Windows MDM setup: updates (#26922)

- Updates based on this retired doc:
https://docs.google.com/document/d/1hpvREXZFLsLdOp-_vS4pISJ1sLb6BzEWdbRBCR6xj0k/edit?tab=t.0

articles/windows-mdm-setup.md

@@ -8,7 +8,7 @@ To use automatic enrollment (aka zero-touch) features on Windows, follow instruc
 
 To migrate Windows hosts from your current MDM solution to Fleet, follow the instructions [here](#automatic-windows-mdm-migration). 
 
-## Manual enrollment
+## Turn on Windows MDM
 
 ### Step 1: Generate your certificate and key
 
@@ -22,7 +22,6 @@ How to generate a certificate and key:
 
 > Note: The default `openssl` binary installed on macOS is actually `LibreSSL`, which doesn't support the `--traditional` flag. To successfully generate these files, make sure you're using `OpenSSL` and not `LibreSSL`. You can check what your `openssl` command points to by running `openssl version`.
 
-
 ### Step 2: Configure Fleet with your certificate and key
 
 In your Fleet server configuration, set the contents of the certificate and key in the following environment variables:
@@ -42,7 +41,7 @@ Restart the Fleet server.
 
 3. Select **Turn on**.
 
-### Step 4: Test manual enrollment
+## Manual enrollment
 
 With Windows MDM turned on, enroll a Windows host to Fleet by installing [Fleet's agent (fleetd)](https://fleetdm.com/docs/using-fleet/enroll-hosts).
 
@@ -56,9 +55,7 @@ To automatically enroll Windows workstations when they’re first unboxed and se
 
 After you connect Fleet to Microsoft Entra ID, you can customize the Windows setup experience with [Windows Autopilot](https://learn.microsoft.com/en-us/autopilot/windows-autopilot).
 
-In order to connect Fleet to Microsoft Entra ID, the IT admin (you) needs a Microsoft Enterprise Mobility + Security E3 license. 
-
-Each end user who automatically enrolls needs a [Microsoft license](https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses.)
+In order to connect Fleet to Microsoft Entra ID, the IT admin (you) needs a Microsoft Enterprise Mobility + Security E3 license. Each end user who automatically enrolls needs at least a [Microsoft Entra P1 license](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing). If they already have an [E3 or E5 license](https://www.microsoft.com/en-us/microsoft-365/enterprise/microsoft365-plans-and-pricing) then you're good to go.
 
 ### Step 1: Buy Microsoft licenses