Windows Server CALs: Choose User or Device Licensing
Buying a server license doesn't necessarily cover everyone who connects to it. For many businesses, Windows Server CALs are a separate requirement, and choosing the wrong type means paying for unnecessary licenses or leaving access uncovered.
The choice starts with your access patterns : User CALs suit people who use several devices, while Device CALs suit shared computers.
Before comparing quotes, map who accesses the server and which equipment they use.
Key Takeaways
- A User CAL covers one person accessing covered Windows Server versions from any device.
- A Device CAL covers one device accessing covered Windows Server versions, regardless of who uses it.
- Shared workstations often favor Device CALs, while mobile employees often favor User CALs.
- Remote Desktop Services CALs are separate licenses, so an ordinary Windows Server CAL doesn't cover an RDS deployment by itself.
What Windows Server CALs Actually Cover
A Client Access License, or CAL, provides access rights to Windows Server software on your licensed servers. It doesn't license the server itself or replace a Windows desktop operating-system license.
In a typical Windows Server Standard or Datacenter deployment, businesses must address both server licensing and client access licensing. Buying the server software alone doesn't settle the access requirement.
File sharing, authentication, and server-based business applications are common reasons employees access Windows Server. However, the applicable licensing terms determine the requirements for your deployment.
An appropriately assigned CAL can cover access to multiple properly licensed Windows Servers within its version rights. You generally don't buy another Windows Server CAL for the same covered user simply because you add another covered server.
Also, licensing and permissions are separate . A licensed employee still needs appropriate account permissions. Someone who needs shared proposals shouldn't automatically receive access to payroll folders or administrator controls.
User CALs vs. Device CALs: Follow the Access Pattern
Both models license access, but they attach that entitlement to different things. Your work arrangements matter more than job titles.
User CALs fit employees who change devices
A Windows Server User CAL covers one assigned user accessing covered server versions from any device.
That makes it a practical fit for employees who connect through an office desktop, a company laptop, and another approved device. The person remains the licensed unit even when their equipment changes.
For sales teams, traveling managers, and hybrid office staff, this can simplify tracking. IT maintains the user's assignment rather than licensing every device that person uses.
However, "any device" describes licensing rights, not a security policy. Your business can still restrict server access to managed, encrypted, and updated equipment.
Device CALs fit shared workstations
A Windows Server Device CAL covers one assigned device, regardless of how many people use it.
This often fits reception computers, warehouse terminals, and workstations shared across shifts. When employees use the same licensed terminal, the access entitlement follows that device.
Each employee should still have a unique account. A Device CAL doesn't require shared passwords or remove the need for role-based permissions.
Also, check access beyond the shared workstation. If those employees connect through other devices, the terminal's Device CAL doesn't automatically cover those additional access paths.
Which CAL Type Is More Cost-Effective?
The cheaper option depends on license quantities and the prices available through your purchasing agreement. User and Device CALs aren't guaranteed to have identical prices.
These access patterns provide a useful starting point:
| Access pattern | Model to evaluate first | Reason |
|---|---|---|
| One employee uses several devices | User CAL | One user assignment covers that person's devices |
| Several employees share one terminal | Device CAL | One device assignment covers its users |
| Each employee uses one dedicated computer | Compare both | Required quantities may be similar |
| Office staff and shift workers have different setups | Mixed licensing | Each group can use an appropriate model |
The table identifies likely fits. Your inventory and supplier quote determine the actual cost.
Compare quantities before comparing prices
Calculate the required User CAL quantity and multiply it by the quoted unit price. Then calculate the required Device CAL quantity using its quoted price.
The comparison should use the same Windows Server version and comparable purchasing terms. Otherwise, a lower quote may reflect different rights or coverage.
When each employee uses multiple devices, User CALs can reduce the number of licenses needed. When many employees share fewer terminals, Device CALs can reduce that number instead.
Include the cost of keeping assignments accurate
A mixed environment can use User CALs and Device CALs, provided every required access path has coverage.
For example, mobile staff can have User CALs while shared terminals have Device CALs. However, document the assignments carefully so you don't purchase duplicate coverage unnecessarily.
Also consider administration. A small price difference may offer little value if your team can't reliably track device replacements, staff changes, and additional access.
Count Access, Not Simultaneous Connections
Windows Server CALs aren't concurrent-use licenses. The number of people signed in at one moment doesn't determine the required quantity.
With User CALs, count the users who require covered access. With Device CALs, count the devices that require covered access. Employees on different shifts still need coverage, even when their sessions never overlap.
