Three routes to Windows session hosts in Azure, and they are not close on price
Running Windows Remote Desktop sessions in Azure has three licensing routes: RDS CALs with Software Assurance, Azure Virtual Desktop per user, and bring-your-own-license under License Mobility. On the same 1,000-user workload they price out from roughly 75K to 396K over three years, so the route decision dwarfs the unit rate. Map the estate to its license source before the SA anchor, because the metric switch between per-device and per-user is permitted at SA renewal only.
Prepared by Redress Compliance · August 9, 2026 · Microsoft advisory. Based on enterprise Microsoft RDS and AVD estate reviews, 500-plus clients advised.
Executive summary
If you already own RDS CALs with active Software Assurance, BYOL into Azure is the cheapest route by a wide margin.
On 1,000 users on persistent session hosts, BYOL of existing CALs under License Mobility costs the SA only, roughly 75K to 114K over three years, against 240K to 300K for fresh RDS User CALs plus SA and 396K for AVD per user external.
And it is free where the users already hold M365 E3 or E5, which include AVD user rights.
RDS User CALs plus SA is the cheapest fresh license path on a three-year horizon, and AVD per user external at roughly 11 dollars a month, or 132 dollars a year, is the right path only for users not already licensed via M365 E3 or E5.
License Mobility moves on-prem RDS CALs into Azure, but Windows Server is not on the list, and mixing the two is the most common BYOL mistake.
License Mobility through active SA permits deploying RDS CALs and Listed Server products such as SQL Server, BizTalk and SharePoint on an Authorized Outsourcer including Azure, subject to a verification form on first deployment and no reassignment more than once every 90 days.
Windows Server itself is not License Mobility; Windows Server in Azure runs under Azure Hybrid Benefit, a different program with different rules. The two solve different problems, and mixing them, treating Windows Server as a mobility right, is the mistake that trips most procurement teams.
The per-device versus per-user choice is reversible at SA renewal only, and cloud RDP from any device forces per-user.
RDS Device CALs count the accessing device, best for shared kiosks, manufacturing floors and contact centers, at roughly 102 dollars perpetual plus 25 SA; RDS User CALs count the accessing user, best for a mobile or BYOD workforce, at 152 plus 38.
The wrong choice locks the customer into the wrong metric for the SA term, so the buyer-side audit identifies the right metric before the SA anchor, and a per-device CAL cannot cover cloud RDP from any device, which requires per-user.
A reclassification that catches estates that moved workloads to Azure without revisiting the metric.
Multi-tenant hosting is a separate license, and lapsed SA ends mobility the day it lapses.
Three traps recur: multi-tenant hosting of third-party users is not permitted on retail RDS CALs and requires SPLA via RDS SAL; a per-device CAL against a cloud RDP session counts the wrong unit and needs per-user.
And lapsed SA mid-term ends the mobility right immediately, reverting the license to on-prem use only.
The AVD line itself is included at no incremental cost inside M365 E3 and E5, so the per-user external AVD license applies only to users outside that bundle.
One estate mapped a 1,200-user RDS estate, found 380 CALs eligible for mobility into Azure, switched 220 contractors to AVD per user external, and landed the EA renewal 23 percent below the original ask on the RDS line.
The three routes, priced on 1,000 users
| Route | License unit | Three-year cost band |
|---|---|---|
| RDS User CAL plus SA | 1,000 RDS User CALs plus SA | 240,000 to 300,000 |
| AVD per user external | 1,000 users at 132 per year | 396,000 |
| AVD via M365 E3 | If E3 already owned | Included in E3 |
| BYOL existing CALs into Azure | Existing CALs with active SA | SA only, roughly 75,000 to 114,000 |
The decision logic is simple once the estate is mapped: if you already own RDS CALs with SA, BYOL into Azure is the cheapest route; RDS User CALs plus SA is the cheapest fresh license path on a three-year horizon.
And AVD per user external is right only when the workload is consumed by users not already licensed via M365 E3 or E5.
