VDI Licensing Fundamentals
Microsoft traditionally licences Windows for VDI on a per-access-device or per-user basis. The primary licensing vehicles are Windows Software Assurance (SA), Virtual Desktop Access (VDA), and Windows Enterprise subscriptions via Microsoft 365. These determine who is licensed to access a remote Windows OS and from which devices.
Virtual Desktop Access (VDA) Explained
🔑 Windows SA Benefit
If a PC is covered by Windows Software Assurance, it includes access to virtual Windows desktops at no extra cost. Devices with active Windows SA (or a Windows Enterprise subscription) have built-in "virtual desktop access rights." This was Microsoft's way of allowing volume licensing customers to run Windows in VDI without additional fees on those licensed PCs.
📋 When VDA Is Needed
For devices not covered by Windows SA — thin clients, non-Windows endpoints, personally owned or contractor PCs — you must purchase a Windows VDA licence to legally allow those devices to access a Windows virtual desktop. VDA ensures every endpoint is licensed, whether it's a Mac, Linux device, iPad, or older PC without proper licensing. VDA is typically provided as a per-device annual subscription at approximately USD $100 per device per year (retail).
👤 Per-Device vs Per-User VDA
Traditional VDA is device-based (one licence per accessing device). Microsoft now also offers per-user licensing through subscriptions, which covers VDI rights across multiple devices for a single user. The key rule: every accessing endpoint or user must be covered by some form of Windows virtualisation licence (SA, VDA, or qualifying subscription). There is no "free" use of Windows in a VM for unlicensed endpoints — ignoring this is a common compliance risk. VDA covers only the Windows OS itself — it does not cover Microsoft Office or RDS CALs.
Windows 10/11 Enterprise Per-User Licensing via Microsoft 365
🏢 M365 E3/E5 — VDA Rights Included
A user with Microsoft 365 E3 or E5 is licensed for Windows Enterprise on up to five devices and, crucially, has VDI access rights on any device they use. The Windows 10/11 Enterprise per-user licence that comes with M365 fulfils the VDA requirement for that user. You don't need separate VDA licences for that user's devices — even if they use personal or non-Windows endpoints — because the user subscription covers them. Instead of buying $100/year VDA for a user's home PC and iPad, a single M365 E3 licence covers both.
🔄 How Per-User Licensing Enables Remote Access
With Windows Enterprise per-user, an employee can legally access a Windows VM from any of their devices (corporate or personal). This is ideal for BYOD programmes. An engineer with M365 E5 can use a personal Mac to log into a Windows 11 virtual desktop — no separate VDA is needed. Per-user licensing also allows the licensed user to run multiple VMs (for testing, multi-session needs, etc.) as long as it's for that user's primary use.
On-Premises VDI (Citrix, VMware) — Licensing Considerations
Traditional on-premises VDI solutions (Citrix Virtual Apps and Desktops, VMware Horizon) host Windows client OS instances in the data centre. The primary Microsoft licensing concern is licensing the Windows desktop OS for remote users and any required RDS licences.
✅ Organisations with M365 E3/E5
Each user's M365 licence covers their rights to use Windows 10/11 VDI. No extra OS licence needed. A company with 500 employees all on M365 E3 can deploy a Citrix VDI farm with Windows 10 Enterprise VMs. All 500 users can connect from any device (office PC, home laptop, tablet), and the Windows OS is licensed via their M365 user subscriptions — no separate VDA subscription or Windows OS licence required.
⚠️ Organisations without M365 (or Mixed Licensing)
If some users or endpoints lack a Windows E3/E5 licence, you must licence their access via another route: Software Assurance on Windows Pro PCs (ensure SA is up to date — if lapsed, VDA is needed), Windows VDA per device (~$100/year per thin client or non-Windows device), or a standalone Windows Enterprise subscription per user (like M365 E3 without Office). Also consider RDS CALs if your VDI solution uses RDS components — many Citrix deployments require RDS CALs because the Citrix VDA agent uses RDP under the hood on Windows Server.
