabled.
- A user logs on to a virtual desktop with his/her domain credentials.
- The user starts an Office 365 ProPlus application, such as Word.
- Office 365 ProPlus contacts the Office Licensing Service on the Internet to obtain a licensing token for the user. The user needs to enter their Office 365 credentials to activate. If the user is licensed for Office 365 ProPlus, a licensing token is stored on the computer in the user’s profile folder, and Office 365 ProPlus is activated. The user can now use Office 365 ProPlus.
- These steps are repeated for each user who logs on to the shared computer. Each user gets a unique licensing token. Just because one user activates Office 365 ProPlus on the computer doesn’t mean Office 365 ProPlus is activated for all other users who log on to the computer. If a user goes to another computer that also is enabled for shared computer activation, the same steps occur. There is a different licensing token for each computer that the user logs on to.
So far so good. One challenge is that the user needs to enter their Office 365 account credentials to activate Office and the user needs to do that each time he logs on to a virtual desktop, because it will be a new virtual desktop each time. You can solve this by implement ADFS and enabling SSO for Office 365. I will not go deep-dive on this, but these are the steps you need to take:
- Sync active directory with Office 365.
- Make sure the user UPN in Active Directory is the external address (i.e. when AD domain is company.local, make sure the UPN is firstname.lastname@example.org)
- Implement ADFS so users can use single sign on to Office 365 with their logged on credentials.
- Configure GPO so users will automatically authenticate with federated credentials:
- Add ADFS proxy address to local sites in IE and edit the policy so users will log on with logged on credentials (can also be done with group policy):
- One other issue I had was that the EULA message keeps appearing for the user. To get around this issue, add the following regkey to the user:
For more information about Office 365 shared computer licensing go to this link.