فا
MSLicenseHub
windows · reference
🎓

Windows 11 Education

Windows 11 Education and Pro Education — feature-equivalent to Enterprise/Pro with education defaults, sold through academic Volume Licensing.

WINDOWS 11 EDUCATION
On this page

Editions · channels · activation · audit notes · FAQs

Editions covered
4
Edition matrix with feature differences and the right audience.
In-depth sections
5
Channels, activation, audit, modern management & more.
FAQs answered
6
Common questions buyers and IT admins ask before purchase.
Words of reference
0.6k
Plain-English, no vendor agenda, updated to current Product Terms.
Edition matrix

Pick the right edition

Each edition targets a specific scale and feature set. Match the workload, not the price tag.

Edition 1
Pro Education

Academic equivalent of Pro. BitLocker, Hyper-V, AD/Entra join, Group Policy, AppLocker.

Edition 2
Education

Academic equivalent of Enterprise. Adds Credential Guard, Application Guard, WDAC, Windows Autopatch.

Edition 3
Education A3 (per user)

Microsoft 365 A3 entitlement — Education licence on up to five devices per licensed user.

Edition 4
Education A5 (per user)

Microsoft 365 A5 entitlement — adds Defender for Endpoint, Entra ID P2 and Purview eDiscovery.

Side-by-side

Edition comparison

Heuristic capability matrix derived from each edition's intended use. For binding commitments, always confirm against the current Product Terms.

CapabilityPro EducationEducationEducation A3 (per user)Education A5 (per user)
Target audienceEducationEducationEducationEducation
Domain / Entra join
Virtualisation rights
Advanced security
Centralised management
Volume Licensing path
Deep dive

Windows 11 Education — what to actually know

Windows 11 Education and Pro Education are the academic SKUs of Windows 11. Feature-set-wise, Education is functionally equivalent to Enterprise and Pro Education matches Pro — same security surface, same management capabilities, same activation models. What changes is the defaults (consumer features that distract in a classroom are switched off out of the box), the licensing channels (academic Volume Licensing, OVS-ES, Microsoft 365 A1/A3/A5 per-user subscriptions, and student-use benefits) and the pricing tiers offered to qualifying institutions. Schools, colleges and universities should always start with Education licensing rather than commercial Enterprise because the academic SKUs cost a fraction of their commercial equivalents while delivering the same technical capabilities.

01

Education vs Pro Education — picking the right SKU

Pro Education is the academic counterpart to Pro and is the right choice for student-owned laptops, computer-lab workstations and faculty machines that need the full Pro management surface (BitLocker, Hyper-V, Remote Desktop host, AD/Entra join, Group Policy, AppLocker via WDAC). Education matches Enterprise and adds Credential Guard, Application Guard, full WDAC tooling, DirectAccess and Windows Autopatch — the right floor for institution-owned shared devices, lab images, exam machines and any device that will be enrolled in a managed estate. Both ship with the 'SetEduPolicies' defaults: Tips & Tricks suggestions are off, the Microsoft Store consumer surface is restricted, Cortana consumer features are disabled, and Spotlight content is suppressed.

02

Academic licensing channels

Qualified educational institutions reach Education through Enrollment for Education Solutions (EES), Open Value Subscription for Education Solutions (OVS-ES), Microsoft Cloud Agreement (CSP-Edu) and Microsoft 365 A1, A3 and A5 per-user subscriptions. A1 covers basic online services and is often free for students and staff at qualifying institutions. A3 and A5 add the desktop apps, Intune for Education, Defender for Endpoint, Entra ID and Purview tooling — A5 sits at the top with the full security and compliance stack. Microsoft 365 A3 includes Windows 11 Education as a per-user subscription activation entitlement covering up to five devices per user, mirroring the commercial M365 E3 model.

03

Shared device and Take a Test scenarios

Education includes shared-PC mode, which optimises sign-in and account cleanup for devices used by dozens of different students per day: profiles are cached briefly then aged out, the disk is kept clean, sign-in is fast, and there is no risk of one student's session bleeding into the next. Take a Test creates a locked-down browser session for exams — no other apps, no print, no screen capture, no clipboard — and pairs with assessment platforms used by school districts and universities. Set up School PCs is a free provisioning tool that turns USB sticks into a one-click image deployment for shared laptops, sidestepping the need for full Intune Autopilot in smaller environments.

