Microsoft RDS licensing in Azure. Three routes, and they are not close on price.

If you own RDS User CALs with active Software Assurance, bringing them to Azure costs only the SA. Map every user to the license that covers them before the SA renewal, because that is the only point you can switch CAL type.

Microsoft gives you three ways to license Remote Desktop sessions in Azure. You can bring the RDS CALs you already own under Software Assurance, buy new RDS User CALs with SA, or use Azure Virtual Desktop rights. On the same 1,000 users, the three year license cost runs from about $75,000 to $396,000.

That spread is much wider than any discount you will win on a unit price. So the first job is to work out which license already covers each user, and only then decide what to buy.

What are the licensing routes for Remote Desktop sessions in Azure?

Which route is open to you depends on who the users are and what licenses you hold today. The table splits AVD into its two forms, the rights already inside Microsoft 365 and the per user access pricing sold for external customers, and prices each line on 1,000 users over three years.

The last row needs care. Microsoft sells per user access pricing only for external users, meaning customers outside your organization. It is not a way to license your own staff or contractors, and the section on external users below explains where that line sits.

What none of the routes include

Every figure above is license cost only. The session host virtual machines, storage and networking are billed separately on your Azure invoice in every route. A Windows Server virtual machine at pay as you go rates already includes the Windows Server license, but it does not include a single RDS CAL.

Can you use your existing RDS CALs in Azure?

Yes, if they are RDS User CALs with active Software Assurance. Those CALs carry an extended right to Remote Desktop Services on Windows Server in Azure, or with an Authorized Mobility Partner. It is the cheapest route by a wide margin, because you pay only the SA you were already paying.

Five conditions apply, and a migration plan has to satisfy all of them.

• Active SA throughout. The right exists only while SA is active. If SA lapses mid term, the Azure right ends that day and the CAL reverts to use on premises only.
• One shared server environment. The SA benefit allows each user to reach Remote Desktop Services in one shared environment, such as Azure, in addition to your own servers on premises.
• Verification form. Microsoft requires the License Mobility verification form on first BYOL deployment. Its guidance is to submit it within 10 days of deploying.
• 90 day reassignment rule. A license cannot be reassigned more than once every 90 days, so you cannot flip users between environments month to month.
• Listed Server products travel under the same right. SQL Server, BizTalk, SharePoint and several others sit on the Listed Server schedule and can move to Azure with active SA.

Why Windows Server itself runs under Azure Hybrid Benefit

Windows Server is not eligible for License Mobility. Microsoft states that the Windows Server license comes from Azure or the Authorized Mobility Partner. Your own Windows Server licenses with active SA reach Azure virtual machines through Azure Hybrid Benefit, a separate program with its own rules that bills the VM at the base compute rate.

Treating Windows Server as a mobility right is the most common BYOL mistake we see. Keep RDS CALs and Listed Server products under License Mobility, and Windows Server under Hybrid Benefit, as separate records. Our Hybrid Benefit optimization guide covers the reconciliation, and the Azure Hybrid Benefit guide for Windows and SQL Server the wider picture.

Where Device CALs fit

The extended Azure right in Microsoft's licensing FAQ is written for RDS User CALs. Azure Virtual Desktop is broader. For Windows Server session hosts serving internal users, it accepts RDS CALs with SA, per user or per device, and RDS User Subscription Licenses. Device CALs with SA can therefore still earn their keep in Azure inside an AVD host pool.

Does Microsoft 365 E3 include Azure Virtual Desktop?

Yes. Microsoft 365 E3 and E5 include AVD user rights, so those users need no extra AVD license and you pay only for compute, storage and networking in Azure. The list of eligible licenses is longer than most buyers assume.

• Microsoft 365 E3, E5, A3, A5, F3 and Business Premium
• Windows Enterprise E3 and E5, and Windows Education A3 and A5
• Windows VDA per user

Those rights cover Windows client session hosts, including Windows 10 and 11 Enterprise Multi-Session, which you can run only through AVD. The service also brings FSLogix profile containers, image management, the session host management plane and RDP Shortpath. Host pools on Windows Server are the exception: their users need RDS CALs with SA whatever Microsoft 365 license they hold.

For the choice of base license, see our E3 vs E5 vs F3 guide, and for how AVD compares with Cloud PCs, the Windows 365 vs AVD licensing guide.

Who counts as an external user for per user access pricing?

External users are customers who are not members of your organization, typically people using an application you deliver to them as a service. Microsoft's AVD licensing page counts employees, students, external vendors and contractors as internal users. Contractors therefore need an eligible internal license, such as Windows VDA per user or Microsoft 365 F3.

Per user access pricing is not available on Windows Server session hosts, and it bills each distinct user who connects in the month. We plan at roughly $11 a month per user for the desktops and apps tier, or $132 a year. Check your region's current rate in the Azure pricing calculator before you model it.

Should you license RDS per user or per device?

Choose per device when many people share a small number of fixed machines, and per user when people connect from several devices or from anywhere. The choice can be reversed only at SA renewal, so the wrong metric stays with you for the whole SA term.

The reclassification that follows a move to Azure

A Device CAL counts the machine that connects. Once users reach cloud session hosts from home laptops, tablets and phones, those connections come from devices you never licensed, and per user is the metric that covers them. A population licensed per device that moved to Azure without anyone revisiting the metric is under licensed.

Because the switch is allowed only at SA renewal, you need to find these users before that date. Miss it, and closing the gap means buying new User CALs at full price instead of converting Device CALs you already pay SA on.

Why we do not tell every client to standardize on User CALs

The common advice is to put everyone on User CALs because they follow the person. We disagree for shift based operations. Say a contact center runs 150 shared workstations across three shifts, with 450 agents in total. Over three years, the two metrics price out very differently.

