When provisioning a Windows Server 2008 R2 Datazenter VPS in Azure there is a question,

Already have a Windows Server Licence?

I selected "no" and expected that the cost for the instance would include a license because the info bubble says,

If you own Windows licenses with active Software Assurance (SA) or have an active Windows Server subscription, use Azure Hybrid Benefit to save compute cost.

Upon accessing the server via remote desktop connection, the instance indicates that windows is not activated and needs a product key.

https://azure.microsoft.com/en-us/pricing/licensing-faq/ states:

The license to run Windows Server in the Azure environment is by default included in the per-minute cost of your Windows Virtual Machine.

So where is the key?


There is a couple different pre-reqs for the VM to get activated.

  1. Windows is configured with the appropriate KMS client setup key for that version of Windows.
  2. Windows is configured to use the Azure KMS service, e.g. kms.core.windows.net:1688 for VMs in Azure public cloud regions.
  3. VM has network connectivity to the KMS endpoint, e.g. kms.core.windows.net:1688 for VMs in Azure public cloud regions. For example, if the guest OS firewall or an Azure network security group (NSG) rule does not allow TCP port 1688 outbound, the activation request will be blocked.
  4. Source IP address of KMS activation requests from the VM must be an IP address within the Azure IP ranges. This is necessary because the Azure KMS service only allow requests through if the source IP is within the Azure IP ranges. If you are using ExpressRoute, please see Azure VM may fail to activate over ExpressRoute. If you are using site-to-site VPN please see Use Azure custom routes to enable KMS activation with forced tunneling.


  • I'm new to windows server, but I think that points 1 and 2 should be handled by the OS image issued by Azure. Is that right? Point 3 is to open port 1688 on the network security group (which it isn't presently) and if points 1 and 2 are done right then should point 3 fix it since I'm not using ExpressRoute? Aug 25 '19 at 20:34
  • @AuntJemima correct, that should fix it since you use an Azure image.
    – Jarnstrom
    Aug 26 '19 at 5:04
  • It worked. #3 worked. Thank you. As a weird observation, I spun up a Windows Server 2019 intance while port 1688 was still disabled and it managed to activate without me doing anything. Aug 26 '19 at 13:23
  • That is a bit weird, could it be that you opened the port in a NSG and deployed the 2019 VM to the same network ? Doesn’t really matter as long as everything works though
    – Jarnstrom
    Aug 26 '19 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.