RDS CAL Licensing on Windows Server: Per-User vs Per-Device, BYOL vs SPLA

In short

Default Windows Server lets exactly 2 administrators connect via RDP simultaneously — no licence needed. For anything beyond that (real multi-user RDP for a team), you must run the Remote Desktop Session Host role, which requires an RDS Client Access Licence (CAL) for each user or device. Two licence flavours exist: per-user (assigned to AD users, can connect from any device) and per-device (assigned to shared machines, good for shift work). Microsoft gives you a 120-day grace period before the licensing rules become enforceable. Source the licences via BYOL (your existing volume licence with License Mobility) or via SPLA through Raff.

TL;DR

• 2 concurrent admin RDP sessions are free; multi-user RDP needs the RDS role + CALs.
• Per-user CAL = assigned in AD, follows the user. Per-device CAL = assigned to a machine, follows the seat.
• 120-day grace period before enforcement starts. After that, sessions get rejected — not just flagged.
• RDS CALs for newer Server versions work on older session hosts. The reverse is never allowed — buying 2025 CALs future-proofs your deployment.
• BYOL needs Software Assurance + License Mobility. Otherwise activate via Raff's SPLA programme — pay-as-you-grow.

What is an RDS CAL?

Every user or device that connects to a Windows Server running the Remote Desktop Session Host role needs a Remote Desktop Services (RDS) Client Access Licence. This is separate from the base Windows Server CAL (which covers general server access like file and print); RDS CALs specifically cover the right to run a Remote Desktop session.

The lifecycle of a connection:

1. A user (or device) opens an RDP client and connects to your Windows Server.
2. The session host checks whether this is an admin session. Sessions 1 and 2 are admin and don't require a CAL.
3. Beyond session 2, or when the RDS Session Host role is installed, the session host asks the Remote Desktop Licensing server for a CAL.
4. If one is available, it's issued and the user connects.
5. If no CAL is available AND you're past the 120-day grace period, the connection is refused with a licensing error.

The licence server is a separate role you install on a Windows Server. On small deployments it commonly lives on the same VM as the session host. It tracks issued CALs, handles renewals, and surfaces usage reports.

Per-user vs per-device — decision matrix

Pick per-user if:

• Each member of your team has their own laptop or desktop and signs in from one AD identity.
• You're running an Active Directory domain.
• You want flexibility to add or remove users without tying licences to hardware.
• Typical scenarios: accounting firm with 8 bookkeepers, dev team of 12 with personal laptops, agency with remote staff.
• You're using RD Web Access. Microsoft specifically recommends per-user here, because per-device CALs get consumed by any device that visits the web portal — which drains licences fast.

Pick per-device if:

• You run shifts (call centre, factory floor, retail) where 2-3 workers share the same PC.
• You don't have an AD domain (workgroup deployment — per-user simply won't work here).
• You need strict enforcement and over-allocation prevention.
• Typical scenarios: 6 shared kiosk PCs serving 15 nurses on rotating shifts, 4 shared workstations for a team of 10 contractors.

Common workgroup mistake: buying per-user CALs for a workgroup deployment. Per-user tracking requires Active Directory. Without it, users get disconnected after 60 minutes every time. The only supported fix is to buy new per-device CALs (there's a Convert-License PowerShell cmdlet that can migrate the pack, but check with your reseller — volume-licence-agreement terms may prevent conversion).

RDS CAL version compatibility

The rule: CALs work for the same or older Windows Server, never newer.

Practical takeaway: if you're deploying Server 2025, you need 2025 CALs. If you have spare 2022 CALs from an old project, they won't work with a 2025 session host — Microsoft doesn't allow "downgrade" of CALs to a newer host.

The licence server itself follows the same rule — it must run a Windows Server version equal to or newer than the CALs it issues. A 2022 licence server cannot install 2025 CALs; a 2025 licence server can install any 2025, 2022, 2019, or 2016 CALs.

The 120-day grace period

Microsoft gives you 120 days of full RDS Session Host functionality without a licence server, starting from when you install the role. During this window you can deploy, test, and roll out access while you arrange CALs.

