Windows 11 Enterprise Review: What You Get That Pro Simply Cannot Do

Fix it now

Windows 11 Enterprise is not a boxed product. It reaches devices through a subscription such as Microsoft 365 E3 or through a volume agreement, so the real question is whether the subscription carrying it earns its cost. The genuinely Enterprise-only capabilities are narrower than most feature comparisons suggest.

1. Consider it if you need Credential Guard. Microsoft supports it on Enterprise and Education only, and the entitlement comes from Windows Enterprise E3 or E5 or Windows Education A3 or A5.
2. Consider it if you need the long-term servicing channel for fixed-function devices, or Enterprise multi-session rights for a virtual desktop deployment.
3. Skip it if your reason is application control. App Control for Business is supported on Windows Pro and the Pro licence grants the entitlement, so you may already have it.
4. Skip it if you are under 300 users and Microsoft 365 Business Premium covers you, because that plan carries Windows 11 Pro and Pro for Workstations rights and Intune with it.
5. Skip it if nobody can name the Enterprise-only feature they intend to deploy and who will operate it. Future-proofing is the most expensive reason anyone gives for this purchase.
6. Do not buy a retail Enterprise key. Microsoft does not sell one, and a key advertised as such is a licensing problem rather than a bargain.

Enterprise arrives as an upgrade delivered by subscription or volume agreement. The device underneath still carries its own Windows licence, normally the Pro licence it shipped with, so cancelling the subscription returns the estate to that rather than to nothing.

If that settles it you can stop here. If you are trying to work out which of Pro, Business Premium and E3 you actually need, the next section separates the features from the licensing.

Why it happens

The differences between Pro and Enterprise are concentrated in identity protection, servicing options and licensing rights rather than in anything you can see on screen. Start with the one that is unambiguous. Credential Guard uses virtualisation-based security to isolate derived credentials so that stolen hashes cannot be replayed against other systems, which is the mechanic behind a great deal of lateral movement. Microsoft’s own table lists it as supported on Windows Enterprise and Windows Education and not on Windows Pro, and names Windows Enterprise E3 and E5 and Windows Education A3 and A5 as the licences that grant it. Since Windows 11 22H2 it is enabled by default on domain-joined systems that meet the hardware requirements, which makes the licensing question the only remaining one.

Now the correction that saves organisations money. Application control is regularly sold as the second reason to move to Enterprise, and on current documentation it is not one. App Control for Business, which Microsoft used to call Windows Defender Application Control, is supported on Windows Pro, Pro Education and SE, Enterprise and Education, and Microsoft lists a Windows Pro licence as granting the entitlement. If application control is your requirement, you can start on Pro. What you cannot skip is the work: discovering what your organisation runs, authoring policy, testing it against the departments that will break it, and maintaining it as software changes. Buying a licence is the easy part of application control, and it was never the expensive part.

The long-term servicing channel is a real Enterprise-only route, and it is also the one most often misused. Microsoft states that it is not intended for deployment on most or all the PCs in an organisation, and that it exists for special-purpose devices that do a single important task and do not need feature updates often. Windows 11 Enterprise LTSC 2024 released on 1 October 2024 and is supported to October 2029. Put an instrument, a controller or a kiosk on it. Do not put the finance department on it.

It is equally important to know what is not exclusive. BitLocker, Hyper-V, domain join, Group Policy, Windows Update for Business and Intune enrolment are all available on Windows Pro. A great many organisations assume they need Enterprise for management and find they already had what they needed, which is exactly the check worth doing before a renewal rather than after it.

The licensing route decides more than the feature list does, because the common route is per user rather than per device. That means the count follows people, not machines: a user with a laptop, a desktop and a tablet is one licence, which suits organisations where staff carry several devices and suits shared-device environments far less well. Work out your real user-to-device ratio before comparing routes, because it can reverse the answer.

The other decision to make deliberately is Business Premium against E3. Microsoft caps the Business family at 300 provisioned seats across Business Basic, Standard and Premium, and states that organisations above that should look at the enterprise plans. Business Premium carries Windows 11 Pro and Windows 11 Pro for Workstations rights rather than Enterprise, so it is the cheaper answer only when Pro-level Windows is genuinely enough. Microsoft 365 E3 is the plan that lists Windows 11 Enterprise.

Full reference

Which route carries which Windows rights

What is genuinely Enterprise-only, and what is not

Virtual desktops change the licensing question

If the reason Enterprise is on the table is Azure Virtual Desktop or Windows 365, read Microsoft’s Azure Virtual Desktop licensing page before you decide anything. For Windows client session hosts used for internal commercial purposes, the eligible licences are Microsoft 365 E3, E5, A3, A5, F3 and Business Premium, Windows Enterprise E3 and E5, Windows Education A3 and A5, and Windows VDA per user. That list is the actual answer to “which subscription do we need for virtual desktops”, and it includes Business Premium, which surprises people who assumed E3 was the entry point.

One trap worth naming: session hosts running Windows Server are licensed a different way entirely, through Remote Desktop Services CALs with Software Assurance or RDS User Subscription Licences. Choosing a Windows Server session host to save money and then licensing it as though it were a Windows client is a compliance gap that nothing will warn you about.

Before you renew anything

1. List the Enterprise-only capabilities you actually deploy today. Credential Guard, LTSC and the virtual desktop rights are the usual honest answers.
2. Check whether anything on your list is available on Pro. App Control for Business is the common one people get wrong.
3. Count users against devices. Per-user licensing rewards estates where people carry several machines and penalises shared-device environments.
4. If you are under 300 users, price Business Premium alongside E3 rather than assuming the enterprise plan.
5. If you are buying E5 rather than E3, name the E5 service you will deploy and the person who will operate it. If you cannot, buy E3.

Practical notes on running Enterprise

• Credential Guard being on by default from Windows 11 22H2 means some estates already have it without anyone deciding to. Check before you buy it, and check for driver compatibility if you are enabling it deliberately.
• Application control policy is a project with an owner, not a licence. Budget the discovery and testing time or the capability sits unused.
• LTSC devices drift away from the rest of the estate in application compatibility over time. That is the trade you are making, and it is the right one only for devices whose function must never change.
• Enterprise is an upgrade delivered by subscription or agreement. Keep the underlying device licences in order, because they are what the estate falls back to if a subscription lapses.
• Overlapping entitlements are extremely common. Organisations that moved most users to a Microsoft 365 plan and kept a separate Windows agreement frequently pay twice for the same right.

Questions people ask about this