Migrating from per-device to per-user licensing

For end-users, activating their copies of Parallels Desktop for Mac Enterprise Edition is much easier by signing in with their usual set of corporate login credentials. If your organization already runs an identity provider service (e.g., Microsoft Entra ID, Okta, or Ping Identity), you can benefit from the Single Sign-On (SSO) activation method by setting up the integration. This method has the added benefit of automatically disabling the licenses of employees leaving your organization, freeing up their quota.

Note: For new customers or those who previously did not use SSO activation, only Parallels Desktop for Mac Enterprise Edition supports this method. For the sake of flexibility, Enterprise Edition supports mixed licensing, with per-device (license key) and per-user (SSO) activations in the same setup.

This chapter represents a migration plan that will not affect your existing per-device (license key) activations while you continue to run them in parallel with the new per-user (SSO) test group.

If your current Parallels Desktop for Mac deployment uses the license key activation method but you would like to switch to SSO, follow these steps:

Step 1: Setup

At this stage, your goal is to set up the integration between Parallels and your identity provider (IdP) and validate that it works for your test group. Once this goal is achieved, you can make the SSO activation method default for all new users of Parallels Desktop for Mac in your organization.

Start the integration process on this page of Parallels My Account and follow the instructions from this chapter.

Warning: Once you have completed the integration process and activated the SSO functionality, only users from the Administrators group in your IdP signing in via SSO will retain access to managing the Parallels business account. All previous administrative privileges based on logins and passwords will become inactive.

Your designated backup login will continue to work.

Throughout this process, your new SSO setup will not affect your existing users of Parallels Desktop for Mac.

Step 2: Testing and Enabling for New Users

Download a copy of Parallels Desktop for Mac on a computer that doesn't have it and attempt to activate it using the SSO method. Make sure to allow Parallels Desktop access to the Downloads folder.

Alternatively, choose an existing non-critical Parallels Desktop seat, deactivate it using the following Terminal command:

prlsrvctl deactivate-license,

restart Parallels Desktop, and try to activate again using SSO. Expand the test to a small group of users.

Once everything is successfully tested, you can either:

• Update your company's documentation to instruct all new users to activate via SSO only or

• If you have a Mac management tool, deploy a configuration profile to all new Macs that forces the SSO login window to pop up at the app launch until it has been activated.

Step 3: Migration

Once you have successfully completed the previous steps, it's time to expand the SSO activation to your organization's wider Parallels Desktop user base. Start by proactively notifying them of the upcoming switch to per-user (SSO) activation. Your email may also suggest the following steps:

1. Making sure their copies of Parallels Desktop have been updated to version 20.1.0 or newer;

2. Opening the Parallels Desktop Control Center and using the Parallels Desktop drop-down menu in the macOS menu bar to open the Account & License... window;

3. Using the Continue with SSO option in that window (bottom left corner).

However, there will always be users who routinely ignore such emails. If you have a Mac management tool at your disposal, you could force selected users to re-activate with SSO by following these steps:

1. Update all Parallels Desktop for Mac seats to version 20.1.0 or newer;

2. Execute the following commands:

prlsrvctl deactivate-license

sudo -u $(stat -f%Su /dev/console) defaults write "com.parallels.Parallels Desktop" ActivationExperience -string "sso"

sudo -u $(stat -f%Su /dev/console) defaults write "com.parallels.Parallels Desktop" "isSSOExperienceForced" -bool FALSE

Step 4: Monitoring Progress

You can monitor per-user (SSO) activations using the following path in Parallels My Account: click on the Business Profile link in the top-right corner. On that page, click on the Users (N) link, also in the top-right corner. From the first drop-down menu, select the Users: With product licenses option. The resulting list will contain all the Parallels Desktop users who have activated their copies using SSO.

Continue to monitor the user count on this page for the next few weeks to ensure progress.