After 120 days, RDP connections beyond the 2 admin sessions get rejected with a licensing error. There's no soft-warning mode — it just stops working.

Plan your CAL purchase to land at least 2 weeks before the grace period ends. SPLA activation through Raff is quick (typically 1-2 business days). BYOL via volume licensing can take longer if you're applying for License Mobility for the first time.

Sourcing CALs: BYOL vs SPLA

Two legitimate ways to license RDS CALs on a Raff Windows Server.

BYOL (Bring Your Own Licence)

Use this if you already own RDS CALs through Microsoft volume licensing and you have Software Assurance with License Mobility rights.

• Buy CALs once, use for the life of the agreement (subject to upgrade rights and SA).
• Cost-effective if you'll run the workload for 18+ months.
• Requires: original purchase records, a License Mobility verification form submitted to Microsoft, and customer attestation.
• Raff helps with the License Mobility paperwork during onboarding.

SPLA (through Raff)

Pay monthly per CAL while you use them. No upfront purchase, no License Mobility paperwork.

• Month-to-month — scale up or down as your team changes.
• Includes the right to use the CAL on the version of Windows Server you're running.
• No long-term commitment, no purchase paperwork.
• Activation through Raff during onboarding.

SPLA RDS CAL pricing is negotiated between Microsoft and authorised resellers and isn't published publicly. Talk to Raff during onboarding for your specific rate based on user count and term.

Per Microsoft's SPLA pricing updates, Windows Server and SQL Server SPLA list prices held flat on January 1, 2026 (with foreign-exchange adjustments in non-USD markets). Only Exchange, SharePoint, Skype for Business, and legacy Dynamics SPLA rates increased ~10% for 2026. RDS SAL rates follow the same annual SPLA cycle; confirm specifics with your reseller.

The October 2025 Listed Provider rule change

Effective October 1, 2025, Microsoft no longer permits service providers to use their own SPLA licences on "Listed Provider" infrastructure — AWS, Azure, Google Cloud, and Alibaba Cloud.

This rule doesn't apply to Raff. Raff operates its own infrastructure at our Vint Hill datacentre, not on a Listed Provider. Customers using Raff's SPLA programme are fully compliant.

If you're considering moving from AWS, Azure, or another hyperscaler to Raff specifically because of RDS licensing, the rule change actually strengthens the case: Raff can legally bundle SPLA CALs into a monthly service fee on our own infrastructure, while hyperscaler-hosted MSPs cannot.

Decision shortcut

Install and activate the RD Licensing role

The detailed installation procedure is documented in Microsoft Learn — Deploy your Remote Desktop environment. High-level: install the RDS-Licensing role, activate the licence server through RD Licensing Manager (licmgr.exe), install your CAL pack, and point session hosts at the licence server. A Raff-specific tutorial with screenshots tested on Server 2025 will be published separately (linked from What's next when available).

Common mistakes

1. Mixing per-user and per-device CALs in one deployment. Technically allowed but creates an accounting nightmare. Pick one mode and stick with it. If you inherited a mixed pack, use Convert-License to consolidate — but check with your reseller first.
2. Forgetting the licence server FQDN. Session hosts need to resolve and reach the licence server. If the host can't reach the licence server's FQDN, no CALs get issued and connections fail after the 120-day grace period.
3. Using a 2022 licence server with 2025 CALs. Won't work. Upgrade the licence server to match your highest CAL version — the install wizard simply won't show 2025 CAL packs on a 2022 licence server.
4. Buying per-user CALs for a workgroup deployment. Operational failure, not just a compliance issue. Users get disconnected every 60 minutes. You'll end up buying per-device CALs anyway.
5. Treating per-user as enforceable. Microsoft doesn't technically block over-allocated per-user CALs at runtime. You'll get a free pass during a session but fail an audit. Track real usage in RD Licensing Manager → Reports.
6. Assuming SPLA works on AWS or Azure. As of October 1, 2025, using SPLA on a Listed Provider is non-compliant — this is why some customers are moving RDS workloads off hyperscalers. Doesn't affect Raff customers.

