Unattended Excel: RPA licences

A robot receives invoices, opens Excel and saves the result. The company buys Power Automate Process and expects the entire workflow to be licensed. At night, however, Excel enters reduced functionality mode or waits for a dialog nobody can see. Automation licensing, Office licensing and application reliability are three separate questions.

Unattended use of Microsoft 365 desktop applications needs the corresponding unattended Office entitlement. Power Automate Process does not replace it. Obtaining that entitlement also does not turn desktop Excel into a supported universal server service. Start with how the file is actually processed, rather than the service account's name.

This guide concerns desktop Office for Windows. A cloud connector handling workbook data, direct file manipulation and a robot clicking inside an application are different architectures. The XLSX extension alone does not establish identical licensing or operating conditions.

What the solution licenses

Microsoft distinguishes Power Automate user and capacity licences. Premium includes attended RPA for the user. Process can be allocated to a machine for unattended runs; each allocation provides one unattended bot. Hosted Process adds hosted machine capacity.

For a cloud flow operating under Process, check the desktop connection account too. To trigger attended or unattended desktop runs, the documentation requires its user to hold Power Automate Premium or another user entitlement including desktop flows. A purchased bot does not automatically satisfy every prerequisite for the execution identity.

This is our way of breaking down a proposal. An order containing only “robot licence” should explain the covered layers. If the supplier delivers only automation capacity, establish the remaining rights separately.

Microsoft 365 unattended terms also prohibit bots from performing or replicating activities on behalf of an unlicensed user or device. Assessment cannot stop at the technical account. Map use of the target application by people whose tasks the robot performs; do not automatically equate merely receiving an output with the same usage scenario.

Count unattended Office by OSE

Microsoft 365 Apps unattended RPA documentation requires Microsoft 365 Apps for enterprise (unattended) licensing for the account running the task. Office applications for Windows from Version 2009 are supported. One unattended licence allows use in one unique physical or virtual OSE. RPA does not support Shared Computer Activation.

OSE means operating system environment, such as one Windows VM. Invoice count and flow count are not OSE count. One account name also does not mean one entitlement covers every VM where it runs.

Distinguish the capability name in Apps documentation from the product ordered. The current Microsoft 365 Product Terms list Microsoft 365 E3 – Unattended License and its variants. Ordinary user E3 is not the same item. Confirm the SKU, agreement, covered OSEs and permitted robot placement with the supplier.

A hypothetical company uses two Windows VMs for unattended desktop Excel processing. Each invoice is handled by one machine; a queue distributes work between both. The Office design must establish coverage of two OSEs. Adding a third machine for peaks needs another assessment, even with the same account and image.

For two simultaneous unattended desktop runs, also check suitable bot capacity on the machines. Forty documents processed serially on one machine do not create forty concurrent bots. This two-machine design is not a complete licence quote: include flow authors and administrators, the operating system and every automated application.

Activation in the robot's account

Microsoft distinguishes ordinary application launch and declared unattended use. For automated launch, the documentation specifies -unattended. On a dedicated device, it also describes HKEY_CURRENT_USER → Software → Microsoft → Office → Common → Licensing, a DWORD named Unattended set to 1.

This is a user-context setting. Changing it in an administrator's account does not prove that the robot's profile sees it. Include the actual execution account, launch method, application version and successful file creation, editing and saving in the handover record.

Without the required licence, an application used unattended can open and print existing files but cannot create new files or edit and save existing ones. Microsoft's unattended activation overview documents these conditions and configuration paths.

“The robot opened a workbook” is therefore an insufficient pilot. Test the final saved result and its content. Otherwise, success in the first step can be mistaken for entitlement to the whole task.

Hosted Process is not an Office account

The hosted-machine requirements describe Hosted Process capacity in the environment and additional Windows, Intune and Entra ID prerequisites. Flow developers building and managing desktop flows in the portal need Premium user licensing; Hosted Process licenses the machine, not the user.

A Microsoft image or installed Excel does not establish the robot's licence coverage. With a custom image, verify installation, activation mode and the actual execution identity's profile. Assess application rights as carefully as for a Windows VM you operate yourself.

Separate hosting, automation capacity, developer access and unattended Office in the calculation. Otherwise, managed infrastructure can be mistaken for inclusion of every application. Our article Power Automate: Premium, Process and service accounts separately addresses cloud-flow ownership.

Automation rights do not guarantee support

Microsoft explains unattended Office operating limits. Desktop applications were designed for user interaction. Unexpected dialogs, UI changes, identity and concurrency can cause waiting or errors that the solution must handle.

Microsoft also does not recommend or support Office automation from unattended non-interactive components such as a Windows service or server web application. This differs from desktop RPA in a session. Buying an unattended licence therefore does not confirm support for an existing COM script running as a service.

Record two independent answers: which entitlement you have and the environment in which the application actually starts. “We have an unattended licence” does not answer the second question. Moving an old programme from a laptop to a server can change its operating model even when its code stays the same.

A locked session can block the robot

Power Automate creates a remote Windows session for an unattended run. On Windows 10 and 11, it cannot run while an active user session exists, including a locked session. Signing in during unattended execution is unsupported and can interrupt it. These runs also cannot use elevated privileges.

Sign out completely before a night-time pilot. Locking the screen after a manual test is different. If manual processing works but the scheduled run fails before Excel opens, check the session and connection first. Another Office licence cannot repair an unmet Windows-session prerequisite.

Choose how to work with the file

Start with the required result. Do you need to fill a few cells, calculate a complex model, run a particular desktop add-in or simply build a document? Different approaches can make sense for each outcome.

This is a decision aid, not confirmation that the tools are interchangeable. Direct file editing might fail a task requiring a particular desktop add-in. Verify outputs on representative documents before selecting the architecture.

Graph does not automatically mean app-only Excel

“Use Microsoft Graph with a service principal” needs endpoint-level checking. Current documentation for Excel workbook createSession supports delegated work or school account permissions; application permissions are unsupported.

This does not mean every Graph operation has the same authorization model. It means a solution using this endpoint cannot simply switch to client credentials without redesign. The pilot must prove both supported authorization and file processing. A general Graph feature list is not that evidence.

For the same API, distinguish persistent and non-persistent sessions. With a session that does not save changes to the source, a successful calculation does not prove the working document was updated.

Measure the pilot by completed outcomes

We recommend a test set containing a normal file, missing input, a locked file and a document requiring interaction. Include repeated delivery of the same invoice and interruption after output creation. This is an editorial test design, not a guaranteed inventory of all failures.

Separate activation, Windows session, file-access and application-result failures. Each needs a different intervention and owner. Log task ID, machine, account, version, result and timeout; avoid unnecessarily copying invoice content into operating logs.

Recheck OSE coverage and bot capacity before adding VMs. Recheck activation and representative tasks before replacing an image. This produces a design another administrator can operate without relying on the original developer remembering manual settings.