Azure Virtual Desktop (AVD) — Cloud VDI Licensing
Azure Virtual Desktop (formerly Windows Virtual Desktop) is Microsoft's cloud-based VDI platform running on Azure. Licensing involves two pieces: user access rights and Azure infrastructure costs.
👤 User Licensing for AVD
Microsoft does not charge a separate per-user licence fee for AVD for internal users. It requires that each user have an appropriate Windows licence. AVD is essentially free to use if users are already licensed for Windows Enterprise — you only pay for Azure consumption. Eligible licences: Microsoft 365 E3, E5, F3, A3/A5, Business Premium, or standalone Windows 10/11 Enterprise E3/E5. For external users, Microsoft offers a per-user monthly fee ($10/user/month for full desktop, $5 for app-only) instead of requiring them to have a Windows licence.
☁️ Azure Infrastructure Costs
Running AVD incurs pay-as-you-go Azure infrastructure costs: compute (VM hours), storage, networking. VMs can auto-scale down at night to save money — if a VM runs 8 hours/day, you pay for 8 hours. Multi-session Windows 10/11 is available exclusively on Azure, allowing multiple user sessions on a single VM — greatly reducing the number of VMs needed. This is a unique licensing benefit: no additional licence charge for multi-session beyond the same user licence requirement. You can also use Azure Hybrid Benefit to apply existing Windows Server licences with SA to reduce Azure VM costs by up to 40%+.
Windows 365 Cloud PC — Licensing and Comparison to AVD
💻 Windows 365 Licensing Model
Windows 365 is licensed per user, per Cloud PC. You purchase a licence SKU corresponding to a specific configuration (e.g. 2 vCPUs, 8 GB RAM, 256 GB storage) at a fixed monthly fee (~$31/user/month for a basic config). The fee covers VM, storage, and management — truly a SaaS solution with no separate Azure charges. The Windows 365 subscription covers the Windows OS licence — you don't need SA or VDA. Windows Hybrid Benefit provides ~16% discount if the user has a Windows Pro licence on their primary device.
🏢 Enterprise vs Business Editions
Windows 365 Enterprise: Requires user to also be licensed for Windows Enterprise, Intune, and Azure AD Premium 1 — typically via M365 E3/E5 or Business Premium. Integrates with Intune management, hybrid AD-join, etc. Ideal for companies already on M365. Windows 365 Business: No licensing prerequisites — purchase and assign, even without M365. Limited to 300 users, designed for SMBs or simple deployments. Plug-and-play: purchase the licence, user gets their Cloud PC.
👥 Windows 365 Frontline
Specialised licence for shift workers: each Frontline licence allows 3 Cloud PCs for 3 users, but only 1 active at a time (non-concurrent). For a hospital with 30 nurses across 3 shifts (10 per shift), instead of 30 licences, buy 10 Frontline licences. Each provides Cloud PCs for three nurses on different shifts. Approximately one-third the cost per user. Requires base M365 entitlements (F3/E3 for Intune and AAD).
AVD vs Windows 365 — Side-by-Side Comparison
| Factor | Azure Virtual Desktop (AVD) | Windows 365 Cloud PC |
|---|---|---|
| Model | Platform as a Service — you manage Azure environment | Software as a Service — Microsoft manages everything |
| User Licensing | Must have M365 E3/E5 or Windows E3/E5 — no separate AVD fee | Cloud PC licence includes Windows OS; Enterprise edition requires M365; Business has no prereqs |
| Cost Structure | Consumption-based (Azure pay-as-you-go); VMs can scale down/off | Fixed monthly per-user fee; 24/7 availability included |
| Multi-Session | Supported (Windows 10/11 multi-session — multiple users per VM) | Not supported — one user per VM (except Frontline model) |
| Management | Requires Azure/VDI expertise; full customisation of images, scaling, networking | Minimal IT overhead; managed via Intune like physical PCs |
| Best For | Variable workloads, BYOD, enterprises with Azure expertise leveraging existing M365 | Predictable costs, simplified management, full-time personal Cloud PCs, contractors |
| Frontline Option | Use multi-session + scheduling with consumption model | Windows 365 Frontline: 3 users / 1 licence (non-concurrent) |
Remote Access Use Cases and Licensing Strategies
📱 1. BYOD (Bring Your Own Device)
When employees use personal devices to access corporate virtual desktops, assign each BYOD user a Microsoft 365 E3 or E5 licence (or Windows Enterprise per-user). Since personal devices won't have corporate Windows SA, per-user licensing is the simplest way to grant VDI rights across any device. M365 covers the user across all their devices, avoiding the need to individually licence each personal device with VDA. Ensure BYOD policy limits access to authorised, licensed users only — Azure Virtual Desktop integrates with Azure AD for conditional access and MFA enforcement.
