Microsoft VDI licensing for remote work. Map the rights you already own before you buy more.

Most VDI savings come before the technology choice. Map the Windows rights your E3 and E5 subscriptions already grant, fix external worker coverage, then decide between Windows 365 and Azure Virtual Desktop population by population.

Do Microsoft 365 E3 and E5 already include VDI rights?

Yes, for most users. Microsoft 365 E3 and E5 carry Windows Enterprise per user rights, which cover access to virtual Windows desktops and make the user eligible for Azure Virtual Desktop. The suites also include the Windows Enterprise, Intune and Entra ID P1 rights that Windows 365 Enterprise requires, so only the Cloud PC license is extra.

Despite that, roughly half the organizations we reviewed were paying twice. At least one population held Windows VDA or a virtual desktop bundle on top of suite rights covering the same access, bought by another team in another budget cycle. Fixing it needs only an inventory, and the duplicate subscriptions can be cut at the next anniversary or renewal.

How to check what you already own

Build the entitlement map from these sources and reconcile them before anyone raises a new order:

• Tenant licenses. Microsoft 365 admin center under Billing, then Licenses, or the Get-MgSubscribedSku cmdlet in Microsoft Graph PowerShell for counts by SKU.
• Agreement records. The Microsoft licensing statement from your reseller or account team, which shows Windows VDA, RDS CALs and Software Assurance bought outside the tenant.
• Actual use. Azure Virtual Desktop Insights and Entra ID sign in logs for who connects, and the Windows 365 pages in the Intune admin center for provisioned Cloud PCs.
• Old purchase orders. Standalone Windows VDA and third party VDI bundles often sit in a project or regional budget, outside the central Microsoft agreement.

Any user who appears in the VDA or bundle list and also holds E3 or E5 is a candidate for removal. Confirm the edge cases first, such as users whose only device is a thin client or who sit in another tenant.

When does per user licensing beat per device for remote workers?

Per user wins whenever one person works across more devices than one device serves people. Per device wins where several people share a machine. Most organizations have both groups, plus a third on thin clients, so they need several licensing models at once.

Why the 2019 default no longer fits

Per device licensing made sense when an office had shared workstations, one machine per desk and fewer machines than people. Hybrid work reversed that ratio, so a knowledge worker with a laptop, a home desktop and a tablet now needs three device licenses or one user license.

The policy that was efficient in 2019 is expensive today, and most organizations never revisited it. Per device is still right where headcount exceeds devices, on manufacturing floors, clinical workstations and retail kiosks, so segment by population.

A worked example of segmentation

Say you have 1,000 hybrid knowledge workers averaging three devices each, and 400 shift workers who share 120 kiosks. Count each population both ways before you choose:

The segmented answer is 1,120 licenses: 1,000 per user plus 120 per device. Either single default costs more, and the gap grows as hybrid workers add devices. User and device SKUs carry different unit prices, so price each line from your own agreement.

The suite side of this decision sits in our Microsoft 365 licensing pillar, and the hybrid work detail in Microsoft 365 licensing for remote and hybrid work.

Shift workers who need a Cloud PC

For shift workers who need a personal cloud desktop, look at Windows 365 Flex, formerly Windows 365 Frontline. In dedicated mode one license provisions up to 3 Cloud PCs with one active session at a time. Three shifts of 30 people can therefore share 30 licenses among all 90 workers, provided the shifts do not overlap.

Thin clients without a qualifying Windows license

Call center thin clients lack a qualifying Windows version. Standalone Windows Enterprise per user needs the user to be the primary user of a qualifying device, so it fails when a thin client is their only device. For on premises VDI, license the thin client with Windows VDA per device or the user with Windows VDA per user.

Azure Virtual Desktop works differently. Users with Microsoft 365 E3, E5, F3 or Business Premium, or Windows VDA per user, can connect from endpoints that do not run Windows Pro, so check which platform the thin clients reach before you buy device subscriptions.

How should contractors, outsourcers and offshore staff be licensed for VDI?

License them through your own agreements, or accept their employer's coverage only after you have verified it in writing, population by population. Assuming the supplier handles it was the most common finding in our remote work reviews. Coverage was wrong in 4 of 10 organizations and accounted for most of the audit exposure we found.

Treat it as risk rather than cost. Our wider Microsoft audit defense work points the same way: unmanaged cloud consumption drove 30 to 50 percent of disputed amounts, and external identities on your tenant are cloud sprawl with a compliance obligation attached.

The external user price does not cover contractors

Azure Virtual Desktop offers per user access pricing for external users, billed monthly through your Azure subscription. Microsoft means customers you serve with a SaaS application, and it is not available for Windows Server session hosts. Contractors and vendors working for you count as internal users and need the same eligible licenses as employees.

