Azure RDS Licensing: What ITAM Professionals Need to Know

Azure RDS Licensing

Executive Summary: Azure RDS licensing can be a complex topic for IT asset management in global enterprises.

In Azure, Remote Desktop Services (RDS) still require client licensing – moving to the cloud doesn’t eliminate the need for RDS licenses.

This advisory provides a comprehensive overview of how Azure RDS licensing works, including options for licensing models, cost implications, and best practices to ensure compliance.

It provides enterprise-focused insights and actionable guidance to help ITAM professionals effectively manage Azure RDS licensing.

Azure RDS Licensing Basics

Azure allows you to run Windows Server virtual machines, but it does not include RDS licenses by default.

Suppose users connect to a Windows Server on Azure for a graphical desktop or applications (via RDS/Remote Desktop Protocol).

In that case, each user or device must be licensed for RDS just as they would on-premises.

Key points to understand:

• RDS CAL Requirement: Every user or device accessing Remote Desktop Services on Azure needs an RDS Client Access License (CAL) or equivalent. This requirement applies even if Windows Server CALs are not needed in Azure (Windows Server CALs are exempt on Azure VMs, but RDS CALs are not). In short, running RDS on an Azure VM still obligates you to have proper RDS CALs for those users.
• User CAL vs. Device CAL: Microsoft offers RDS CALs in two forms – per User and Device. However, only RDS User CALs can be used for Azure deployments. Device-based CALs cannot be assigned to cloud environments. For Azure scenarios, you’ll license RDS per user (covering each user’s access from any device).
• No Bundled RDS in Azure: Unlike some Azure services that include licensing in the VM pricing, there is no pay-as-you-go RDS CAL available in Azure. Microsoft doesn’t sell RDS CALs as part of Azure subscriptions. You must acquire the licenses separately (through volume licensing or service provider programs) and ensure they cover your Azure usage.

These basics mean that ITAM teams should treat an Azure VM with RDS roles just like an on-prem RDS server when it comes to licensing – nothing is automatically covered aside from the Windows Server OS license itself.

Licensing Models and Options in Azure RDS

Enterprises have several options for licensing RDS for Azure deployments.

The choice of model will affect cost structure and compliance. Below is a comparison of key RDS licensing options for Azure:

Microsoft has announced that the SPLA model for RDS (RDS SALs) will only be available through September 30, 2025, and future cloud service provider licensing for RDS may change after that date.*_

Explanation of Options:

• RDS User CAL with Software Assurance (SA): Enterprises can purchase RDS User CALs (perpetual licenses) and must maintain active SA on them to use on Azure. The Software Assurance benefit (often called License Mobility) allows a licensed user to access RDS on Azure VMs. With this model, you pay upfront for the CAL (typically in a volume license agreement) and an annual SA fee (around 25% of the license price) to keep cloud rights active. This is ideal for long-term internal use, as it often has a lower long-term cost per user when your workforce is stable.
• RDS User Subscription License (SL): Rather than buying perpetual CALs, organizations can opt for subscription-based licenses for RDS. These are available via Microsoft’s Cloud Solution Provider (CSP) program or volume licensing as a per-user, per-month, or per-year license. An RDS User SL provides the same rights as a CAL with SA, but on a pay-as-you-go basis. This model can be convenient if you prefer operational expenses or need flexibility without a long-term commitment to SA.
• RDS Subscriber Access License (SAL via SPLA): If using a third-party service provider or a hosted solution on Azure, the provider can license RDS via SPLA. An RDS SAL is a monthly license that service providers charge per user. SALs are typically used when an organization doesn’t have its volume licenses or when external users need access. However, SALs are time-limited in the Azure context – Microsoft’s current policies allow SPLA usage for RDS on Azure only until the end of September 2025. Beyond that, how service providers offer RDS in Azure may change. Enterprises leveraging this option should plan for a transition (e.g., moving to their CALs or another solution) as this deadline approaches.
• RDS Device CAL: This license ties to a device rather than a user. It’s useful on-premises for shared devices, but in Azure, it’s not permitted. The license mobility to the cloud does not extend to device CALs. Even if your company owns RDS Device CALs, those cannot legally cover Azure usage. In practice, Azure RDS environments must be covered with per-user licensing models.