04

Intune for Education and classroom tooling

Intune for Education is a simplified, classroom-aware skin over Intune designed for IT staff who are not full-time MDM specialists. Teachers and lab admins can group devices by class or grade, push apps from the Education Store, restrict settings, schedule reboots after class hours and inventory devices with a UI that does not require an MDM engineer to navigate. For mixed estates that include iPads and Chromebooks, Intune for Education manages those alongside Windows devices in the same console — a meaningful reduction in tooling overhead for a typical K-12 IT team of one or two people serving hundreds of devices.

05

Upgrade paths and student-use benefits

Pro to Pro Education and Pro to Education are in-place upgrades that flip the device through a key change under Settings → Activation — no reinstall, no data loss. Many EES and OVS-ES agreements include the Student Advantage / Student Use Benefit, which entitles every student at the institution to install Microsoft 365 Apps for Enterprise on personal devices at no additional charge. For BYOD-heavy campuses, this is often the single biggest practical benefit of the academic agreement: students get a fully licensed Office on their own laptops simply by signing in with their institutional account.

By channel

Where to buy this product

Relative fit of each licensing channel for typical buyers of this product. Calibrate against your own scale and renewal strategy.

Channel fit (typical buyer)
Retail / FPP7
OEM (pre-installed only)9
Volume Licensing9
CSP / Microsoft 3658
Retail / FPPIndividuals & small teams

Boxed or ESD keys, transferable, registered to a Microsoft account.

Volume LicensingMid-market & enterprise

MAK / KMS activation, centralized VLSC, optional Software Assurance.

CSP / Microsoft 365Subscription, per user

Monthly / annual seats, managed through partner or admin center.

OEM is not a buying channel for end users. OEM keys are supplied pre-installed by hardware manufacturers and are not sold standalone — choose Retail, Volume or CSP instead.
Support timeline

Lifecycle phases to plan against

Windows desktop licensing has three legitimate routes — Retail FPP, OEM pre-installation on new hardware, and Volume Licensing for organisations. Pick the wrong one and you either overpay (Retail for fleet) or break the rules (OEM after the fact).

Phase 1
General availability
Launch day

Edition matrix opens across Retail, OEM (system builders) and Volume Licensing channels. Initial servicing channel is the General Availability Channel (GAC).

Phase 2
Mainstream support
Years 1–5

Monthly cumulative updates, feature updates once a year, free non-security fixes, and warranty-grade incident support for organisations with the right agreement.

Phase 3
Extended support
Years 5–10

Security updates only. No new features, no design changes. Paid Unified Support is the only break-fix path for organisations.

Phase 4
End of support
Beyond year 10

Extended Security Updates (ESU) can be purchased for one to three additional years, with sharply rising per-device pricing. After ESU, every new CVE is permanent.

Procurement checklist

Do this, not that

The small set of decisions that determine whether you overpay, fail an audit, or land in the right place.

DO

Standardise the whole fleet on the same edition (typically Pro or Enterprise) and use Volume Licensing re-image rights on top of OEM.

DON'T

Mix Home and Pro across the same office to save a few dollars — domain join, BitLocker and Intune all silently break on Home.

DO

Verify TPM 2.0 and Secure Boot are switched on in firmware before deployment; both are required for Windows 11 and for serious BitLocker use.

DON'T

Use the unsupported registry bypass for production machines — they will not receive feature updates and Microsoft documents this explicitly.

DO

Use a Microsoft account or Entra ID account at first sign-in so the digital entitlement is recorded against the hardware.

DON'T

Activate a Retail key on multiple machines 'just for a few days' — the entitlement migrates and the original device immediately deactivates.

DO

For 6+ devices, move to Volume Licensing or a Microsoft 365 plan that includes Windows Enterprise per user.

DON'T

Buy stacks of Retail FPP boxes for a corporate rollout — the per-device cost and management overhead never recover.

Typical deployments

How buyers actually use Windows 11 Education

Three reference deployments — find the closest match and adapt rather than starting from zero.

Scenario 1
Solo founder / consultant

A single laptop running client work — Pro is the floor. BitLocker, Hyper-V for testing, and the ability to join a future Entra tenant when the team grows. Retail FPP is the right channel until you cross five seats.

Scenario 2
Growing SMB (10–100 seats)

OEM Pro on every new device, Microsoft 365 Business Premium for the management layer, Intune for policy. You get Defender, conditional access and automated patching without standing up a domain controller.

Scenario 3
Enterprise fleet (500+ seats)

Enterprise Agreement with Windows Enterprise E3 or E5, Autopilot for zero-touch provisioning, Autopatch for the update train, and LTSC only for the narrow set of fixed-function devices that genuinely need it.