🔧 2. Contractors and Part-Time Workers
For short-term contractors, Windows 365 Business is very attractive — no prerequisites, purchase a Cloud PC licence and the contractor gets a secure, ready-to-use workstation. For larger contractor pools, consider AVD external user billing ($10/user/month). For part-time employees, consider Windows 365 Frontline licences to serve 3 users with 1 licence. Always ensure each contractor has a licensed account — contractors using unlicensed personal Microsoft accounts creates a compliance gap.
🏭 3. Frontline and Shift Workers on Shared Devices
For shared PCs used by shift workers, consider device-based licensing (Windows Enterprise via SA or VDA on the shared device) — more economical when the device-to-user ratio is low (1 device shared by 5 workers = 1 licence not 5). M365 F3 is tailored for frontline workers and includes Windows Enterprise for VDI, but the device must have Windows Pro base licence. Windows 365 Frontline is practically made for this: 1 licence covers 3 shift workers at ~⅓ the cost per user.
Cost-Effective Licensing Strategies
📋 Inventory and Leverage Existing Licences
Assess what Microsoft licences you already own. Many enterprises discover they already have Windows VDI rights via M365 or SA and aren't fully utilising them. If you've invested in M365 E3/E5, capitalise on those entitlements as the cornerstone of your VDI licensing strategy. Avoid paying again for VDA if it's not necessary. If paying for multiple device VDA subscriptions, consider whether shifting to M365 E3 delivers more value (Office, EMS, and Windows for roughly the combined price).
💰 Use Azure Hybrid Benefit
For any cloud deployment (AVD or Windows 365), use Azure Hybrid Benefit. Apply existing Windows Server licences with SA to Azure to cover session host VMs and reduce costs by up to 40%+. For Windows 365, ensure Windows Hybrid Benefit is applied if you qualify (~16% discount). These require administrative steps but savings are substantial.
📊 Choose AVD vs Windows 365 Based on Usage Patterns
If your workforce works standard hours and you have IT capability, AVD with scaling scripts can be very cost-effective (shutting down VMs after 7 PM and weekends). If your workforce is global 24/7 or you prefer simplicity, Windows 365's fixed costs may be competitive when considering IT management savings. Sometimes a mix is optimal: critical users on Windows 365 for guaranteed performance; larger pool on AVD pooled desktops.
🔒 Minimise Licensing Overlap for Frontline
Either licence the user or the device — not both. Don't pay for M365 F3 for a user and VDA for the shared device they use — one is sufficient. Be clear about whether user-based or device-based is the primary metric for each scenario and stick to it. Configure VDI solutions to allow only properly licensed users to sign in via Azure AD groups.
CIO Recommendations and Action Plan
For Global Enterprises
Develop a Unified VDI Licensing Policy
Establish a clear policy covering all forms of remote Windows access — on-prem VDI, Azure VDI, Cloud PC, RDS. Mandate that any VDI implementation be reviewed by a licensing specialist and aligned with corporate Microsoft agreement terms. Inconsistency across regions leads to non-compliance.
Maximise Your Enterprise Agreement
You likely licence Windows Enterprise organisation-wide via M365. Ensure EA true-ups account for VDI usage. If planning a major AVD shift, negotiate Azure consumption commitments or promotional credits with Microsoft. Use your scale for cost predictability.
