Where to Buy Licences: Reseller, Marketplace or Straight From Microsoft

Fix it now

All three routes sell the same licences. What differs is the evidence you end up holding, who is accountable when something fails, and whether anybody tells you the SKU does not cover what you are about to do. Direct and reseller purchases leave an invoice naming your legal entity and a record in a Microsoft portal. A standalone marketplace key usually leaves neither.

1. Buy direct if you already know the exact SKU, edition and seat count. The record is unambiguous, and nobody reviews the choice.
2. Buy through a reseller if nobody in the business is a licensing specialist. The expensive mistakes are made in the SKU, the CAL type and the count, not in the price paid.
3. Buy Windows OEM with the hardware and specify Pro at the point of order. It is the cheapest legitimate route to a Windows business licence.
4. Skip any listing that sells a product key on its own. Microsoft’s Universal License Terms make product keys Confidential Information of Microsoft that a customer may not disclose to third parties.
5. Treat a second-hand licence as a documents question, not a price question. Microsoft publishes one route for transferring a licence to a third party, and it has conditions – they are set out below.
6. Check the delegated access before appointing a partner. A Granular Delegated Admin Privileges relationship runs two years at most and you can terminate it yourself.

If you already have an invoice in the company name and the entitlement is visible in your own portal, the channel question is settled. Below is what Microsoft actually publishes about transfers and resold licences, and where the legitimate savings really sit.

Why it happens

Buying direct suits an organisation that knows exactly what it wants. You self-serve, the subscription sits in your own tenant, the record is unambiguous, support comes from the vendor, and nobody reviews your choice. If you have bought the wrong plan, too many seats or a SKU that does not cover your virtualisation, you find out at renewal. For a business with a licensing specialist that is fine. For most businesses of ten to a hundred people it is the main risk of the channel.

A reseller or partner buys the same licences on your behalf and adds the part self-service does not: which edition covers your virtualisation, whether you need User or Device CALs, whether an upgrade licence has a qualifying operating system licence underneath it, and whether the plan you are about to buy for everybody is right for everybody. Microsoft’s own commercial licensing page states the underlying rule plainly – a properly licensed operating system is either a full licence or an upgrade licence combined with a pre-existing full licence – and that single sentence is behind a large share of the mistakes a reseller catches.

Marketplaces and key sites sell keys rather than entitlements, and the two are not the same thing. A key is a technical enabler. The licence is the right to run the software, and the evidence for it is the purchase record and the agreement it sits under. Microsoft’s own guidance on genuine Windows is direct about the failure mode: validation failure is common for copies of Windows purchased from an online auction site, or where Windows came on a used PC, and Microsoft advises asking for the Certificate of Authenticity and the original media when you buy a used machine.

There is a legitimate second-hand market question underneath all of this, and it deserves a factual answer rather than a shrug. Microsoft publishes exactly what it permits. A customer may transfer only fully-paid, perpetual licences, and only to an Affiliate, or to a third party solely in connection with the transfer of the hardware to which – or the employees to whom – those licences were assigned, as part of a divestiture or a merger. Microsoft must be notified, the transferee must receive documentation showing the scope, purpose and limitations of what was transferred, and the transferring customer must uninstall the software and render its copies unusable. Subscription licences and metered products cannot be transferred to a third party at all, and attempted transfers that do not comply are void.

That is the published position and it is the one to hold a seller to. Whether any particular resale is lawful where you trade is a question for your own legal adviser rather than for a supplier, and this article does not answer it. What it does answer is what you should be able to see before money moves: the transfer documentation, the original agreement, and a route by which the entitlement appears in a record you control.

Full reference

The three routes against what actually matters

What Microsoft publishes about transferring a licence

• Only fully-paid, perpetual licences may be transferred. Subscription licences and metered products may not be transferred to a third party.
• The permitted destinations are an Affiliate, or a third party solely in connection with the transfer of the hardware to which – or the employees to whom – the licences were assigned, as part of a divestiture of all or part of an Affiliate, or a merger.
• Microsoft must be notified of the transfer, and the transferee must receive documentation setting out the scope, purpose and limitations of the licences transferred.
• The transferring customer must uninstall the product and render any copies unusable.
• Attempted transfers that do not comply are void.
• Separately, the Universal License Terms make all product keys Confidential Information of Microsoft, and state that a customer may not disclose product keys to third parties.

That list is what Microsoft publishes, stated so you can hold a seller to it. It is not legal advice, and whether a particular resale is lawful where you trade is a question for your own adviser. Arco is a reseller of new licences and does not deal in resold activation keys.

Two halves of proof, and where each half lives

Proof of licence is always two things together, never one alone. First the transaction: an invoice showing your legal entity, the SKU, the quantity, the date and the channel. Second the entitlement, visible where that channel records it. For subscriptions that is the Microsoft 365 admin center. For volume licensing agreements it is now also the Microsoft 365 admin center – the Volume Licensing Service Center retired in April 2024 and agreements, licence keys and downloads moved to Billing, then Your products, then the Volume Licensing tab, with the old VLSC roles carried across. For OEM it is the hardware invoice and the device itself.

• A product key alone proves that software can activate. It says nothing about whether you were entitled to it.
• A screenshot of a confirmation email is not an invoice, and neither is a payment receipt with no line detail.
• An invoice in a personal name against a licence deployed on company hardware is a gap, and it is a common one in businesses that started as one person.
• Keep both halves for as long as the licence is deployed, which for a perpetual licence can be a decade.
• For a used PC, Microsoft’s own advice is to ask for the Certificate of Authenticity and the original media.

Delegated access: what to ask for now

The old model, where a partner held standing administrative rights in your tenant indefinitely, is not how this works any more. Microsoft stopped granting Delegated Admin Privileges for new reseller relationships in production on 10 October 2023 and replaced them with Granular Delegated Admin Privileges, which grant specific roles through security groups rather than global administrator by default. A GDAP relationship cannot be permanent: two years is the maximum, auto-extension adds six months at a time, and the customer can terminate it. The question to ask a prospective partner is therefore not whether they will use granular access but which roles they are requesting and for how long, and whether you know where to go to end it.

Where the legitimate savings actually are

• Specify the Windows edition you need when you buy hardware. OEM at the point of purchase is the lowest legitimate route to a Windows business licence there is.
• Match the plan to the person. Staff who need mail and web applications do not need the seat a finance manager needs.
• Reclaim unassigned seats before every renewal. This costs nothing and is usually the largest single saving available.
• Use Device CALs wherever machines are shared, because the device count is lower than the headcount there.
• Ask about charity, education and non-profit programmes if you qualify. They are a real route and they carry none of the grey-market exposure.
• Do not size a purchase around an Enterprise Agreement unless you are actually eligible for one: Microsoft sets the qualifying size at 500 users and devices for commercial customers, 250 for public sector.

Which route fits, by situation

• One home PC: direct, a shop you know, or OEM with the hardware. All three give you a receipt.
• Sole trader who knows the product: direct is perfectly reasonable. Keep the invoices in the business name rather than a personal one.
• Small business with no in-house licensing expertise: a reseller, because the expensive mistakes are in the choice of SKU and the count.
• An organisation with a volume agreement: buy through the agreement, and export your entitlement records periodically rather than trusting any portal to stay unchanged.
• Anyone in diligence, under review, or about to be: buy nothing from a marketplace, and start the register today.
• Someone offering you licences from a business that has closed: ask for the transfer documentation described above before anything else. Without it there is nothing to buy.

Questions people ask about this