M365 E3 and E5 include AVD user rights, so the user can access AVD without an additional per-user license, and only the AVD compute, storage and networking on Azure are billed separately.
AVD provides multi-session Windows 10 and 11 Enterprise available only on Azure, FSLogix profile containers, image management, the session-host management plane and RDP Shortpath.
The wider Azure cost picture sits in the Azure cost optimization pillar, and the E3-versus-E5 base decision in the E3 vs E5 vs F3 guide.
License Mobility, and the Windows Server trap
- Active Software Assurance is required: the mobility right exists only while SA is active, and lapsed SA mid-term ends it the day it lapses, reverting the license to on-prem use only.
- Authorized Outsourcer only, with verification: Azure and other listed providers qualify, and Microsoft requires a verification form on first BYOL deployment, with no reassignment more than once every 90 days.
- Listed Server products travel too: SQL Server, BizTalk, SharePoint and several others sit on the Listed Server schedule and move under the same mobility right as RDS CALs.
- Windows Server is not License Mobility: Windows Server in Azure runs under Azure Hybrid Benefit, a different program with different rules, and mixing the two is the most common BYOL mistake. The AHB reconciliation sits in the Hybrid Benefit optimization guide.
- Three traps close the picture: multi-tenant hosting of third-party users needs SPLA via RDS SAL not retail CALs, a per-device CAL cannot cover cloud RDP from any device, and lapsed SA ends mobility immediately.
The Microsoft EA renewal playbook
The AVD versus RDS decision matrix, the License Mobility checklist, the BYOL verification map, and the discount benchmark.
Get the white paper →The per-device versus per-user metric, and the SA anchor
The choice between per-device and per-user RDS CALs is reversible at SA renewal only, so the wrong choice locks the customer into the wrong metric for the SA term, and the buyer-side audit identifies the right metric before the SA anchor.
RDS Device CALs count each accessing device and fit shared kiosks, manufacturing floors and contact centers at roughly 102 dollars perpetual plus 25 dollars a year of SA.
RDS User CALs count each accessing user and fit a mobile, BYOD or multi-device workforce at 152 plus 38, and both can move into Azure under License Mobility with active SA.
The trap is the cloud session: a per-device CAL counts the connecting device, but cloud RDP from any device requires per-user, so an estate that moved a device-licensed population to Azure without revisiting the metric is under-licensed.
Because the switch direction, per-device to per-user or the reverse, is permitted only at SA renewal, the metric decision has to be made before the SA anchor rather than discovered after it, which is why the estate mapping, users to license source, comes first.
In one engagement a 1,200-user RDS estate was mapped, 380 persistent CALs were found eligible for License Mobility into Azure, 220 contractors were switched to AVD per user external, and the rebuilt position landed the EA renewal 23 percent below the original Microsoft ask on the RDS line.
The seat-reclaim tooling that pairs with this sits in the M365 license optimizer, and the end-to-end vendor process in the Microsoft vendor management toolkit.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across Microsoft RDS and AVD estates
Across enterprise Microsoft RDS and AVD estate reviews, the route decision, not the unit rate, decided the cost, and the estate was rarely mapped to its license source before the renewal. The three routes price out very differently on the same workload, so the mapping is where the saving is found:
Where a 1,200-user estate was mapped, 380 CALs moved into Azure under mobility, and 220 contractors switched to AVD per user external, rebuilding the EA renewal position.
Three-year cost on 1,000 users between BYOL of existing CALs under mobility and AVD per user external, the same workload priced two ways.
The buyer-side process fits inside a 90-day window before the next M365 or EA renewal anchor, and it is seven steps: inventory the RDS estate, session hosts, user counts, persistent versus non-persistent, AVD versus on-prem.
Map users to license source, M365 E3 or E5, RDS CAL with SA, external AVD per user, contractor; identify mobility candidates, RDS CALs with active SA that can move into Azure; identify reclassification candidates, per-device users on cloud RDP who need per-user; model the three routes side by side.
Negotiate at the SA anchor, because the switch direction is permitted only at SA renewal; and document the position with the mobility verification form and the License Mobility statement filed.
