Shared Computer Activation (SCA) Errors in VDI Environments

Shared Computer Activation (SCA) errors occur in Virtual Desktop Infrastructure (VDI) environments like Citrix, VMware Horizon, or Azure Virtual Desktop when Microsoft 365 Enterprise installations fail to issue or roam temporary activation tokens. When SCA fails, apps display “Unlicensed Product” banners or force users to sign in every time a non-persistent session launches. This break occurs when the SharedComputerLicensing registry flag is missing or when user profile tools like FSLogix fail to persist the %LocalAppData%\Microsoft\Office\16.0\Licensing token folder across desktop teardowns.

Fast-Fix: The 45-Second Solution

SCA failures in VDI stem from missing SharedComputerLicensing registry flags or un-persisted licensing token folders in non-persistent VM pools. Risk Tier: High. To resolve this, set the DWORD SharedComputerLicensing to 1 in HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration, enable FSLogix container redirection for %LocalAppData%\Microsoft\Office\16.0\Licensing, and restart the master VM image before re-deploying the pool.

Diagnostic Snapshot

• Severity Tier: High (Blocks productivity across entire non-persistent virtual desktop pools; impacts all users assigned to affected hosts).
• Data Safety Risk: Minimal (User documents, mailbox data, and cloud files stored on OneDrive/SharePoint remain completely intact).
• Common Cause: Missing or disabled SharedComputerLicensing registry entry in the golden/master image, or failure to roam licensing tokens across logoffs.
• Admin Requirement: Local Administrator access on master VM images and Domain/Global Admin rights for Group Policy (GPO) or Intune management.

Conflict Escalators

• Non-Persistent Pool Re-Imaging: Updating a golden master image without setting <Property Name="SharedComputerLicensing" Value="1"/> in the deployment XML reverts all spawned VM clones to standard 5-device licensing mode.
• FSLogix Redirections.xml Exclusions: Incorrect exclusion rules in Redirections.xml that strip out the AppData\Local\Microsoft\Office\16.0\Licensing folder during container logoff syncs.
• Non-Enterprise M365 Licensing: Assigning licenses that do not support SCA (such as M365 Business Basic or Standard) rather than SCA-supported tiers (M365 Business Premium, E3, E5, or F3).

Common Misdiagnoses

• Misdiagnosed as Device Activation Limit Exceeded: Admins often see 5-device limit errors and attempt to manually deactivate devices in the M365 Portal. However, if SCA is active and roaming correctly, activations do not count against the user’s 5-device quota. For standard 5-device limit troubleshooting, see How to Fix “This product is already installed on another device” Limit.
• Misdiagnosed as General Account Unlicensing: If a user holds a valid license but gets unlicensed errors in VDI, the failure is local deployment mode or token persistence, not account licensing. Review “Account Unlicensed” Error despite active M365 Subscription.
• Misdiagnosed as Credential Vault Corruption: Clearing Windows Credential Manager on a non-persistent VM is ineffective because the credential vault is wiped upon logoff anyway. For credential management on persistent endpoints, see How to Clear Office Credential Cache on Windows 11 (The Modern Way).
• Misdiagnosed as Modern Auth Broker Crash: Sign-in prompt loops inside VDI are frequently blamed on WAM plugin crashes when the root cause is actually an unrouted licensing token path. Compare broker reset steps in How to Resolve Modern Authentication (ADAL/MSAL) Failures in 2025.

Immediate Action Steps

Step 1: Verify and Enforce SCA in the Master VM Registry

Ensure the golden image explicitly enables Shared Computer Activation via registry or Group Policy.

1. Open the master VM image in edit/maintenance mode.
2. Press Windows Key + R, type regedit, and press Enter.
3. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration
4. Verify or create a String Value named SharedComputerLicensing and set its value to 1.
5. Check the secondary registry path for Group Policy enforcement:
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing
6. Ensure SharedComputerLicensing is set to 1 (DWORD).

Step 2: Configure Token Persistence and Roaming Paths

To prevent users from having to sign in on every non-persistent session launch, force Office to save licensing tokens to a roamed profile location or FSLogix container.

1. In the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing, create a String Value named SCATokenFilePath.
2. Set the value data to a roamed path, such as %LocalAppData%\Microsoft\Office\16.0\Licensing or a specific roamed user profile share (%AppData%\Microsoft\Office\16.0\Licensing).
3. If using FSLogix Profile Containers, ensure the default %LocalAppData%\Microsoft\Office\16.0\Licensing path is not excluded in your custom Redirections.xml file.

Step 3: Verify ODT Configuration for Future Deployments

If deploying Office using the Office Deployment Tool (ODT), update your configuration.xml file before sealing master images:

XML

<Configuration>
  <Add OfficeClientEdition="64" Channel="Current">
    <Product ID="O365ProPlusRetail">
      <Language ID="en-us" />
    </Product>
  </Add>
  <Property Name="SharedComputerLicensing" Value="1"/>
</Configuration>

Step 4: Clear Stale Activation Tokens from User Profiles

If specific users experience persistent sign-in loops within active profile containers, clear stale token files using the automated state reset procedure in How to Reset the Microsoft 365 Activation State (Using SaRA Tool).

Hard-Stop Red Flags

• Unsupported M365 License Tier: SCA is not supported on Microsoft 365 Business Basic, Business Standard, or Office Home & Business. If users are assigned these tiers, SCA will fail regardless of registry settings.
• Access Denied to Token Folder: If local security permissions prevent the user account from creating files inside %LocalAppData%\Microsoft\Office\16.0\Licensing, review directory security flags using How to Fix “0x80070005” Access Denied Activation Error.

What the IT Admin Will Check

1. User License SKU Entitlement: Verify in the Microsoft 365 Admin Center that the affected user holds an SCA-eligible SKU (M365 Business Premium, E3, E5, F3, or Enterprise Apps).
2. Network Endpoint Whitelisting: Ensure VDI host subnet firewalls allow outbound HTTPS (Port 443) traffic to:
   • activation.sls.microsoft.com
   • ols.officeapps.live.com
3. FSLogix Container Logs: Check C:\ProgramData\FSLogix\Logs\Profile to confirm that the profile container mounts cleanly at logon and that local AppData folders are captured upon logoff.
4. Group Policy Management: Confirm that the GPO rule Use shared computer activation under Computer Configuration > Policies > Administrative Templates > Microsoft Office 2016 (Machine) > Licensing is set to Enabled.

Ticket Closed

Shared Computer Activation (SCA) errors in VDI environments are caused by unconfigured master image registry flags or un-persisted licensing token paths. Enabling SharedComputerLicensing=1 in the master image registry and ensuring %LocalAppData%\Microsoft\Office\16.0\Licensing is roamed via FSLogix eliminates repetitive sign-in prompts and prevents users from exhausting their 5-device activation quota. Re-seal the master image and push the updated pool to restore seamless virtual desktop licensing.