Personally, I would gladly activate friends and family using mass grave.

Professionally, while I have never seen an audit in decades, I would not bypass Microsoft activation in a professional setting. It’s the company’s hardware, and if they insist on using it they will need to pony up for a licence. I’m not liable for the device if I advise it is not able to be updated and they insist on using it. I will be liable if I use the activation script.