Remote Desktop Services (RDS) Licensing: CALs, Cloud Alternatives, and Enterprise Strategy

Remote Desktop Services (RDS) Licensing

Remote Desktop Services (RDS) Client Access Licenses (CALs) are required for each user or device that accesses Windows Server remote desktops or published applications.

This article explains RDS CAL requirements in Windows Server Remote Desktop Session Host (RDSH) scenarios, how to license users vs. devices, and key considerations for CIOs and CTOs to ensure cost-effective compliance in enterprise remote access deployments.

Read Licensing Virtual Desktops and Windows 365 for CIOs.

RDS CAL Requirements

RDS enables users to remotely access Windows-based applications and desktops hosted on a server. Each user or device that connects to a Remote Desktop Session Host (RDSH) server must have an RDS CAL in addition to a standard Windows Server CAL.

The Windows Server CAL permits general access to server services (file sharing, etc.), but an RDS CAL is specifically required to use the server’s GUI or remote desktop features.

In other words, even if a user is licensed to access the server’s basic services, you need an RDS CAL for that user (or their device) to open a remote app or desktop session on the server.

This applies whether you’re offering full remote desktops or just RemoteApp streaming of specific applications – either scenario counts as an RDS session that demands proper licensing. The only built-in exception is for remote administration: Windows Server allows two simultaneous remote admin connections without RDS CALs for maintenance purposes.

Beyond that, enterprises must deploy an RDS Licensing Server to issue and track CALs and configure each RDSH server in either “Per User” or “Per Device” licensing mode. (Windows Server Essentials is a rare exception, allowing up to 25 users/50 devices without CALs, but it cannot be used for typical multi-user RDSH scenarios in larger organizations.)

Importantly, when setting up a new RDSH deployment, a 120-day grace period is provided during which users can connect without CALs. After this period, the licensing server must have valid RDS CALs installed; otherwise, clients will be denied access.

In summary, for any production Remote Desktop Services environment, each connecting user or device needs both a Windows Server CAL and an RDS CAL to remain compliant.

Read Windows Virtual Licensing: VDA and Microsoft 365 E3/E5 Rights.

Per User vs. Per Device RDS CALs

Microsoft offers two licensing models for RDS CALs: Per User and Per Device. Both fulfill the same function (enabling RDS access), but they are assigned and tracked differently to suit different usage scenarios.

Below is a comparison of the two CAL types:

In practice, choosing the right CAL type comes down to how your organization’s staff uses devices. If each employee uses multiple devices (e.g., a laptop in the office, a home PC, and a tablet), then Per User CALs typically minimize total licenses and administrative overhead.

Conversely, if you have shared devices (for example, call center desktops or hospital kiosks used by many individuals on different shifts), Per Device CALs can be more cost-effective. It’s crucial to pick one model and apply it consistently for a given RDS deployment – an RDSH server must be configured in one mode or the other. You cannot mix licensing modes on the same server or pool of servers.

Also, ensure your access control approach aligns with the CAL type. For example, if you purchased Device CALs, you should restrict RDS access by device (or physical location) rather than simply by user group, to avoid a scenario where unlicensed devices connect.

Misalignment of the licensing model and how you provision access can lead to compliance gaps (e.g., having Device CALs but allowing any user on any device to connect undermines the intent and could result in under-licensed conditions).

Ultimately, match the CAL model to your workforce and verify which option yields the lower license count for your scenario.

Many enterprises find a clear answer (one model is inherently more efficient given the ratio of users to devices). Still, borderline cases may require calculations or even a mix of models in separate environments.

RDS CAL Costs and Pricing Considerations

RDS CALs represent a significant investment, so CIOs and CTOs should understand their pricing and how to optimize it. Unlike some client licenses that are bundled with subscriptions,

RDS CALs are typically purchased as one-time, perpetual licenses (for a given Windows Server version) either via volume licensing agreements or authorized resellers. Per-user and per-device CALs usually cost the same. Microsoft’s retail price for a single Windows Server 2022 RDS CAL is around $220 USD.

Volume discounts are available. For instance, a pack of 5 user CALs might be listed at approximately $1,095 (Microsoft MSRP). Still, actual street pricing can be lower, often $100–$200 per CAL in multi-pack bundles, depending on the reseller and your agreement.