Takeaway: For Azure, the per-user licensing model is king – either via user CALs with SA or via subscription/SPLA.

Decide upfront which model fits your needs: buy-and-maintain licenses for each user (with SA for cloud use), or “rent” licenses per user as needed. Each has cost and flexibility implications as we explore next.

Azure RDS vs. Azure Virtual Desktop (AVD)

Many enterprises are now considering Microsoft’s Azure Virtual Desktop (AVD) as an alternative to traditional RDS on Azure VMs.

Azure Virtual Desktop (formerly known as Windows Virtual Desktop) is a platform that delivers virtual Windows 10 or Windows 11 desktops from Azure.

It has different licensing requirements, which can simplify RDS licensing concerns:

• No RDS CAL Required for AVD: AVD runs on Windows 10/11 multi-session operating systems (or Windows 10 Enterprise for single user). These are classified as “desktop OS” environments, so RDS CALs are not needed for users to access them. This is a major difference – if you use AVD with Windows 10/11 sessions, you avoid the requirement for RDS CALs entirely.
• Per-User AVD Licensing: Instead of RDS CALs, each user of Azure Virtual Desktop must have an eligible Windows license, typically covered by existing Microsoft 365 or Windows Enterprise subscriptions. For example, users licensed with Microsoft 365 E3/E5, Windows 10 Enterprise E3/E5, or equivalent are already entitled to use Azure Virtual Desktop. In practice, most large enterprises already provide these licenses to employees, so there’s often no incremental cost to license AVD users beyond what you already pay for Microsoft 365. You essentially only pay for the Azure infrastructure (VM compute, storage, etc.) when using AVD.
• When to Use Traditional RDS: Despite the benefits of AVD, there are scenarios where traditional RDS on Windows Server VMs is still used. For instance, if you need certain server-only applications or you have an existing RDS deployment to lift-and-shift to Azure, you might continue with RDS on Server OS. In these cases, you must ensure RDS CAL/SL coverage as discussed. However, suppose your use case is providing desktop apps or full desktops to internal users. In that case, AVD can be attractive because it simplifies licensing and management (fewer licenses and no license servers for RDS CALs).
• Cost Consideration: From a licensing cost perspective, AVD can be very cost-effective if your users are already licensed via Microsoft 365. It eliminates the need to purchase separate RDS CALs or subscriptions for those users. The trade-off is that AVD requires specific Azure configurations and may incur Azure compute costs differently than a traditional RDS VM deployment. ITAM professionals should compare the total cost of ownership, considering whether to pay for RDS CALs for a Windows Server VM versus using AVD with existing licenses and Azure usage. Often, AVD wins on simplicity if license prerequisites are met.

Example: A global firm with 500 users, all on Microsoft 365 E5, could opt to use Azure Virtual Desktop for their remote access needs.

They would not need to procure any RDS CALs, since each user’s M365 license entitles them to AVD. The firm would only pay for the Azure VM hours and storage.

By contrast, if they had used traditional RDS on Windows Server VMs, they would need 500 RDS CALs (plus SA) or equivalent subscriptions, which would significantly increase licensing costs and compliance tracking efforts.

In summary, consider AVD as a modern alternative to hosting RDS on Azure, especially if you already license users with Microsoft 365. It can reduce the complexity of Azure RDS licensing and shift the focus to optimizing Azure resources instead.

Cost Drivers and Optimization Strategies

Licensing for Azure RDS has direct cost impacts that ITAM and finance teams must manage.

Key cost drivers include the type of RDS license model chosen and the efficiency with which you utilize those licenses.