Cost optimisation

Where the savings actually live

None of these are tricks — they are the same levers Microsoft's own licensing specialists pull on every renewal.

💰
Layer OEM under Volume Licensing

Buy hardware with OEM Pro pre-installed (cheapest first licence) and add Volume Licensing or Microsoft 365 on top for re-imaging rights and Enterprise features. You only pay the upgrade delta, not the full retail stack.

📊
Use Microsoft 365 E3/E5 for Enterprise

Windows 11 Enterprise is included with M365 E3/E5 per-user — if you already pay for the bundle, paying again for standalone Enterprise licences is double-spend.

🎯
Plan Copilot+ rollouts around policy first

Recall and on-device AI features ship gated behind enterprise policy. Stand up the Intune policy set before rolling hardware so you do not have to retroactively disable features.

Counterfeit & risk

Red flags when buying second-hand

These four signals show up in every counterfeit-licence case we have seen. If any of them is present, walk away — no discount makes it worthwhile.

01
Standalone OEM key sold below market

OEM keys are distributed only pre-installed on hardware and stay bound to that device for life. A separately sold OEM key is almost certainly leaked, harvested from scrapped hardware, or fully counterfeit.

02
Lifetime key with no invoice or VLSC record

Microsoft entitlement always leaves a paper trail — a Volume Licensing Service Center record, a CSP invoice, a sealed Retail box with a COA, or a Microsoft Store order. No proof = no defence in an audit.

03
Key works once, then 'not genuine' after the next cumulative update

Classic symptom of a MAK key that has exceeded its activation pool, or a KMS key being abused outside its volume programme. Microsoft revokes these centrally; the activation grace period is short.

04
Seller refuses to put the entitlement in your tenant

Legitimate CSPs and LARs transfer the licence into your Microsoft 365 / Azure / VLSC tenant under your domain. If the seller insists on activating 'for you' on their account, you do not own anything.

Acronyms

Licensing terms used on this page

Quick definitions — the full glossary lives at /en/glossary if you need to dig deeper.

CSP

Cloud Solution Provider — Microsoft's primary indirect channel for subscriptions and cloud services.

VLSC

Volume Licensing Service Center — the portal where Volume Licensing keys, agreements and downloads live.

MAK

Multiple Activation Key — a Volume Licensing key with a finite activation count, used for isolated machines.

KMS

Key Management Service — an on-premises activation host that activates clients on a 180-day re-check cycle.

EA

Enterprise Agreement — Microsoft's largest commitment-based volume contract, typically a 3-year term with annual true-ups.

SA

Software Assurance — the upgrade-and-benefits add-on to Volume Licensing; required for new version rights and several mobility scenarios.

Browse the full glossary →
FAQ

Frequently asked questions

Who qualifies for academic licensing?+
Accredited K-12 schools, post-secondary institutions, public libraries and museums. Microsoft's academic eligibility list is the binding reference — proof of status is required at agreement signing.
Is Education really free for students?+
Microsoft 365 A1 is free for qualifying institutions to deploy to students and faculty for the basic online services. A3 and A5 are paid per-user and add the desktop apps and management surface.
Can we use Education in a corporate environment?+
No. The licensing terms restrict use to qualifying educational scenarios. Misusing academic licences in a commercial context is one of the more commonly cited audit findings.
What replaces 'Take a Test' on the newest builds?+
Take a Test remains supported on Windows 11 Education and Pro Education. Microsoft has been steering some assessment partners toward the newer Education Insights and partner-built lockdown clients, but the built-in tool is still shipping.
Where can I legitimately buy a license?+
Through Microsoft's Retail channel, an authorised Cloud Solution Provider (CSP), or a Volume Licensing partner (MPSA, Enterprise Agreement, Open Value, Server & Cloud Enrollment). OEM keys are distributed only pre-installed by hardware manufacturers and stay bound to that device for life — they are not sold to end users as standalone products. Anyone offering a 'cheap OEM key' as a standalone download is, by definition, operating outside Microsoft's distribution terms.
What gets checked in a Microsoft licensing audit?+
Auditors map every installed copy to a proof of purchase (VLSC record, CSP invoice, sealed Retail FPP), verify edition alignment (features used must match the licensed edition), and confirm CAL counts cover the maximum number of authenticated users or devices during the audit window. Small variances usually resolve with a true-up; large gaps escalate to Software Asset Management engagements and back-billing at list price.
Related

Other products in this category