Enterprise Agreements and volume license programs typically negotiate better rates, especially for large quantities or bundled purchases. Table: Example RDS CAL Pricing (Windows Server 2022):

<small>¹Actual prices vary by vendor, volume, and region. Enterprise agreement pricing can be lower than public MSRP.</small>

When budgeting, remember that RDS CALs are licensed per version of Windows Server. A CAL is valid for that version and is downwards-compatible with earlier server versions, but not upwards-compatible.

For example, a 2019 RDS CAL allows a user to connect to a 2019 or 2016 RDSH server, but it does not cover access to a 2022 server.

If you upgrade your RDSH farm to a new Windows Server release, you must buy new CALs for the new version (or have active Software Assurance to upgrade the CALs). Software Assurance (SA) on RDS CALs adds 25% or more to their cost annually.

Still, it provides rights to new version upgrades and additional benefits (e.g., license mobility to the cloud, discussed below).

Many enterprises include RDS CALs in their Microsoft Enterprise Agreement true-ups to get volume pricing and spread costs over time. It’s wise to compare the cost of SA vs. buying new CALs at upgrade cycles; SA is often justified if you plan to upgrade Windows Server versions frequently or if you want the flexibility to deploy RDS on cloud infrastructure.

Another consideration is public cloud or hosted environments: if you run RDS workloads on Azure, AWS, or a third-party cloud, Microsoft requires that you use RDS CALs with active Software Assurance (this enables “License Mobility” to legally use your licenses in cloud VMs).

Alternatively, you must acquire RDS user access rights through a Service Provider License Agreement (SPLA) if using a service provider’s infrastructure. In an SPLA, RDS is typically licensed on a monthly fee per user, often referred to as an RDS Service Agreement License (RDS SAL).

In short, bringing your own RDS CALs to the cloud is allowed only with SA. On-premises deployments do not require SA – you can use perpetual CALs as long as you stick to the licensed server version, though you’ll need to purchase new CALs when you eventually move to a newer Windows Server OS.

Finally, note that some Microsoft 365 plans include virtualization rights for Office applications on a server; however, this does not eliminate the need for RDS CALs if you’re using Windows Server RDSH.

For example, Microsoft 365 E3/E5 users can legally use Office ProPlus on a shared RDSH server without a separate license for Office. However, to access that server itself via RDS, they still need an RDS CAL (unless only Office apps are run and Microsoft’s narrow Office roaming rights apply).

This is a nuanced corner case – in general, plan on needing an RDS CAL for each user or device using your remote desktop environment, regardless of any other subscriptions.

Licensing External Users (Customers or Partners)

For many enterprises, a remote desktop environment might not only serve employees but also external users (such as business partners, contractors, or customers accessing an application). Microsoft’s licensing rules distinguish external users (non-employees) and provide a special option: the

RDS External Connector license. An External Connector is a server-based license that, once assigned to a given server, permits an unlimited number of external (third-party) users to access that server’s Remote Desktop Services without individual CALs.

This can be far more economical and manageable if you have dozens or thousands of external users.

For instance, if you’re hosting a remote software demo environment for customers, you could either purchase a CAL for each customer (which is impractical) or you could license the server with an External Connector to cover all their access.

However, external connectors are not inexpensive: they typically cost on the order of $900 per server per year (and you may need a Windows Server External Connector plus an RDS External Connector in tandem, as external users also lack regular CALs).

In scenarios with only a handful of external users, it might be cheaper to simply acquire a few standalone RDS CALs for those users (Microsoft does allow licensing external users with CALs instead of a connector; if those users leave, you can reassign their CAL after 90 days).

The break-even point depends on numbers: e.g., if you have five external users, buying 5 CALs is far less expensive than a $900 connector; if you have 500 external users, a connector is highly cost-effective.

Also, remember that external users must not be employees or onsite contractors – those still require regular CALs. Bottom line: assess your external user counts and choose either individual CALs or the External Connector accordingly.

If using connectors, budget for their recurring cost and ensure a connector license is obtained for each server that external users will access via RDS.

Compliance and Audit Risks

Microsoft software licensing is complex, and RDS CALs are a common source of concern in compliance audits. Under-licensing (having more users or devices using RDS than you have CALs for) can lead to hefty penalties and true-up costs.

