Microsoft 365 shows 'Unlicensed' when licensed — fast triage

When a Microsoft 365 desktop app shows “Unlicensed” it usually means the app cannot verify an active Microsoft 365 license for the account currently signed into the app. The usual fixes are: confirm the subscription and account assignment in the browser, sign out and sign back in to force token refresh, and clear cached credentials; if those fail, test for network or device-registration blocks and then escalate. Follow the ordered checks below before contacting IT or Microsoft Support.

Symptom: what you see and when it appears

You open Word, Excel, or another Office desktop app and see “Unlicensed” in the title bar or in the Account > Product Information area. The app may still let you open files in read-only mode or show occasional prompts to sign in.

This typically appears at app start, after a system restore or account change, when network connectivity to authentication endpoints is blocked, or after tenant or device-policy changes. The exact message text varies by app and build.

Before you start (scope, permissions and safe checks)

This guide assumes you are on a managed or personal device with permission to sign out of apps and clear local credentials. If your device is managed by your organization, check with IT before running admin-level commands or uninstalling Office.

• Check you can use a browser to sign into your work/school account.
• Have your primary work/school email address ready.
• Note Office app version from Account > About before you change anything; IT may request it later.

Stop and escalate to IT if you do not have permission to sign out, clear credentials, or change network settings on the device.

3-minute triage: fast checklist to try now

Run these actions in order. They fix most cases and are reversible.

1. Confirm the subscription in the browser.

Open https://portal.office.com and sign in with the work/school (AAD) account you use for Office.

2. Check which account Office is using.

1. Open any Office desktop app and go to Account (profile icon or File > Account) and note the signed-in account shown.

3. Sign out of Office and sign back in.

1. Account > Sign out, quit all Office apps, then reopen an Office app and sign in with the exact work/school account you used in the browser.

4. Test without VPN or proxy.

1. Temporarily disable VPN and proxy, then reopen the Office app and check activation.

Expected result: the app shows your account and a licensed product. If one step changes the result (for example, it activates off VPN), stop and collect details for IT before continuing.

Step-by-step checks: confirm subscription and account assignment

Verify the cloud-side license and account assignment before changing device state.

1. Sign into the Microsoft 365 portal with the work/school account you use for Office.

Sign into https://portal.office.com and confirm the account in the top-right.

2. Look for subscription or Office access in the portal account view.

• If the portal shows a Microsoft 365 subscription or "Apps for enterprise" access, the account is licensed in the cloud. If it shows no subscription or a sign-in error, your account may not be licensed or is a guest in another tenant.

3. If you have an admin contact, ask them to verify in the Microsoft 365 admin center that a license is assigned to your user (Users > Active users > [your user] > Licenses and Apps).

What to do if Office is signed into the wrong account:

1. Account > Sign out from the Office app.
2. Quit all Office apps.
3. Reopen an Office app and sign in with the exact AAD account that the portal showed as licensed.

If you’re a guest in another tenant or have multiple accounts, collect screenshots of the Office Account page and the portal subscription page before escalating.

Token, credential cache and device-state fixes (Windows)

Cached credentials and stale tokens are frequent causes. These steps are low-risk and reversible.

1. Note the current account in Office (Account > About > product info) and save any work.

2. Check Access work or school accounts.

1. Open Settings > Accounts > Access work or school and note connected accounts.

3. Sign out of Office apps and close them.

1. Account > Sign out in each Office app, then quit all Office apps.

4. Clear stored Office credentials in Windows Credential Manager.

Open Control Panel > Credential Manager > Windows Credentials. Remove entries that start with "MicrosoftOffice" or the email address you used for the account.

5. Re-open an Office app and sign in with the correct AAD account.

Expected result: Office prompts to sign in and then activates. If activation still fails, a token refresh blocked by network or tenant policy is likely.

6. Optional token refresh via PowerShell (only with permission):

Install-Module -Name MSAL.PS -Force
Connect-MgGraph -Scopes "User.Read"

If these steps don’t restore a license, collect the Office About info, Windows version, and whether the device is Azure AD joined or hybrid joined for IT.

