EA Qualified User Definition – Microsoft EA Renewal

If your organization is delivering services to external users, you should assess whether the users should be licensed from Microsoft under your Enterprise Agreement (EA).

In the order of precedence, you should first look at the Enterprise Agreement, as this will govern how licenses under the Enterprise Agreement may be assigned. The EA ‘Agreement’ (2018) document states that EA licenses can be assigned to users or devices “within the Enterprise“. Accordingly, If the users or devices are not “within the Enterprise”, one could argue they need to be licensed under another agreement, or you should determine the service description and delivery topology meet the requirements for SPLA.

Microsoft do not explicitly define “within the Enterprise”, the ‘Enterprise’ is defined by the affiliates declaration in the Enterprise Enrollment. Normally, a business will select “all and future affiliates” to incorporate planned acquisitions. Microsoft would normally classify an enrolled affiliate as an organization that is more than 50% owned, however, there are exceptions where a ‘participation amendment’ has been signed to expand on this minimum ownership requirement, for example, to support partnerships in the legal sector or insurance market.

If the users could be characterized as “within the Enterprise”, you should confirm by assessing whether the users meet the criteria of ‘qualified user‘ under the EA ‘Enrollment’, specifically users working from a ‘qualified device‘, and that device is “used by or for the benefit of the enrolled’ affiliates enterprise” [Ref: Microsoft Enterprise Agreement Enrollment, February 2018]

Microsoft expand on the ‘qualified user’ beyond employees alone, to a “person, (e.g. employee, consultant, contingent staff)” [Ref: Microsoft Enterprise Agreement Enrollment, February 2018] , with the criteria for the end-users to be considered ‘qualified users’ for licensing under the EA, as follows:

  • The user’s ‘qualified device‘ is capable of running windows locally, or is used to access a genuine Windows Desktop OS virtually. (Normally, this is a laptop so this would be a qualified device for this first criteria)
  • Secondly, to be a ‘qualified userrequires access to the products of an Enterprise Online Services (EOS), or Enterprise Products of the your organization’s EA.
  • To determine this, look at the Product Terms for what is an ‘Enterprise Online Service’ (‘EO’) or Enterprise Product (‘E’), and compare to what you have in your EA enrollment, and/or the services planned to be provisioned to the user(s) under the appropriate licensing bundle(s). If the user(s) are using components of an EOS or Enterprise Product, then this will determine those users as falling under the ‘qualified user’ count for the EA (For example access to services licensed under Microsoft 365 E3 or E5 for be an Enterprise Online Service, or Enterprise CAL).
  • Thirdly, Microsoft  expand the ‘qualified device’ definition to include BYOD (Bring Your Own Device) PCs and would require licensing under the EA if the devices meet the Windows ‘qualified device’ test, and, the client OS is alsomanaged‘ by the your organization. This is defined in the product terms as:
    • “If Customer’s volume licensing agreement refers to the Product Terms, the Product List, or the PUR for defining managed Qualified Devices, the following terms apply. Customer “manages” any device on which it directly or indirectly controls one or more operating system environments. For example, Customer manages any device:
      it allows to join its domain, or
      • it authenticates as a requirement to use applications while on its premises, or
      • it installs agents on (e.g., anti-virus, antimalware or other agents mandated by the Customer’s policy), or
      • to which it directly or indirectly applies and enforces group policies, or
      • on which it solicits or receives data about, and, configures, or gives instructions to hardware or software that is directly or indirectly associated with an operating system environment, or
      • it allows to access a virtual desktop infrastructure (VDI) outside of Windows SA, Microsoft Intune (Device) or Windows Virtual Desktop Access Roaming Rights.
      A device that accesses a VDI under Roaming Rights only or utilizes Windows To Go on a Qualifying Third Party Device off the Customer’s premises only, and is not managed for other purposes as described here, is not considered “managed” for purposes of this definition”.

[Ref: Microsoft Enterprise Agreement Enrollment, February 2018]

(The latter reference to ‘Roaming Rights’ is a specific reference to the expired/expiring Windows per device SA benefit (Ref: Product Terms, February 2016))


In terms of some guidance on when a user is considered a ‘qualified user’ under the EA :

  • The language specifically includes consultant and contingent personnel.
  • If you provide them with hardware, refer to the qualified device definition within the Enterprise Enrollment.
  • Those users could still be exempt from the EA, based on the non-managed ‘industry device’
  • The ‘qualified device’ definition does refer to ‘capable’ i.e. can it run Windows or Office locally or virtually, or can it be exempted as an ‘industry device’?
  • Do you provide ‘access’ to services within Enterprise Online Services or Enterprise Products e.g. CALs (note this is not the same as ‘use’)
  • If an external contractor, best practice is that they are responsible for hardware and software, and,
  • If BYOD, it could still fall under one of the ‘managed’ device criteria,
  • The only other exemption criteria, is a narrow, ‘qualified user exemption’ under the Product Terms where users with access to specific Microsoft products only, are exempt.
  • Confirm that the service could not be characterized as a “software service” and your firm as a “Service Provider” under SPLA