Licensing a Hybrid Workforce: Home Laptops, Office PCs and Everything

Fix it now

Three separate questions decide hybrid licensing and only one of them follows the person. The device decides Windows, the work decides the Microsoft 365 plan, and whether you must manage the machine decides whether a personally owned PC can be part of the answer at all. Trying to settle all three with one purchase is where this goes wrong.

1. Buy nothing extra for a company laptop that goes home. It is already licensed and manageable; check that encryption and device policy are actually applied.
2. Buy a second company machine with Windows Pro rather than trying to manage a home PC. Every Windows 11 and Windows 10 edition except Home can be Microsoft Entra joined, and Home is not listed for BitLocker enablement.
3. Skip the assumption that a Microsoft 365 seat licenses Windows. A properly licensed operating system is a full licence, or an upgrade licence over a pre-existing full one.
4. Use Intune app protection policies for personal phones and tablets. They work without enrolment, but cannot deploy apps or provision certificate, Wi-Fi or VPN profiles.
5. Buy Remote Desktop Services CALs before the 120-day grace period runs out. Each user or device reaching a session host needs one on top of the Windows Server CAL.
6. Price a cloud desktop as a stack, not a line: Windows 365 Enterprise needs Windows E3, Intune, Microsoft Entra ID P1 and a Windows 365 licence per user.

If everyone is on a company laptop, the answer is already nothing extra. Below is what each device situation actually needs, where Windows licensing stops at the front door, and what the remote-access routes cost in licences.

Why it happens

Classify every device that touches company data, because the licensing follows the device rather than the person. Who owns it decides the Windows question. Whether you must manage it decides the edition. What the person does on it decides the Microsoft 365 plan. Those three answers are independent, and the most common hybrid mistake is assuming a Microsoft 365 licence resolves the first one.

It does not. Microsoft 365 licenses the applications and the cloud services attached to a user; the operating system on a physical device is licensed with that device. Microsoft’s own commercial licensing page states the underlying rule: a properly licensed operating system is either a full operating system licence, or an upgrade licence combined with a pre-existing full operating system licence. An upgrade right presupposes something to upgrade from. Before you assume a plan covers a personal machine, confirm what counts as a qualifying licence on your own Product Terms.

Edition is a technical wall as well as a licensing one, and the detail here is finer than the usual advice suggests. Microsoft documents that all Windows 11 and Windows 10 editions except Home can be Microsoft Entra joined, and BitLocker enablement is listed for Pro, Enterprise, Pro Education and Education but not for Home – Home gets Device Encryption instead, which is automatic but not centrally managed. What is not true is that a Home machine cannot be touched at all: Windows 11 Home appears in Intune’s list of supported editions for enrolment. Microsoft’s own caveat is the part that matters, though – not all Windows editions support all operating system features being configured through MDM. So a Home device can be enrolled and still refuse most of the baseline you wanted to apply to it.

What the applications allow is more generous than people assume and worth using before buying anything. A licensed Microsoft 365 user may install Microsoft 365 Apps on up to five PCs or Macs, five tablets and five phones. One person with a laptop, a desktop and a phone consumes one seat, not three. The asymmetry that used to catch people out – endpoint protection counted per device while Office counted per user – does not apply to the endpoint product Business Premium includes either: Microsoft Defender for Business covers up to five client devices per user licence.

Where the work genuinely requires a managed device and the person owns their machine, there are two honest answers and neither is a licence bolted onto someone’s own PC. Either buy company hardware with Pro on it, or move the desktop into the cloud so the machine in front of the person becomes a screen and a keyboard. Both are purchases. Pretending a personal Home machine can be brought under a baseline is not.

Full reference

Four ownership situations, four different answers

Where Windows licensing stops at the front door

An OEM Windows licence is bound to the device it shipped with and does not travel to another machine. A volume or retail licence can be reassigned, but Microsoft’s terms allow that no sooner than 90 days after the last reassignment, with published exceptions for permanent hardware failure or loss and for termination of the user’s employment or contract. There is no per-user Windows licence in the small business plans that follows a person onto whatever hardware they happen to sit in front of, which is precisely the assumption hybrid working tempts people into making.

Personal devices: what app protection can and cannot do

Intune app protection policies work independently of any mobile device management enrolment, on iOS and iPadOS, Android and Windows. They can require a PIN or biometric to open a managed app, control data sharing between apps, prevent saving corporate data to personal locations, encrypt corporate data and selectively wipe it. The user needs a Microsoft Entra account, an Intune licence and membership of a targeted group, and on Android the Company Portal app must be present. Microsoft is equally clear about the ceiling on an unenrolled device: applications are not deployed to it, so the user gets them from the store, and certificate, company Wi-Fi and VPN profiles are not provisioned. If your requirement includes any of those, app protection is not the answer and a managed device is.

Remote access routes and what each costs in licences

One point in favour of cloud desktops for older estates: Microsoft provides Windows 10 Extended Security Updates at no additional cost for Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop. If part of the reason for the hybrid conversation is a set of machines that cannot move to Windows 11, that changes the arithmetic on where those desktops should live.

What to buy, by workforce shape

• Everyone on a company laptop, some days at home: nothing new to buy. Confirm encryption and device policy are applied, because the office network is no longer doing that work.
• Company laptops plus occasional personal-device access to mail and documents: keep the seats you have and use app protection policies rather than trying to manage those devices.
• Staff who need a second machine at home: buy it with Pro. It consumes no extra Microsoft 365 seat and no extra Defender for Business device beyond the five that seat already covers.
• Contractors and short-term staff: a cloud desktop avoids both the hardware purchase and the argument about managing somebody else’s laptop, but price the whole licensing stack rather than one line.
• Anyone reaching an on-premises line-of-business application: budget RDS CALs on top of your Windows Server CALs, and do it before the 120-day grace period expires.
• Regulated or client-audited work: assume unmanaged personal devices will not be accepted, and price company hardware in from the start.

Questions people ask about this