Token, credential cache and device-state fixes (macOS)

On macOS the Keychain stores Office tokens. Clearing the right items forces a fresh sign-in.

1. Note the account shown in the Office app and save work.

2. Sign out of Office apps and quit them.

1. Account > Sign out in any Office app, then quit all Office apps.

3. Open Keychain Access and delete Office-related items.

1. Search for your work email and for entries containing "Office" or "MSOpenTech" and delete items that clearly reference Office credentials or tokens.

4. Re-open an Office app and sign in with the correct work/school account.

Expected result: a fresh sign-in and activation. If keychain entries reappear or sign-in still fails, device registration or Conditional Access may be preventing token refresh.

Device registration and compliance quick checks

Device state can block activation when Conditional Access requires a compliant or joined device.

1. Check if the device is Azure AD joined, hybrid joined, or registered.

• Windows: Settings > Accounts > Access work or school shows join/registration status.
• macOS: open Company Portal (Intune) and confirm the device is enrolled and compliant.

2. If you recently reinstalled the OS or changed the device name, your tenant may have duplicate device objects; this requires an admin to clean up.

If the device is not listed or marked noncompliant, gather screenshots and escalate to IT. Do not try to change join state without IT approval on managed devices.

Network, tenant and identity provider issues and how to test them

Network and tenant controls often stop token renewal without an explicit error.

1. Test browser sign-in on the same machine and network.

1. Open a browser and sign into https://portal.office.com with the same account used in Office.

• If browser sign-in prompts for extra steps or fails, the tenant or network is likely blocking authentication.

2. Switch networks and disable VPN/proxy.

1. Temporarily use a home Wi‑Fi or a mobile hotspot with VPN and proxy disabled, then reopen an Office app.

• If Office activates on the alternate network, a corporate VPN, proxy, or firewall is blocking required OAuth endpoints.

3. Consider identity provider issues.

• If your org uses ADFS or an on-premises identity provider, legacy routing or an old ADFS URL can interfere with modern auth flows. Ask your admin whether Conditional Access or ADFS changes were recent.

If network testing points to a block, collect the time you performed the tests, the network used, and whether disabling VPN changed the result before you contact IT.

When to escalate and what to collect for IT or Microsoft Support

Escalate after you’ve confirmed the license in the portal and tried sign-out, credential clears, and network tests.

Collect these items before you contact IT or Microsoft Support:

• Screenshot of the Office app Account page showing the signed-in account and “Unlicensed” status.
• Screenshot of the portal page that shows your account and subscription status.
• Time and date of the failure and the results of network tests (on corporate network vs hotspot, with and without VPN).
• Device details: OS version, Office app version (Account > About), Azure AD join state, and Intune/Company Portal compliance status if available.

Logs IT will ask for (collect only if you can and have permission):

• Office diagnostic logs or Support and Recovery Assistant output if approved by your admin.
• Windows: relevant Event Viewer logs under Applications and Services > Microsoft > Office 16 (labels may vary).
• macOS: Console logs and any error traces from the Company Portal.

Provide the exact steps you already tried — that saves time and narrows down whether the issue is a license assignment, Conditional Access, device-registration state, or network block.

Least-destructive reset and reinstall sequence

Try these in order; stop when the app activates.

1. Sign out of Office and clear credentials (Credential Manager or Keychain), then sign back in.

2. Use Office repair (Windows) or uninstall/reinstall following Microsoft’s official uninstall instructions (macOS) only if the above fails and after you check with IT for managed machines.

Settings > Apps > Microsoft 365 Apps > Modify > Quick Repair

If reinstalling is required, reinstall the same build your organization supports and sign in with the AAD account that has the license.

Conclusion

If the quick triage fixed it, you’re done. If not, gather the screenshots and device/network details listed above and contact your IT admin or Microsoft Support — the issue is usually a missing license assignment, a Conditional Access or device-compliance block, or a network/authentication routing problem that requires admin action.