The gotchas are restrictive and three areas trip up most teams: multi-tenant hosting on RDS CALs is not permitted and needs SPLA via RDS SAL, a per-device CAL with a cloud session needs per-user, and lapsed SA mid-term ends mobility rights the day SA lapses.
The deliverable is a defended RDS position, a defended AVD position, and a defended Azure Hybrid Benefit posture across the SA term. The wider Microsoft library sits in the Microsoft practice.
Your first five moves
- Inventory the RDS estate and map users to license source, M365 E3 or E5, RDS CAL with SA, external AVD, contractor, because the route decision needs the license source, not just the headcount.
- Identify mobility candidates: RDS CALs with active SA can move into Azure under License Mobility as the cheapest route, at SA cost only.
- Identify reclassification candidates: per-device users on cloud RDP need per-user, and the switch is permitted only at SA renewal, so surface it before the anchor.
- Model the three routes side by side on your real population, because on 1,000 users they span roughly 75K to 396K over three years.
- Negotiate at the SA anchor and document the position with the mobility verification form filed, keeping Windows Server on Azure Hybrid Benefit, not mobility. The Microsoft practice runs the estate review with you.
Frequently asked questions
Does AVD require a separate license if we have M365 E3?
No. Microsoft 365 E3 and E5 include Azure Virtual Desktop user rights, so the user can access AVD without an additional per-user AVD license, and only the AVD compute, storage and networking on Azure are billed separately.
The per-user external AVD license, at roughly 11 dollars a month or 132 a year, applies only to users not on M365 E3 or E5, which is why the estate mapping to license source decides whether the AVD line costs anything at all.
Can we use RDS CALs in Azure?
Yes, via License Mobility through Software Assurance. The RDS CALs must have active SA, Azure is an Authorized Outsourcer, a verification form is required on first BYOL deployment, and the license cannot be reassigned more than once every 90 days.
Where the CALs already exist with active SA, this is the cheapest route by a wide margin, costing the SA only, roughly 75K to 114K over three years on 1,000 users against 240K to 300K for fresh CALs or 396K for AVD per user external.
What is the difference between per-device and per-user RDS CALs?
Per-device CALs count each accessing device and suit shared workstations, kiosks and contact centers at roughly 102 dollars perpetual plus 25 SA; per-user CALs count each accessing user and suit mobile and BYOD workforces at 152 plus 38.
The choice is reversible only at SA renewal, so the wrong metric locks in for the SA term, and cloud RDP from any device requires per-user, which is a common reclassification for estates that moved workloads to Azure without revisiting the metric.
Is Windows Server in Azure covered by License Mobility?
No. Windows Server in Azure runs under Azure Hybrid Benefit, not License Mobility, and they are different programs with different rules. Azure Hybrid Benefit lets on-prem Windows Server licenses with active SA run on Azure VMs at the discounted base rate.
License Mobility covers RDS CALs and Listed Server products such as SQL Server, BizTalk and SharePoint. Treating Windows Server as a mobility right is the most common BYOL mistake, so keep the two programs on separate tracks.
Can we host third-party users on RDS CALs?
No. Multi-tenant hosting of third-party users requires SPLA via RDS SAL, because retail RDS CALs are for users of the customer organization only.
The RDS External Connector is an alternative for known external users on a single CAL population, but a service-provider hosting model serving third parties sits on the Services Provider License Agreement, not on the retail CAL program.
Getting this boundary wrong is one of the restrictive mobility traps that catches procurement teams.
What is the cheapest RDS route on Azure for 1,000 users?
BYOL of existing RDS CALs with active SA into Azure is the cheapest route if the licenses already exist, costing the SA only, roughly 75K to 114K over three years.
RDS User CALs plus SA is the cheapest fresh license route at 240K to 300K, and AVD per user external at 396K is the right path only when the users are not licensed via M365 E3 or E5. The route decision dwarfs the unit rate, so it is decided by mapping the estate to its license source first.