Microsoft’s compliance programs and software asset audits frequently identify RDS CAL shortfalls, as organizations sometimes enable remote access quickly (especially in events such as sudden work-from-home needs) and address licensing later – a risky approach.

Penalties for non-compliance vary by region and contract. Still, enterprise agreements often stipulate back payment at 125% of the list price for any unlicensed software usage, plus possible interest at 5% or additional fees.

In severe cases (e.g., willful or large-scale infringement), legal fines can be imposed under U.S. software piracy statutes. Fines of up to $150,000 per violation are possible, although these are extreme scenarios.

Even aside from fines, the cost of purchasing the necessary CALs under audit pressure (and possibly funding the auditor’s fees if you were significantly out of compliance) can hit IT budgets hard. To avoid these outcomes, it’s critical to proactively manage and track RDS CAL usage.

RDS License Manager will prevent overuse in Per Device mode (it won’t issue more device CALs than installed), but in Per User mode, the license server is an “honor system” – it will not stop additional users from connecting even if you run out of purchased CALs.

Microsoft expects you to manually ensure the count of enabled users doesn’t exceed your entitlements.

During an audit, they may request Active Directory or RDSH logs to determine the number of unique users accessing the system. If that number is higher than your purchased per-user CAL count, you’ll be found deficient.

The best practice is to periodically run usage reports (the RD Licensing Manager has a per-user CAL usage report feature) and reconcile them with procurement. Also, maintain clear records of RDS CAL purchases (including version and quantity) and deployments.

In summary, compliance requires both the right licensing upfront and ongoing diligence. The good news is that with proper licensing, RDS provides tremendous value in enabling remote work; just be sure to treat CAL management as part of your IT governance to avoid unpleasant surprises from a software audit.

Recommendations

• Assess Your Use Case and Select a License Model: Analyze the number of users versus devices that will connect to remote desktops. Choose Per User CALs for multi-device users (e.g., employees with PCs + mobile devices) and Per Device CALs for shared machines (e.g., shift workstations). This alignment prevents over-licensing and minimizes costs.
• Inventory and Track CAL Usage: Maintain an internal license ledger. Don’t rely solely on the RDS Licensing Server’s interface – especially for Per User mode, which isn’t strictly enforced. Periodically audit the number of unique users or devices accessing your RDSH servers and ensure it does not exceed your purchased CAL count.
• Leverage Volume Licensing and SA Wisely: If you have a large user base, consider obtaining RDS CALs through a volume licensing agreement or an enterprise subscription for better pricing. Consider Software Assurance on CALs if you plan frequent Windows Server upgrades or need cloud flexibility – it can be cost-effective to stay current rather than purchasing new CALs for each version.
• Plan for Server Upgrades: Remember that new Windows Server versions require new RDS CALs. Build the cost of CAL upgrades into your project budgets when planning an RDSH farm upgrade (e.g., moving from Server 2019 to 2025). If you have SA, coordinate the timing to leverage your upgrade rights.
• Control Access to Match Licensing: Implement technical controls to ensure that only licensed users or devices can initiate RDS sessions. For example, if using Device CALs, restrict RDS access to known device hostnames or IP ranges. If using User CALs, ensure that only approved user accounts are in the Remote Desktop Users group. This prevents unintentional license violations by rogue or unplanned connections.
• Consider External User Licensing Upfront: If external (non-employee) users will need access, decide early whether to use individual CALs or an External Connector. Generally, use CALs for small numbers of externals; use the Connector license for large external audiences. Don’t forget that external connectors are per server – a factor that influences architecture decisions (it might be cheaper to have one external-facing RDS server with a connector than to allow external access to many servers).
• Include RDS in Cloud and DR Planning: If you intend to run remote desktops on cloud VMs or have a disaster recovery site, ensure your licenses are properly covered for those scenarios. This could mean having Software Assurance (for license mobility to cloud or DR), or using Azure Virtual Desktop alternatives for cloud (which use a different licensing model). Always verify Microsoft’s current rules before deploying RDS in any non-traditional environment.
• Educate and Communicate: Ensure that your IT operations, procurement, and compliance teams understand that RDS requires its own CALs. It’s a common oversight to assume a Windows Server license alone covers remote use. Regularly communicate the licensing requirements internally, especially when new remote access projects start, or user counts change.
• Consult Experts for Complex Scenarios: When in doubt, engage Microsoft licensing specialists or qualified third-party advisors for guidance. For example, if you’re unsure about licensing in a hybrid cloud setup or a merger that expands your user count, an expert review can clarify the requirements. This small investment can prevent costly missteps, given the steep penalties of non-compliance.