Adopt a Tiered VDI Strategy
Tier 1: Persistent Cloud PCs (Windows 365 or personal AVD VMs) for executives/developers needing admin rights. Tier 2: Pooled AVD multi-session for general office workers, maximising density and minimising Azure costs. Tier 3: Traditional desktops/laptops with SA for occasional VDI use. Match licence types to usage patterns — don't give every user the most expensive solution.
Invest in Automation and Monitoring
Track VDI usage vs licences at enterprise scale. Use Azure Cost Management to monitor AVD metrics and compare with licensed user counts. Automate power management in AVD (schedules, AutoScale for host pools) — savings accumulate significantly at scale. Flag discrepancies where more users log in than are licensed.
Audit Contractors and Partners
Periodically audit external users with temporary accounts. If multiple contractors are identified, transition them to "external AVD" billing or Windows 365 Business Cloud PCs deleted after use. Prevent licence creep where expensive E5 licences are assigned to short-term accounts and forgotten.
For Midsize Organisations
Simplify with Microsoft 365
M365 Business Premium (≤300 users) includes Windows Enterprise upgrade, Office, Intune, and VDI rights — one per-user licence covers everything. For 300+ users, E3/E5 via CSP or EA. A single per-user licence covering Windows, Office, and mobility makes VDI licensing one less headache.
Utilise Cloud Services to Reduce Complexity
Lean towards Windows 365 or straightforward AVD deployment (possibly via managed service provider or tools like Nerdio). Windows 365 may cost slightly more than AVD but the time saved and reduced admin overhead is valuable for smaller IT teams — just assign and go.
Optimise Shared Device Licensing
If you have a handful of shared devices/kiosks, cover them with device-based licensing (10 shared PCs for 50 workers = 10 VDA licences, not 50 user licences). Cheaper and easier to track for known, fixed assets.
Watch Azure Costs Carefully
A surprise Azure bill can upset a mid-size IT budget. Start AVD small, monitor costs daily/weekly, use Azure budgets and alerts. If Azure cost variability is concerning, Windows 365's fixed pricing may be preferable despite slightly higher nominal cost.
Consider CSP Licensing for Flexibility
Cloud Solution Provider allows month-to-month adjustments. Ramp up/down M365 or Windows 365 licences as staffing changes — e.g. add 20 Windows 365 licences for 2-month contractor project, then drop them. This flexibility aligns well with dynamic remote work staffing.
General Recommendations (All Organisations)
Keep Documentation
Document licensing assumptions and decisions with references to Microsoft's licensing terms. This is critical for audits, personnel changes, and continuity. If you decide "M365 E3 covers all VDI," write that down with the supporting terms reference.
Stay Informed About Licensing Changes
Microsoft VDI licensing evolves (per-user AVD external licensing, Windows 365 Frontline, etc.). Assign someone to monitor Microsoft announcements. Do an annual review — new offerings can uncover savings or risks. Designate a licensing champion or use a licensing partner for regular reviews.
Pilot and Iterate
When adopting new approaches (moving from on-prem VDI to AVD or introducing Cloud PCs), run a pilot evaluating not just technical performance but licensing impact. Verify all pilot users are properly licensed with evidence. Flush out overlooked scenarios (unlicensed intern trying to log in, etc.) before scaling.
The goal is to enable flexibility for employees — work from anywhere, on any device — while maintaining compliance and controlling costs. Microsoft's licensing has a reputation for complexity, but by leveraging existing entitlements, taking advantage of cloud offerings, and matching licence types to usage patterns, CIOs can turn licensing into an advantage rather than a burden.
Need Help with Microsoft VDI & Remote Work Licensing?
Whether you're navigating on-premises VDI compliance, evaluating Azure Virtual Desktop vs Windows 365, optimising licensing for BYOD and contractors, or preparing for an EA renewal that includes remote desktop entitlements — our Microsoft licensing specialists deliver vendor-neutral expertise to ensure compliance, eliminate waste, and match the right licences to your workforce.