Is Credential Guard Included with Microsoft 365 Business Premium

Question

We use Microsoft 365 Business Premium and most of our endpoints have Credential Guard enabled, many by default out of the box. However, we've run into some computers where it will not enable and, in the logs, it indicates it will not enable because the device does not meet the licensing requirements. This happens randomly - we can factory reset the same computer and magically, Credential Guard will be enabled. If we attempt to enable Credential Guard using Intune, we get an error saying that we are not licensed for it.

However, if we are to believe the Windows edition and licensing requirements for Credential Guard, none of the computers in our organization should have Credential Guard enabled (they are all running "Windows 11 for Business", which is what the version changes to once a licensed Business Premium user is associated with the device), yet all but a few have the feature enabled without us intervening.

To really make things confusing, If I go to the Microsoft 365 and Office 365 service descriptions page on Microsoft Learn, under "Available Plans" there is a link to "the Microsoft 365 Business Plan comparison table", the PDF that opens clearly shows that Business Premium includes access to Credential Guard:

Does Microsoft 365 Business Premium include Credential Guard or not? If this entitlement is tied to Windows editions, per my first link, then why is it on and active on most of our devices despite none of them meeting the requirements supposedly outlined on this page?

Answer 1

Dear @Alex Rourke,

Thank you for posting your question in the Microsoft Q&A forum. We understand the confusion around Credential Guard and its availability with Microsoft 365 Business Premium. Here’s the official clarification. Yes, Microsoft 365 Business Premium includes Windows Defender Credential Guard as part of its security features. This is confirmed in Microsoft’s official documentation: Credential Guard overview | Microsoft Learn

However, the availability and functionality of Credential Guard depend on the underlying hardware and software configuration of each device. 

To help me narrow down the cause, could you please provide the following details?  

• The specific error codes/messages you're seeing when trying to enable Credential Guard? 
• Any configurations unique to the devices that fail to enable the feature compared to those that do? 
• Confirmation that the devices have Secure Boot and TPM 2.0 enabled? 

In the meantime, please try the following official troubleshooting options which usually resolve issues with basic issues: 
Credential Guard requires specific hardware and OS configurations. Even if your subscription includes the feature, it will not activate unless these requirements are met: 

• Device must run Windows 11 Business or Windows 10 Enterprise 
• Hardware must support Virtualization-Based Security (VBS)
• Secure Boot and TPM must be enabled 

If any requirement is missing, Credential Guard will not enable by default. 

Follow Microsoft’s official guide: Configure Credential Guard | Microsoft Learn 

Here are some steps you can take to troubleshoot the situation: 

1. Check Device Compatibility: Ensure that the devices where Credential Guard doesn't enable actually comply with the necessary requirements. 
2. Review Logs in Detail: Look for patterns or specific error messages in the logs that can provide more insight into why certain devices have issues. 
3. Consult Microsoft Documentation: Review the Microsoft 365 Business Premium security FAQs for detailed insights about requirements and troubleshooting tips. 

Hope this helps clarify things! Let me know if you have any further questions or need more assistance. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.