What to write into outsourcing and staffing contracts

Every supplier whose people touch your desktops or your Microsoft 365 tenant needs these points settled in the contract:

1. Who licenses. Name the party that supplies the Windows, Microsoft 365 and RDS rights for each supplier population, and the SKUs.
2. Who proves it. Require the supplier to produce license evidence within a set number of days on request, and to keep it for the life of the contract.
3. Who pays findings. If an audit finds the supplier's population unlicensed, the supplier pays the license cost and any back charge, and indemnifies you for it.
4. Who reports changes. A monthly joiner and leaver list for every account with access to your tenant. External populations churn faster than employee headcount, and a list that was right at the last true up is often wrong today.

Is Windows 365 or Azure Virtual Desktop cheaper?

It depends on user density and on how well you run the platform. In our cost models the curves crossed at around three users per vCPU equivalent with scheduled scaling. Above that pooling ratio Azure Virtual Desktop won, and below it the flat Windows 365 subscription did.

Organizations that modeled both services against real usage profiles cut virtual desktop cost by 20 to 35 percent compared with defaulting to either. Most landed on a mix. The density test works for planning because it measures how hard each host works, which headcount cannot show.

What each service charges for

What does optimizing Azure Virtual Desktop require?

Left unoptimized, Azure Virtual Desktop routinely costs more than the flat subscription. Optimized on pooled workloads, it routinely costs less. The work is specific:

• Autoscaling host pools on a schedule, so hosts shut down outside working hours.
• Right sized machine families chosen from the load you measure in each host pool.
• Reserved capacity or savings plans on the base load that runs every day.
• Profile storage tiering for FSLogix containers, so idle profiles do not sit on premium storage.

Why the platform team should not pick the desktop service first

The standard advice treats Windows 365 against Azure Virtual Desktop as an architecture decision for the platform team. We disagree, because in our reviews two commercial facts that come before the architecture mattered more: duplicate entitlements and unlicensed external workers. Settle those first, then decide the desktop service population by population.

That last decision turns on whether your team can run Azure Virtual Desktop well enough to earn the lower cost. Until it can, Windows 365 is the cheaper choice for stable populations. Our Windows 365 against AVD licensing comparison covers the product differences.

Which server licenses do VDI session hosts still need?

Windows Server session hosts need Remote Desktop Services client access licenses. On Azure Virtual Desktop, each user of a Windows Server host needs an RDS CAL with active Software Assurance, per user or per device, or an RDS User Subscription License. The same applies on premises, including Citrix or VMware Horizon on Windows Server.

Cloud desktop proposals tend to leave these out because the usual design runs Windows 11 Enterprise multisession, which needs no RDS CAL. Published app farms and legacy host pools on Windows Server bring the requirement back, and the gap tends to surface during an audit. See our guide to Azure RDS licensing for the detail.

Map what you already own and fix the external populations before you compare desktop services. Most of the money sits in those two steps.

What have we seen in Microsoft VDI licensing reviews in 2024 and 2025?

Across roughly 25 to 35 remote work licensing reviews in 2024 to 2025, three patterns decided where the money went. Each had an organizational cause that is easy to spot once you look for it:

• Paying twice. VDI projects were funded from infrastructure budgets while suite licenses sat with procurement, and neither team checked the other's list.
• External coverage wrong. Business units signed supplier contracts with no licensing clause, and offshore teams joined the tenant without anyone updating the count.
• Modeling paid. The savings went to organizations that collected connection data per population before choosing a desktop service, and the resulting mix beat either single default.

What the account team and your suppliers will say, and how to answer

Expect some version of these lines from Microsoft, a reseller or an outsourcer:

• "Windows 365 is simpler, so move everyone." It is simpler to run. Ask for the per user cost at your measured density on both services before any population changes platform.
• "Our people are covered under our own Microsoft agreement." Ask which agreement, which SKUs and which clause allows those licenses to be used on your hosts. Until that is in writing, count them as yours.
• "Buy Windows VDA for the new VDI users." Ask for the list of those users and compare it with your E3 and E5 assignments. Anyone on both lists is already licensed.
• "Cloud desktops remove the server licensing." That holds only for Windows 11 or 10 multisession hosts. Ask for written confirmation that no Windows Server session hosts are in scope.

What to do next

1. This month. Map what your existing subscriptions already grant before you buy anything for virtual desktops, and list every Windows VDA and VDI bundle held by a user who also has E3 or E5.
2. Within 60 days. Inventory every external population with virtual desktop or Microsoft 365 access, decide per population whether it runs on your licenses or on verified supplier coverage, and write down who licenses, who proves it and who pays findings.
3. Before the next true up. Segment by usage shape so each group gets per user, per device or Windows VDA coverage, and drop the duplicates. The M365 license optimizer shows where suite assignments and actual use diverge.
4. Before choosing a desktop service. Model Windows 365 and Azure Virtual Desktop against a month of real usage for each population, and test each one against the density crossover described above.
5. For every Windows Server host. Confirm RDS CAL with Software Assurance or RDS User Subscription License coverage for each user.
6. Every quarter. Review external populations, because the obligation follows your tenant wherever the person sits. Our Microsoft practice can run the entitlement mapping with you.

Frequently asked questions