Windows Server CALs Explained: User vs Device and When RDS CALs Are Separate

In short

A Windows Server Client Access License (CAL) gives a user or device the right to access Windows Server software under Microsoft's customer licensing model. For Windows Server 2025 Standard and Datacenter, internal users or devices generally need a qualifying Windows Server CAL unless a documented exception or CAL-equivalent right applies.

Choose a User CAL when one person accesses Windows Server from several devices. Choose a Device CAL when several people share a smaller number of devices. An RDS CAL is separate and additive when Remote Desktop Services functionality is used in a customer-owned deployment.

Raff-hosted Windows under SPLA follows the service-provider licensing model instead of ordinary customer Windows Server CAL purchasing. Hosted RDS is licensed separately with RDS User SALs. For the broader licensing model, see Windows Server Licensing on Raff.

Microsoft licensing is contract-based. Current Product Terms and the customer's executed Microsoft agreement control if they differ from this guide.

What is a Windows Server CAL?

A Windows Server CAL is an access license. It is not the Windows Server operating-system license itself.

Microsoft's Windows Server licensing model separates two layers:

1. Server licensing licenses the Windows Server software, normally through core-based licensing.
2. Access licensing licenses users or devices that access that Windows Server software.

For the conventional customer model, the normal base access license is a Windows Server CAL. Microsoft classifies Windows Server CALs as base CALs. Capabilities such as Remote Desktop Services use additive access licenses on top of the base right where applicable.

Windows Server User CAL vs Device CAL

The two CAL types grant access in different ways.

A User CAL follows the licensed user across their devices. A Device CAL follows the licensed device regardless of which permitted user is operating it.

Choose User CALs when

User CALs usually fit when employees have individual accounts, one person uses several devices, staff work from office and home, or the number of users is lower than the number of devices they use.

10 employees
Each uses an office desktop, laptop, and home computer
→ evaluate 10 User CALs

Choose Device CALs when

Device CALs usually fit when several people share fixed workstations, the business operates shifts, or the number of accessing devices is lower than the number of users.

24 shift workers
6 shared warehouse terminals
→ evaluate 6 Device CALs

Can you mix User and Device CALs?

Yes. Microsoft allows a combination of User and Device CALs when the assignments match the real access model.

For example, office employees can use User CALs while a shared reception or warehouse terminal uses a Device CAL. The assignments still need to be documented. CALs are not a floating pool that can be reassigned informally whenever user counts change.

User CAL vs Device CAL decision table

Do not treat either model as concurrent-session licensing. Five User CALs do not mean any five users may connect at the same time. Each User CAL is assigned to a specific user; each Device CAL is assigned to a specific device.

When are Windows Server CALs required?

Under Microsoft's conventional customer licensing model, Windows Server CAL planning applies when users or devices access licensed Windows Server software unless a specific exception or equivalent access right applies.

Common examples include access to:

• Active Directory services;
• Windows file shares;
• print services;
• line-of-business applications running on Windows Server;
• internal application services;
• Windows Server functionality reached indirectly through middleware or another application layer.

A user does not have to see a Windows desktop for CAL requirements to matter. Licensing evaluates access to the server software, not only interactive logon.

CALs are not the same as server licenses

Buying Windows Server Standard or Datacenter does not by itself grant unlimited employee access.

Changing from Standard to Datacenter does not remove the ordinary Windows Server CAL requirement under the conventional customer model. For edition differences, see Windows Server Standard vs Datacenter.

Windows Server CAL vs RDS CAL

A Windows Server CAL is the base access license. An RDS CAL is an additive license for Remote Desktop Services functionality.

For a conventional customer-owned RDS deployment, the licensing stack can therefore be:

Windows Server license
+
Windows Server CAL
+
RDS CAL

The RDS CAL does not replace the Windows Server CAL when the base CAL requirement applies.

Example: employees use an RD Session Host

If 12 employees use a Windows Server RD Session Host for shared desktop or RemoteApp access, the customer licensing analysis normally includes the Windows Server license, applicable Windows Server CALs, and applicable RDS CALs.

For Per User vs Per Device mode, version compatibility, the RDS licensing server, grace period, and hosted SAL model, use the RDS CAL Licensing Guide.

Administrative RDP is different from employee RDS use

Windows Server includes limited Remote Desktop rights for administration. Those administrative connections are not a substitute for a licensed multi-user employee desktop environment.

Administrators maintaining the server
→ administrative Remote Desktop rights

Employees using shared desktops or RemoteApp for daily work
→ Remote Desktop Services licensing model

If you are deciding between the two administrative sessions and RD Session Host, see Multi-User RDP vs RDS Session Host.

Windows Server CAL version compatibility

Windows Server CALs are version-aware. A CAL for a newer Windows Server version can generally access that version and earlier versions. An older CAL does not grant access to a newer Windows Server release.

So a Windows Server 2025 CAL can cover access to Server 2025, 2022, and 2019, while a 2022 CAL does not cover Server 2025.

Include CAL compatibility in migration planning instead of assuming existing access licenses automatically cover a new server generation.

CAL exceptions and CAL-equivalent rights

Windows Server licensing includes specific exceptions and alternative rights. Microsoft's current guidance includes situations such as qualifying public Internet web workloads, certain HPC use cases, appropriately licensed server-to-server access, and some physical operating-system environments used only to host and manage virtual environments.

These exceptions are narrow. An internal IIS application is not automatically exempt merely because it uses HTTP.

