Microsoft hopes iPad users won't exploit Office loophole

Microsoft wants you to buy Office 365, making the $100 subscription service mandatory to access the full power of Office apps for iPad. But if you don't want to pay the price, you don't technically have to.

After tinkering with numerous devices and accounts since the debut of Office on iPad Thursday, CNET discovered a loophole in how Office 365 authentication gets enforced on Apple tablets. The loophole allows users who have not paid for the subscription to enjoy the benefits of those tablet apps for iOS.

"Similar to our commercial use rights, we do not strictly enforce the limit on tablet installations, but trust that our users respect and understand the device limits outlined in the EULA [end user rights agreement]," a Microsoft spokesperson told CNET.

Subscriptions now form the backbone of Microsoft's software licensing, and the company has made an aggressive push to make it as convenient as possible to access its Office app suite through an Office 365 subscription. It wants to turn one-time customers into annual ones, and users are signing up. Within hours of going live on Thursday, the apps grabbed the top four slots in the free category of Apple's top charts.

Sweetening the deal, Microsoft gives you -- for less than the price to buy the software outright for only one computer -- the ability to install Office on five Macs or PCs and up to five tablets.

However, there's nothing to stop you from trying a sixth tablet, or a seventh or an eighth -- or beyond. For now, there is no set limitation.

How it works

Similar to sharing around an HBO Go password among friends, all that's required to exploit the loophole -- which, again, is against the rights agreement that limits you to authenticating only five tablets -- is to have someone with a valid Office 365 account log in to Word, Excel or any other Office app on iPad. Once that happens, the tablet is automatically authenticated for all Office apps and any future users, regardless of whether or not those users have paid for 365.

In other words, someone with a Microsoft account that was, just minutes prior, unable to access the best features of an iPad Office app will then be able to utilize the full version -- as well as other downloaded Office apps -- seemingly indefinitely. The prompt to pay for 365 or resort to using the "read-only" mode disappears.

Not only will you then be treated like a paying 365 customer -- meaning you'll be automatically signed in to full versions of all the other Office apps once you sign into your first -- but all files will sync to the Office Mobile iPhone app and vice versa.

It wouldn't be exactly practical to find reason to install Office on more than five iPads, and the fact that any 365 user gets 10 total installs makes the service highly economical from a customer standpoint.

But in the worst-case scenario, someone can share their Microsoft Account details with a large number of friends, or perhaps post them somewhere online, and authentication for Office iPad apps can be distributed limitlessly.

Microsoft confirmed that it does indeed track how many versions of Office for iPad a single account has authenticated. What action Microsoft would take if, say, a 100 people were piggybacking on a single 365 subscription is unclear, but the five-tablet limit is explicitly laid out in the user agreement very high up.

It's also currently unclear what would happen if the original person whose Office 365 account was used to authenticate a tablet did not renew the subscription, though it would appear as if that would disable all others because the account is still monitoring how many activations there are. It's also unclear what may happen in future updates to the apps, or in the case of deleting Office apps or resetting one's device.

That Microsoft is putting its trust in paying customers is either due to what may be a technical oversight or the fact that it's not worth the trouble, yet. Depending on how this workaround is utilized, Microsoft may need to examine methods to forcible keep users from disseminating Office authorization to iPads far and wide.