The better course is to split the population. Keep Device CALs where the device is fixed and shared, run those desks on AVD with Windows Server session hosts, and buy User CALs only for staff who connect from several devices or from outside the office.

How do the three year costs work out on 1,000 users?

With the rough list prices above, the arithmetic for 1,000 users is simple. The table shows each step, so you can replace our numbers with your own price level.

The $266,000 sits inside the band in the first table; your agreement type and price level decide where. On the BYOL routes, session host compute is often the larger line, so watch users per host and reserved instance coverage too. The wider cost picture is in our Azure cost optimization guide for 2026.

How the answer changes with the size of the organization

• A few hundred users on Business Premium. AVD rights are already in the license. Run Windows 11 Enterprise Multi-Session host pools and buy no RDS CALs unless a legacy application needs Windows Server.
• A mid size enterprise with an old RDS farm. Existing User CALs with SA go to Azure at SA cost. Retire the CALs of users who already hold E3 and move them to Windows 11 session hosts.
• A large enterprise on E3 or E5. The RDS CAL count should shrink to the Windows Server session hosts you cannot retire. Every remaining CAL needs a named reason.

Can you host third party users on RDS CALs?

No. Retail RDS CALs cover users of your own organization. If you host desktops or applications for third parties on a multi tenant basis, that is a service provider model, and it sits on the Services Provider License Agreement through RDS Subscriber Access Licenses (SALs).

If you are moving into the second row, read our SPLA licensing guide before you sign with a hosting partner, because SPLA carries its own monthly reporting and its own audits.

How do you check which license covers each user?

You need four data sets, and Microsoft already gives you the tools to pull each one. Put them in a single sheet with one row per user.

• RDS CAL issuance. Remote Desktop Licensing Manager reports on per user CALs and shows issued Device CALs on each license server. The Licensing Diagnoser shows which mode each session host is set to.
• SA status and renewal dates. The Volume Licensing section of the Microsoft 365 admin center lists your agreements, CAL quantities and SA coverage end dates.
• Microsoft 365 and Windows licenses. The licenses page of the Microsoft 365 admin center, or an export from Entra ID, shows who holds E3, E5, F3 or VDA.
• Who actually connects. AVD Insights and the connection logs in Log Analytics show distinct users per host pool. Per user access charges appear in Azure Cost Management.

Two license server behaviors catch teams out. Per user CALs are not enforced, so a clean console proves nothing. A new session host also runs for 120 days without a license server, which is how unlicensed farms go unnoticed after a migration.

Our M365 license optimizer helps with the seat reclaim that usually follows, and the internal usage review template gives the sheet a structure.

What have we seen in recent RDS and AVD reviews?

In the RDS and AVD reviews we have run for enterprise clients, the route decided the cost far more than the unit rate. The user base was rarely mapped to its license source before renewal, so the saving sat in the mapping.

Map every user to the license that already covers them before anyone prices a new one.

One review covered a 1,200 user RDS environment. We found 380 persistent CALs eligible to move into Azure under License Mobility and moved 220 contractors off the RDS CAL count and onto AVD. The rebuilt position brought the RDS line of the EA renewal in 23 percent below Microsoft's original ask.

If you repeat that step with contractors, check the license each one lands on. Under Microsoft's current AVD licensing terms, contractors are internal users and need an eligible internal license.

What the Microsoft account team will say, and what to answer

• "AVD is included in your E3, so move everyone." Agree for users on Windows client session hosts. Ask how the Windows Server session hosts will be covered, because those still need RDS CALs with SA.
• "Renew SA on the full CAL count to keep your cloud rights." Renew SA only on CALs that will serve users in Azure or AVD. Retire the rest, since a user already on E3 in a Windows 11 host pool does not need them.
• "True up RDS to your full headcount." Answer with the per user CAL report and the AVD connection data. Headcount includes people who never open a remote session.
• "Your Windows Server licenses move with License Mobility." They do not. Ask for Azure Hybrid Benefit to be priced as its own line.

What to put in the renewal paperwork

• The CAL type split. Record the per device and per user quantities you are switching to at this renewal, since the next chance is the following renewal.
• SA end dates aligned. Make CAL SA coterminous with the agreement, so no batch lapses mid term and loses its Azure right.
• A price hold on RDS CAL SA. The BYOL route is only cheap while SA stays at today's rate.
• Reduction rights at renewal. Confirm you can drop SA quantities as users move to Microsoft 365 based AVD.

The whole review fits inside the 90 days before the next EA or Microsoft 365 renewal. Our version has seven steps, from inventory through negotiation at SA renewal to a filed verification form and License Mobility statement, and the list below condenses them. The end to end vendor process is in the Microsoft vendor management toolkit.

What to do next

1. Inventory the RDS and AVD environment. List session hosts, user counts, persistent against non persistent hosts, and which workloads run in AVD or on premises.
2. Map each user to a license source. Microsoft 365 E3 or E5, RDS CAL with SA, AVD per user access for external customers, or contractor needing an internal license. The route needs the license source, not just the headcount.
3. Find the mobility candidates. RDS User CALs with active SA can go to Azure at SA cost only. File the verification form when you deploy.
4. Find the reclassification candidates. Users on Device CALs who now connect from any device need User CALs. Surface them well before SA renewal, since that is the only point the switch is allowed.
5. Model the routes side by side on your real population. On 1,000 users they span roughly $75,000 to $396,000 over three years, before compute.
6. Negotiate at SA renewal and document the result. Keep Windows Server on Azure Hybrid Benefit and the CALs under License Mobility. Our Microsoft practice can run the review with you.

Frequently asked questions