Microsoft Product Terms also recognize certain subscriptions or suites as CAL-equivalent rights for specific products. Do not assume a generic Microsoft 365 subscription replaces every Windows Server or RDS CAL. Check the exact SKU, assignment, version, and Product Terms.

What about external users?

External users can have a different licensing path from internal employees and onsite contractors.

Depending on the scenario, organizations may license external access with individual CALs or a Windows Server External Connector assigned to an accessed physical server. Additive capabilities such as RDS can have separate external-access licensing.

An External Connector is not automatically cheaper. Compare the external-user population, server count, workload, and current Microsoft terms.

Indirect access and multiplexing do not remove CAL requirements

An application, API, proxy, connection pool, middleware service, or other technology between the user and Windows Server does not automatically reduce required access licenses.

100 employees
→ business application
→ middleware service
→ Windows Server

Even if only one middleware identity connects directly to the server, the underlying users and devices may still need to be evaluated under Microsoft's multiplexing rules.

This matters for ERP, accounting, internal web applications, file services, and database-backed systems.

Windows Server CALs, SQL Server, and Active Directory

SQL Server licensing is separate from Windows Server licensing. An SQL Server CAL does not replace a Windows Server CAL because they license different products.

A deployment can require analysis of both the Windows Server access layer and SQL Server's own Server/CAL or Per Core model.

Active Directory Domain Services is also a Windows Server workload. Under the conventional customer licensing model, internal users or devices consuming Windows Server services need the applicable access rights unless an exception or CAL-equivalent right applies.

For AD deployment guidance, see Promote a Windows VPS to an Active Directory Domain Controller.

What changes when Windows Server is hosted by Raff?

Customer CAL licensing and service-provider licensing must be kept separate.

Raff-provided Windows under SPLA

When Raff supplies the Windows Server license under Microsoft's Services Provider License Agreement (SPLA) model, the hosted workload follows Microsoft's service-provider licensing rules rather than requiring the customer to purchase ordinary Windows Server User or Device CALs for that Raff-provided Windows instance.

Raff's current Windows Server Standard licence is $15/month per instance in addition to compute. For daily multi-user Remote Desktop Services on the Raff-hosted SPLA model, RDS User SALs are $8/month per authorized user and are separate from the Windows Server instance licence.

Raff Windows VM
+
$15/month Windows Server Standard licence
+
$8/month per authorized RDS user when hosted RDS is required

The RDS SAL is assigned by authorized user, not by peak concurrent sessions.

Customer BYOL

If a customer brings eligible Windows Server licences to Raff under Microsoft's applicable outsourcing or Flexible Virtualization rights, the customer's own Microsoft licensing terms apply. That can include Windows Server CALs and, where RDS is used, RDS CALs.

Windows Server BYOL should be assessed under the applicable Flexible Virtualization and outsourcing rights. Do not use the separate License Mobility through Software Assurance concept as the Windows Server BYOL mechanism.

For the complete decision, use Windows Server Licensing on Raff.

How many Windows Server CALs do you need?

Count assignments, not concurrent sessions.

User CAL example

18 employees access Windows Server
Each may use multiple devices
→ evaluate 18 User CALs

Device CAL example

40 employees work in shifts
They share 12 fixed terminals
→ evaluate 12 Device CALs

Mixed example

12 office employees with multiple devices
+
5 shared warehouse terminals
→ 12 User CALs + 5 Device CALs may fit

These examples illustrate assignment logic only. Final licensing depends on actual access, CAL-equivalent rights, exceptions, external users, and the customer's Microsoft agreement.

Common Windows Server CAL mistakes

Assuming the Windows Server license includes unlimited user access

The server licence and access licences are different layers under the conventional customer licensing model.

Buying RDS CALs but forgetting base Windows Server CALs

RDS CALs are additive. They do not replace the base Windows Server CAL where that base CAL is required.

Counting concurrent users instead of licensed users or devices

CALs are assigned to users or devices, not to a pool of simultaneous connections.

Using an older CAL with a newer Windows Server version

A Windows Server 2022 CAL does not grant access to Windows Server 2025.

Assuming a proxy removes CAL requirements

Multiplexing and indirect access do not automatically reduce licensing requirements.

Mixing customer CALs with hosted SPLA SALs

Customer-owned licensing and provider licensing are different models. Identify who supplies the Microsoft licence before counting access rights.

Windows Server CAL planning checklist

Before production, document:

• Windows Server version and edition.
• Who supplies the Windows Server licence.
• Whether the deployment uses customer licensing or Raff SPLA.
• Internal users and accessing devices.
• User CAL vs Device CAL assignment model.
• Existing CAL-equivalent rights.
• CAL version compatibility.
• External-user access and External Connector analysis.
• Multiplexing or indirect-access paths.
• Whether Remote Desktop Services is used.
• RDS CAL or hosted RDS SAL requirements.
• SQL Server and other product licensing reviewed separately.
• Final design checked against current Microsoft Product Terms.

What's next

• Windows Server Licensing on Raff
• RDS CAL Licensing Guide
• Windows Server Standard vs Datacenter
• Multi-User RDP vs RDS Session Host
• Raff Windows VM

Sources

• Microsoft Licensing — Windows Server 2025 Licensing Guidance
• Microsoft Licensing — Windows Server licensing documents
• Microsoft Product Terms — Windows Server
• Microsoft Learn — License Remote Desktop Services with Client Access Licenses
• Microsoft Licensing — Services Provider License Agreement
• Sources revalidated: 2026-09-17

Microsoft licensing terms can vary by agreement, program, product version, geography, and deployment model. Microsoft Product Terms and the customer's executed licensing agreement control if they conflict with this guide.