FAQ

Q1: What exactly is an RDS CAL, and when do we need one?
A: An RDS CAL is a “Remote Desktop Services Client Access License” – a license that permits a user or device to connect to a Windows Server and use its Remote Desktop Services (including remote GUI, applications, or desktops). You need an RDS CAL for each user or device that will access a remote desktop or session host server. In practice, whenever you enable Remote Desktop or RemoteApp for more than administrative use on a Windows Server, you must account for RDS CALs for those users or devices.

Q2: Do we need RDS CALs in addition to regular Windows Server CALs?
A: Yes. A standard Windows Server CAL allows access to basic services on the server (such as files and print), but it does not cover remote desktop sessions. RDS CALs are an add-on requirement for using the server’s RDSH role. Typically, a remote user consumes two licenses: a Windows Server CAL and an RDS CAL. (Think of it as one license to access the server and another license to use it as a remote PC.) The only exception is for two concurrent admin connections, which don’t require RDS CALs.

Q3: How do we choose between per-user and per-device RDS CALs?
A: It depends on your usage patterns. If the same employee might log in from multiple different devices (office PC, home laptop, tablet, etc.), a per-user CAL is more efficient – one license covers that user across all their devices. If you have shared stations (e.g., shift workers using generic PCs or terminals), Per Device may be a better option – one license per machine covers anyone using that machine. In essence, choose Per User when the number of users exceeds the number of devices (i.e., many devices per person or a mobile workforce), and choose Per Device when the number of devices exceeds the number of users (i.e., more people than devices or high device sharing). Also consider management: Per-user CALs require you to keep track of which users are licensed (it’s not enforced automatically), whereas server-based CALs track per-device licenses as devices connect.

Q4: How much do RDS CALs cost, and what’s the best way to purchase them?
A: Exact pricing varies, but ballpark ** ~$100 to $200 USD per CAL ** is common, with Microsoft’s retail price around $220 for a single CAL (prices often come down with volume). Microsoft sells RDS CALs individually or in packs (5-pack, 50-pack, etc.). Large enterprises typically purchase them through a Volume Licensing agreement or as part of an Enterprise Agreement. The best approach is to work with your Microsoft reseller or licensing provider to obtain volume pricing – the more you buy (or if you bundle with other licenses), the better the discount typically is. Additionally, consider whether you want Software Assurance (SA) on those CALs – SA incurs an annual cost but provides free upgrades to new versions and flexibility to migrate licenses to cloud servers. In any case, always update your CAL count when your user or device count grows to avoid falling out of compliance.

Q5: What about external users (e.g., clients or partners) who need to access our RDS system?
A: You have two choices: buy RDS CALs for each external user (just as you would for an employee), or purchase an External Connector license for the server. The External Connector is a single license that covers unlimited external (non-employee) users on that one server. It’s expensive (roughly the cost of a few hundred dollars per server per year, often ~$900/year), so it’s cost-effective only if you have a lot of external users. If you have only a handful of external users, it may be cheaper and simpler to treat them like regular users and assign them RDS CALs. By Microsoft’s definition, external users are people who are not your employees or on-site contractors. One additional note: if those external users also access other services on the server (not just RDS), you may also need a Windows Server External Connector. Evaluate the numbers and choose the option that minimizes cost while staying compliant.

Q6: Is there a grace period for RDS licensing or a way to trial it?
A: Yes. When you first enable the Remote Desktop Session Host role on a Windows Server, Microsoft provides a built-in grace period of 120 days, during which the server will accept unlimited RDS connections without contacting a license server. This is designed for evaluation or initial setup. Before that period ends, you need to install an RD Licensing Server and activate your RDS CALs. After 120 days (or if you disable the grace via configuration), the RDSH server will refuse client connections if it can’t obtain a CAL from a license server. Always use the grace period to get your licensing in order; it’s not a permanent free pass.