What we recommend at Raff

For most Raff Windows Server customers running multi-user RDP for an office team:

• Start with SPLA via Raff — predictable monthly cost, fast activation, no upfront paperwork.
• Switch to BYOL if you cross the 18-24 month mark with stable headcount and you can justify the Software Assurance cost.
• Always per-user CALs unless you're literally running shifts on shared hardware or deploying in a workgroup.
• Buy CALs for the latest Server version (2025 today) — they work on older session hosts too, future-proofing at no extra cost.
• Run the licence server on the same VM as your RDS Session Host for small deployments (fewer than 25 CALs) — saves a server, simpler maintenance.
• Set a calendar reminder for month 3 of the grace period so you're not caught at day 119 without activated CALs.

If you're not sure which model fits, talk to the Raff team during onboarding — we'll size the CAL pack to your team and handle the SPLA activation or License Mobility paperwork.

FAQ

Do I need an RDS CAL for the 2 admin sessions?

No. Windows Server allows exactly 2 concurrent administrative RDP connections (sometimes called "Remote Desktop for Administration") with no CAL required. This is built into the OS. The moment you install the Remote Desktop Session Host role to support more concurrent users, CAL requirements kick in.

How does the 120-day grace period work?

It starts the day you install the RDS Session Host role. During the 120 days, sessions work normally without a licence server. After day 120, connections beyond the 2 admin sessions get rejected with a licensing error like "The remote session was disconnected because there are no Remote Desktop License Servers available to provide a license." Fix it by activating a licence server with valid CALs.

Can I move my CALs to a different Windows Server?

For BYOL with Software Assurance + License Mobility: yes, between servers in your tenant, with appropriate paperwork. For SPLA: CALs are tied to the service provider (Raff in this case) and the specific deployment scope — talk to Raff support before changing infrastructure.

Are RDS CAL prices going up in 2026?

Per Microsoft's SPLA announcements, Windows Server and SQL Server SPLA list prices stayed flat on January 1, 2026. Exchange, SharePoint, Skype for Business, and legacy Dynamics SPLA rates went up ~10%. RDS SAL pricing follows the same SPLA cycle and isn't publicly listed — check with your reseller for specifics.

What happens if I run Microsoft 365 Apps on the RDS host?

You also need Microsoft 365 Apps for Enterprise licensing with Shared Computer Activation enabled. RDS CALs cover the Windows Server access right; M365 has its own per-user licensing on top.

Does the October 2025 Listed Provider rule affect me on Raff?

No. The rule restricts service providers from using SPLA licences on AWS, Azure, Google Cloud, and Alibaba Cloud. Raff operates its own infrastructure at our Vint Hill datacentre, so our SPLA programme is fully compliant.

Compatible with Raff

Compatible with Raff: RDS CALs (per-user and per-device) are known to work on Raff Windows Server deployments running Windows Server 2025, 2022, and 2019. Raff's SPLA programme covers RDS SAL activation. A Raff-specific step-by-step installation tutorial with first-hand screenshots is planned — this article covers the licensing decision, not the install procedure.

What's next

• Connect to a Windows Server via RDP — the 2-admin-session scenario before you add CALs
• Windows Server 2019 vs 2022 vs 2025: Which Version to Choose in 2026 — pick the right host version before sizing CALs
• Microsoft Learn — License Remote Desktop Services with CALs — the canonical CAL reference
• Microsoft Learn — Deploy your Remote Desktop environment — step-by-step install guide

Sources

• Microsoft Learn — License Remote Desktop Services with Client Access Licenses (CALs)
• Microsoft Learn — Deploy your Remote Desktop environment
• Microsoft Learn — Best practices for RD licensing across AD domains/forests/workgroups
• Microsoft Licensing — Software Assurance + License Mobility
• Microsoft SPLA Guidance — Services Provider Licensing Agreement program guidance
• Date last verified: 2026-04-20