windows not activated in azure

Hello @Paul Aranda

Thanks for sharing the details this is actually a well-known issue that's been reported by several customers, and it's good news in the sense that there's a clear fix path.

The error you're seeing means your VM is unable to communicate properly with the Azure Instance Metadata Service (IMDS) to validate it's running on Azure infrastructure, OR the required intermediate certificates for attestation are missing/expired. Even if KMS shows activation as successful via slmgr.vbs, the pop-up can still persist due to this separate attestation check.

Step 1 — Verify IMDS connectivity Run this in an elevated PowerShell session on the VM:

If this returns VM metadata (azEnvironment, location, etc.), IMDS is reachable. If it fails or times out, the wire IP 169.254.169.254 is being blocked — likely by a proxy or custom UDR. You'll need to ensure that IP is not routed through a proxy.

Step 2 — Check for missing/expired certificates

Run the certificate chain validation script from the official troubleshooting doc (link below). If $chain.Build($cert) returns False, your VM is missing the intermediate CA certificates required for Azure attestation.

To fix this, you can:

• Install the latest Windows updates (KB5031364 or later for WS2022), which bundle the required certs.
• Or manually download and install the root/intermediate certificates from the Microsoft PKI repository.

Make sure your firewall/proxy isn't blocking certificate downloads from crt.microsoft.com and ocsp.msocsp.com.

Step 3 — If running behind a proxy Add a route exclusion so that traffic to 169.254.169.254 bypasses your proxy entirely. This address is a non-routable link-local IP and should never be proxied.

Links :
Windows activation watermark continues to be displayed
https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/activation-watermark-appears

Troubleshooting tools for Windows activation issues on Azure virtual machines
https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/windows-activation-troubleshoot-tools

IMDS Attested Data TLS changes (certificate context): https://techcommunity.microsoft.com/blog/azuregovernanceandmanagementblog/azure-instance-metadata-service-attested-data-tls-2025-critical-changes/2888953

Azure Instance Metadata Service https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service?tabs=windows

Thanks,
Manish.

Hi Manish i tried the the troubleshooting above. the watermark will disappear for a while then will appear again. Can you escalate this to an engineer and create a support ticket? We are paying a monthly fee for a technical support but I can't even create a support ticket, rather i get this forum support which is not ideal.

Hi @Paul Aranda ,

Thanks for the update — and I completely understand your frustration. The fact that the watermark disappears temporarily but keeps coming back after a restart is actually a very specific and known pattern, and it points us in a clear direction.

What's happening here is that a scheduled task called LicenseImdsIntegration runs fclip.exe automatically each time you log in or restart. It re-validates the IMDS attestation certificate chain, and if that validation fails, the watermark comes straight back. Running fclip.exe manually only clears the symptom for that session — it doesn't fix the root cause.

1.Install KB5036909 (most likely the permanent fix)

This is the April 2024 cumulative update specifically designed to resolve this issue on Windows Server 2022. If it's not installed, nothing else will hold.

Check if it's already there:

Get-HotFix -Id KB5036909

If it's missing, grab it from the Microsoft Update Catalog:

https://www.catalog.update.microsoft.com/Search.aspx?q=KB5036909

After installing, restart the VM and check if the watermark comes back.

2.Fix the FClip scheduled task context (if watermark still reappears)

This is a commonly missed step. The LicenseImdsIntegration task needs to run as SYSTEM — if it's running under a regular user account, it may not have the right permissions to validate the certificate chain properly. Run this in an elevated PowerShell:

Schtasks /change /TN "\Microsoft\Windows\Clip\LicenseImdsIntegration" /RU "NT Authority\System"

Then trigger it manually and verify:

Schtasks /Run /TN "\Microsoft\Windows\Clip\LicenseImdsIntegration"

3. Run the official IMDS Cert Check tool

Microsoft released a dedicated Run Command script for exactly this scenario. You can run it directly from the Azure portal without needing to RDP in:

1. Go to your VM in the Azure Portal
2. Navigate to Operations > Run Command
3. Select the IMDSCertCheck script from the list

This will tell you definitively whether the certificate chain is intact or if specific intermediate CAs are missing.

Docs: https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/windows-vm-imds-tool

4.Ensure certificate download URLs are not blocked

Even if IMDS itself is reachable, the certificate chain validation requires outbound access to Microsoft's CRL and certificate distribution endpoints. Make sure your NSG, firewall, or proxy isn't blocking:

• crt.microsoft.com
• ocsp.msocsp.com
• www.microsoft.com/pkiops/

Full list here: https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-ca-details#certificate-downloads-and-revocation-lists

5.Manually install the missing intermediate certificates (if all else fails)

Run this PowerShell to identify which cert in the chain is missing:

$attestedDoc = Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri http://169.254.169.254/metadata/attested/document?api-version=2018-10-01
$signature = [System.Convert]::FromBase64String($attestedDoc.signature)
$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]($signature)
$chain = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Chain
if (-not $chain.Build($cert)) { Write-Host "Missing: $($cert.Issuer)" -ForegroundColor Red }

Then download and install the identified certificate from:

https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-certificate-authority-details?tabs=certificate-authority-chains

Make sure to install to Local Machine store, not Current User.

If the issue still persists please reply back with your available time to connect with you over the teams.