Do NOT get involved regardless of what others say unless this *friend* agrees to go 100% legit right immediately and you get that in writing!
Do NOT inventory his systems to see what he has that needs to be legit (you loose plausible deniability) because that alone gets you involved in that you must legally A) Risk your business or B) Report him...
It is totally, unacceptable to slowly, over-time buy licences and become legit... If he has 10 illegal copies of Windows and buys 2 legal copies, you ARE still guilty of supporting 8 illegal copies.
DO NOT DRAFT A BECOME LEGIT OVERTIME AGREEMENT with your friend. It is NOT your software he is stealing, so you cannot contract with him to delay becoming legit only Microsoft can contract this way with him.!
Linux will NOT work in most office environments... Not a bad suggestion, but it won't likely satisfy your friend, so don't even go there unless he is simply running web kiosks in his business and all he needs is something to boot a web browser. This might work for a warehouse that runs a web app with a USB bar-code scanner or something, but it will not work when they have their core business apps (Windows Apps) they need to run... Yes, I know about WINE etc., but even if it works he won't be satisfied.
There is no such thing as plausible deniability at this point anyway because you know, your friend knows, your friend knows you know, you told us, we know, we know you know, we know your friend knows, we know your friend knows you know ...
Personally, I do not turn people into the BSA, Microsoft, or anyone else, but I do NOT get involved.
Legally, you are generally not required to report most *misdemeanor level* crimes, but get involved and you become guilty, too i.e. See someone painting graffiti on a wall, you really probably cannot be charged with not calling the police..., but when you start mixing his paint, creating stencils, and cleaning his brushes, you become a guilty accessory!