Don't assume that placing an application, gateway, or shared account between employees and the server removes licensing obligations. Indirect access and multiplexing require review under the applicable Microsoft terms.
Likewise, a list of Active Directory accounts isn't a complete licensing inventory. It may contain disabled accounts, administrative identities, or service accounts, while missing other access paths.
Review who uses the system and how they connect. Treat printers, automated applications, contractors, and other less obvious connections as items to verify, rather than assuming they're exempt.
Windows Server CALs and RDS CALs Are Different
Remote Desktop Services adds another licensing layer. Employees who use an RDS session host for hosted desktops or RemoteApps need the applicable RDS licensing alongside Windows Server access licensing.
Microsoft's RDS CAL guidance, updated October 2, 2026, describes separate Per User and Per Device models.
Ordinary server access doesn't include an RDS entitlement
Accessing a shared folder and running a desktop through an RDS session host are different licensing scenarios.
A standard Windows Server CAL covers the applicable server access rights. It doesn't become an RDS CAL because the employee works remotely.
Likewise, purchasing an RDS CAL doesn't replace the underlying Windows Server access requirement. Keep these as separate lines in your licensing review and purchasing records.
Review administrative remote connections separately with your licensing partner. Don't treat a technical connection limit as proof of licensing coverage.
Choose the RDS model around actual use
The same access-pattern questions help with RDS. Per User licensing suits people who connect through several devices; Per Device licensing suits shared terminals.
However, RDS also requires the correct licensing configuration. IT should check the deployment's licensing mode, license server, and CAL compatibility.
A working remote desktop session doesn't prove that all required licenses are in place.
Licensing also doesn't replace remote-access security. Use approved access methods, appropriate MFA controls, and timely patching. Test login, printing, and application access after changes.
Check CAL Versions and Your Agreement
Windows Server CALs have version rights. A CAL covers its corresponding server version and earlier versions, not later releases.
For example, a Windows Server 2025 CAL covers Windows Server 2025 and earlier versions. An older CAL doesn't automatically provide Windows Server 2025 access rights.
Microsoft's Windows Server Product Terms establish the licensing framework. The terms effective January 1, 2026, support these distinctions; confirm the terms applicable to your agreement and purchase date.
Licensing rights can vary by product, purchase channel, agreement, and subscription benefits. Don't assume a Microsoft 365 subscription automatically settles Windows Server or RDS access licensing.
For external-user access, Microsoft lists CALs and External Connectors as options. Eligibility and coverage need an agreement-specific review, so don't treat an External Connector as a blanket solution.
This is practical licensing guidance, not legal advice.
Build a Licensing Inventory Before Ordering
Start with the same people, device, and application records your business uses for onboarding. SJC Technology's small business managed IT checklist provides a useful foundation for documenting that environment.
Then work through the access requirements:
- Record each Windows Server's version, edition, location, and business purpose.
- Identify the employees, contractors, and devices that access those servers, including remote connections.
- Separate ordinary server access from RDS desktops and RemoteApps.
- Match existing CAL purchases and assignments to the required access, then ask your licensing partner to verify gaps.
Keep purchase evidence, assigned users or devices, and review dates together. Give one person responsibility for maintaining those records and another authority to approve purchases.
If you're considering secure virtual server hosting, ask the provider which licensing model applies and what's included. Moving a server off-site doesn't by itself settle the access requirements.
Finally, review coverage during hiring, departures, device replacement, and server upgrades. Don't assume a license can be reassigned immediately whenever staffing or equipment changes.
Frequently Asked Questions
Can User CALs and Device CALs coexist?
Yes. A business can combine them to cover different access patterns. For example, user-based coverage can suit mobile employees while device-based coverage suits shared terminals. Document assignments and verify that every required connection has coverage.
Does connecting through a VPN change the CAL requirement?
A VPN changes the connection path and security controls. It doesn't automatically remove Windows Server access licensing requirements. Review the underlying user or device access, then check whether RDS or other server applications require additional licensing.
Should shared computers use shared employee accounts?
No. Employees should normally have individual accounts even when the computer has a Device CAL. Unique identities make permissions, access reviews, and activity records easier to manage. Keep administrator credentials separate from routine work, and remove access promptly when someone leaves.
Choose CALs Around How Your Team Works
The right choice follows documented access . User CALs generally fit people with several devices; Device CALs generally fit equipment shared by several people.
Compare quantities and actual quotes, then verify version rights and any separate RDS requirements.
A clear inventory gives your business a defensible purchasing decision and makes future staff, device, and server changes easier to handle.