Why Free Windows 10 Upgrades in CSP Is Big News

Screen Shot 2015 10 12 at 9.03.51 AM.png
In this post, I’d like to share with you why I believe that the recent changes to the licensing of Windows 10 Enterprise through the Cloud Solutions Provider (CSP) program is a big deal.


I work for a Tier 2 CSP distributor – this means that we offer Microsoft’s business cloud services to Microsoft partners, who then resell them to commercial customers – so I’m pretty familiar with some of the benefits and issues of the CSP program. CSP is a program aimed at commercial customers in the small-to-midsized enterprise (SME) market or larger customers with MPSA licensing that don’t want to sign an enterprise agreement (EA), where they pay for what they use, for as long as they use it, on a month-by-month basis.

Last September, Microsoft launched Windows 10 E3 in the CSP program. Microsoft’s goal was to interest SMEs in the security features of the Enterprise edition:

  • Credential Guard: Using hardware- and virtualization-based security, the LSASS process is hidden in an isolated virtual machine called a VSM; this protects against Pass-the-Hash or Pass-The-Ticket attacks where an intruder tries to harvest administrator access rights from a compromised machine.
  • Device Guard: Code integrity policies dictate which applications are trusted by the operating system, helping against the flood of zero-day malware.
  • AppLocker: You can create rules to define which programs and files a user can run.

Also included in Windows 10 E3 is the ability to manage the user experience via Group Policy, which was removed from the Pro edition.
It was said that anyone attending last year’s Worldwide Partner Conference (WPC, Microsoft’s global conference for partners) was bombarded with materials on why they should be pushing Windows 10 E3 into SME customers.

The Flaw in the Plan

Some of the marketing worked. Many customers were interested in the potential of deploying a more secure operating system – I know that almost all of my customers have experienced ransomware on some of their customers’ sites and anti-malware scanning has reached the limits of its capabilities.
So we had customers call up and ask about deploying Windows 10 E3 via CSP – the price of a few euros per user (not per device!) was very attractive.  But there was a catch. Here’s how the system works:

  1. An administrator assigns the Windows 10 E3 licenses via Azure AD.
  2. The user registers their Windows 10 Pro PC with Azure AD.
  3. Azure AD activates the latent Windows 10 Enterprise E3 features in Windows 10 Pro.
  4. The Enterprise E3 features remain active while the user still has a license.

The problem was that very few businesses have upgraded to Windows 10. One might argue that they should have taken advantage of the free upgrade that ended last summer, but that program was disrupting and confusing even for consumers with a single PC, let alone a company with up to 250 PCs! Many of these PCs are running Windows 7, Windows XP, and a little bit of Windows 8.1. So even though Microsoft made better security more affordable, it was logistically unavailable to these customers because they would first have to purchase Windows 10 Pro upgrade licenses via volume licensing. As a result, few signed up for the E3 program via CSP.

Good News from Licensing

Say what!? I know what you’re thinking: there’s no such thing as good licensing news. As it turns out, Microsoft made a few nice changes recently (MSDN subscribers are getting access to EMS). Brad Sams reported that any user that is assigned a Windows 10 Enterprise E3 license via CSP will be getting a free perpetual license for Windows 10 Pro – yes, they get to keep Windows 10 Pro even if they end the Enterprise E3 subscription.
This is a huge deal; effectively, Microsoft is extending the free Windows 10 upgrade program to CSP customers if they sign up to the E3 license (for each user). But it’s better than the old program – these customers are getting the volume licensing media so that they can build new OS images and deploy them if they choose (still my preferred option). Now the process will work as follows:

  1. An administrator assigns the Windows 10 E3 licenses via Azure AD.
  2. The administrator downloads Windows 10 Pro media.
  3. Pre-Windows 10 machines are either upgraded or re-imaged with the perpetual Windows 10 Pro license.
  4. The Windows 10 Pro machines are registered with Azure AD.
  5. The Enterprise E3 features are automatically activated.

Already I’m hearing from resellers who love this change from Microsoft. “Free” software means deployment projects. And to avail of Credential Guard and Device Guard, you need modern hardware; those 5-year-old PCs just won’t do.


Like I said, it’s rare that good news in licensing is actually good news – I’m trying to avoid the phrase “alt-facts”! But this is a case where I think that customers will be interested in getting their hands on Windows 10 Pro (forever) and Windows 10 Enterprise E3 for just a few Dollars/Euros per month, without the need for Software Assurance on the desktop OS.
Note: Some of the Enterprise edition via Software Assurance licensing benefits such as VDA (VDI) are not included in the CSP program.
I expect that Windows 10 Enterprise E3 will become attractive — businesses are used to subscription OSs via programs such as Open Value Subscription. The more organizations that avail of the security features in E3, the better for all of us!