Q7: Do RDS CALs expire, or do we need to renew them periodically?
A: Standard RDS CALs are perpetual licenses – once purchased, they don’t expire, and you don’t pay annual fees for them (unless you optionally added Software Assurance). The CALs issued to devices/users by the license server have an expiration date in the technical sense (for instance, a Per Device CAL might show a validity of 52-89 days, after which it auto-renews if the device reconnects, and Per User CALs show 60 days in the UI with auto-renewal), but this is just how the license server tracks active usage. It doesn’t mean you lose the license – it’s simply how the server re-issues or confirms licenses. You do not need to “renew” RDS CALs like a subscription as long as you stay on the same Windows Server version. If you upgrade to a new version of Windows Server, you’ll need CALs for that version (the old CALs won’t cover the new server). Additionally, if you purchased Software Assurance (SA) with your CALs, SA must be renewed annually to remain active. However, the underlying CALs will remain yours even if SA lapses, as they’ll only be valid for the last version you were licensed for.

Q8: We have two data centers and disaster recovery servers – can we use the same RDS CALs for a backup server?
A: Generally, yes, if it’s truly a passive backup scenario. An RDS CAL isn’t tied to a single server – it’s assigned to a user or device for the right to access any instance of that Windows Server version in your environment. Therefore, you don’t need to double-purchase CALs for a secondary server as long as it serves the same users and devices. However, make sure your license server infrastructure is set up to cover both environments (you might deploy a license server in each data center or have it centrally if network connectivity allows). If your DR environment is active (used for production load balancing, not just standby), those users and devices still count toward your CAL usage. Additionally, if the DR site is located in the cloud or a different country or region, ensure that no special restrictions apply – typically, it’s fine as long as it’s for your organization’s use. The key is that one user connecting to either primary or DR uses one CAL total, not one per site.

Q9: Do Azure Virtual Desktop or Windows 365 Cloud PC require RDS CALs?
A: No, Azure Virtual Desktop (AVD) and Windows 365 employ different licensing models. Those services are essentially Microsoft’s cloud-managed virtual desktop offerings, and they are licensed via user subscriptions (for example, AVD usage rights come with certain Microsoft 365 licenses, and Windows 365 is a per-user per-month subscription). You do not need to purchase traditional RDS CALs for users of Azure Virtual Desktop or Windows 365. RDS CALs are only required when setting up your own Windows Server VMs (whether on-premises or in cloud IaaS) to host multi-user sessions. In the AVD scenario, Microsoft handles the underlying RDS licensing as part of the service. This is one reason some companies consider AVD/Windows 365 – it shifts the licensing model to per-user subscriptions, avoiding the need to manage RDS CAL counts. That said, if you run a hybrid environment where you have some on-premises RDSH and some AVD, you’ll still need CALs for the on-premises portion. Always evaluate the total cost: in a pure cloud scenario, no RDS CAL line item appears, but you’re paying Microsoft in other ways (cloud resource costs or user subscriptions).

Q10: What are the consequences if we are caught without enough RDS CALs?
A: Falling out of compliance can lead to steep financial penalties and forced purchases. In a license audit, Microsoft (or a third-party auditor) will determine how many users/devices were accessing RDS versus how many CALs you have purchased. If you’re short, you’ll typically be required to purchase the necessary CALs retroactively – often at list price or a higher “penalty” rate. For enterprise customers, Microsoft’s agreements might require you to pay 125% of the cost of any shortfall, plus backdated Software Assurance on them, for example. In extreme cases, if it’s seen as a willful violation, legal action could involve fines. However, more commonly, it’s a substantial true-up bill and potentially having to fund the audit costs if you were significantly non-compliant. Indirectly, it could also damage your standing with Microsoft – complicating future negotiations. Additionally, there’s the disruption factor: an audit consumes time and resources from your team. In short, the cost of compliance is far less than the cost of being caught non-compliant. It’s better to regularly verify that you have sufficient CALs than to risk not being audited.

Read more about our Microsoft Optimization Services.

Would you like to discuss our Microsoft Optimization Services with us?

Please enable JavaScript in your browser to complete this form.

Name *

First

Last

Email *

Company

Message *

Submit