Below we break down cost considerations and offer optimization tips:

• Upfront vs. Ongoing Costs: Purchasing RDS User CALs with SA involves an upfront capital expense (for the CAL) and ongoing yearly fees (SA maintenance). For example, a single RDS User CAL might list around $200, with an annual SA cost of ~$50. Over three years, the total per-user cost would be approximately $350. In contrast, subscription models (CSP or SPLA) spread the cost as operational expense – e.g., an RDS SAL might cost roughly $8–$15 per user per month (rates vary by provider). Over three years, that could total approximately $ 360 per user. The break-even point for buy-versus-rent often comes around the 2-3 year mark: if a user will need RDS access long-term, owning a CAL with SA can be more economical than paying monthly fees. However, if your user count fluctuates or you only need short-term remote access (e.g., contractors or seasonal workers), subscriptions give flexibility to scale down without sunk costs.
• Software Assurance is Mandatory for Mobility: Remember that if you go the CAL route, only licenses with active SA can be used in Azure. SA adds 25% to the license cost annually, which should be factored into your budget. The benefit is it grants “license mobility” to use that CAL in the cloud. Ensure your procurement includes SA on all RDS CALs intended for use with Azure. Lapsed SA would mean the CAL is no longer valid for Azure, potentially forcing a switch to subscriptions or new purchases – an avoidable cost if managed proactively.
• Unused Licenses = Wasted Spend: A common cost pitfall is over-provisioning RDS CALs or SALs. If you’ve purchased 100 CALs but only 80 users actively use RDS, you have 20 idle licenses (sunk cost). Similarly, under SPLA, if 100 users are authorized for RDS, you pay for all 100 each month, even if only 80 connect. Optimization tip: perform regular usage audits. Reassign or reclaim RDS User CALs that are no longer needed (e.g., for users who left the company). For SPLA/subscription, adjust the licensed user count downwards if usage drops. Close monitoring and true-up/true-down adjustments can significantly reduce waste.
• Azure Hybrid Benefit vs. Pay-as-You-Go: Although not directly related to RDS CALs, the cost of the underlying Windows Server in Azure is a key consideration. Azure VMs running Windows have a built-in OS cost. Enterprises with Windows Server licenses and Software Assurance can utilize Azure Hybrid Benefit to save on Azure VM costs, effectively reusing their on-premises licenses in Azure. This doesn’t eliminate RDS CAL requirements, but it reduces the total cost of an RDS VM in Azure. Always factor in both the infrastructure cost (VM size, hours, etc.) and the licensing cost (RDS CALs) when evaluating the budget for an Azure RDS environment.
• Leverage Existing Investments: If your organization has already invested in RDS CALs for on-premises, leverage them. Through an Enterprise Agreement, you might already own plenty of RDS User CALs. By adding SA (if not already included), you can bring those to Azure at minimal incremental cost, instead of paying again for new licenses. This can be a significant saving, as it turns a sunk on-prem cost into a cloud entitlement. Conversely, if you lack existing licenses, you might initially negotiate a subscription model via CSP and then true up permanent licenses at your next EA renewal, when you can take advantage of volume discounts.

In summary, optimize costs by selecting the appropriate licensing model for your usage pattern, tracking and adjusting license counts to prevent overpaying for unused capacity, and utilizing programs like Azure Hybrid Benefit and existing entitlements to their fullest potential.

A proactive approach can turn Azure RDS from a surprise expense into a well-managed cost item.

Compliance and Common Pitfalls

Ensuring compliance with Azure RDS licensing is crucial – non-compliance can result in audit penalties and unexpected costs.

Global enterprises should be particularly vigilant given the scale of usage.

Here are common pitfalls and how to avoid them:

• Assuming Azure Covers RDS: One major mistake is assuming that because Azure VM pricing includes the Windows Server license, it also covers RDS usage. It does not. Companies that deploy Remote Desktop on Azure without acquiring RDS CALs or subscriptions are out of compliance with the licensing requirements. This can be uncovered in a Microsoft audit, leading to back-charging of licenses (often at list price plus penalties). Always explicitly account for RDS licensing needs in any Azure deployment plan – it’s never automatically included.
• License Mobility Form & 90-Day Rule: When you bring your own RDS CALs with SA to Azure, Microsoft requires a License Verification form to be submitted (usually within 10 days of deploying the RDS workload). This is part of the license mobility process, notifying Microsoft that you’re using your volume licenses on Azure. Additionally, once assigned to Azure, those CALs are effectively “attached” to Azure (or a specific service provider) for a minimum of 90 days. The pitfall here is failing to submit the form or trying to reassign licenses too frequently. Ensure your team completes the license mobility paperwork on time for compliance records, and plan your deployments to minimize the frequency of license transfers between on-premises and cloud environments.
• Mixing User and Device CAL Misuse: Some organizations have a mix of RDS User and Device CALs from on-prem. In Azure, the use of device CALs is not permitted; however, administrators sometimes mistakenly apply them. This creates a compliance gap. The safe practice is to convert device CAL usage to per-user when migrating to Azure. Microsoft’s terms do not provide a mechanism for device CALs in shared cloud environments, so don’t count any device CALs towards your Azure licensing.
• External User Access: If external users (e.g., contractors, partners, clients) access an RDS environment on Azure, they also need licensing. A common pitfall is overlooking external user licensing, since standard RDS CALs purchased by an enterprise only cover internal users/employees. Microsoft offers an External Connector license for on-prem servers to allow unlimited external user access per server, but in Azur,e a more typical approach is to use RDS SALs via a provider for external users or ensure each external user has their own RDS User CAL with SA assigned. Be mindful of this in compliance terms – external use of RDS should be explicitly addressed either contractually or via proper licenses, otherwise it could be a violation.
• Audit Readiness: Microsoft or its auditors can review your Azure usage and compare it against your licensed entitlements. Maintain accurate records of the number of users with access to RDS in Azure and the licenses that cover them (e.g., CALs with SA, CSP subscriptions, etc.). One pitfall is poor record-keeping – not knowing how many CALs you have or who they’re assigned to. Use Azure logs or RDS license server reports to track actual usage and reconcile it with procurement records. This way, if an audit occurs, you can demonstrate compliance.
• Upcoming Policy Changes: As noted, the SPLA RDS SAL option is slated to change after September 2025. Failing to stay updated on Microsoft’s licensing policy changes poses a risk. An enterprise may continue using a deprecated model, leading to compliance issues. ITAM pros should regularly review Microsoft’s Product Terms and announcements for any changes in RDS licensing rules for Azure. Adapt your licensing approach if new rules or offerings (for example, a new type of subscription or a different mechanism replacing SALs) come into effect.

By anticipating these pitfalls and implementing robust management controls, you can avoid common compliance traps. In licensing, ignorance is not a defense – it’s better to be proactive and double-check that every Azure RDS deployment is properly licensed and documented.

License Planning and Management in Enterprise Agreements

Managing Azure RDS licensing at enterprise scale isn’t just about day-to-day compliance; it also involves strategic planning and negotiation with Microsoft or partners.

Here are some insights on incorporating RDS into your broader IT asset management strategy:

• Enterprise Agreement (EA) Negotiation: If you’re renewing a Microsoft EA or a similar volume licensing agreement, factor RDS CALs into your negotiations. Enterprise customers can often secure better pricing on RDS CALs (and SA) as part of a bundled agreement. If your organization is shifting more workloads to Azure, communicate the need for license mobility rights – ensure that RDS User CALs with SA are included in the EA renewal. You might negotiate for a certain number of RDS CALs at a discount or get promotional offers for transitioning to Azure (Microsoft has occasionally offered incentives for moving remote desktops to Azure).
• Cloud Solution Provider (CSP) Flexibility: Some enterprises employ a hybrid approach, owning some CALs and utilizing CSP subscriptions for burst capacity. Work with a Microsoft CSP partner to establish a structure that allows you to add or remove RDS user subscriptions every month as your needs change. This can be a cost-effective strategy to handle variable demand without overcommitting in your EA. Essentially, negotiate a low base in your EA (for steady-state users with CALs) and leverage CSP for overflow or transient users.
• Licensing Transition Plans: Given the potential end-of-life of SPLA RDS SALs in 2025, have a transition plan if you currently rely on service provider licensing. You may need to bring that licensing in-house via CALs or Microsoft’s new model (if one is introduced). Early engagement with Microsoft account reps or licensing specialists can help clarify your options before the deadline. It’s wise to budget now for purchasing additional RDS CALs or shifting to AVD if that aligns better with future rules.
• Budgeting for SA and Renewals: RDS CALs with SA require renewing the SA every year (or at EA renewal cycles). Plan these renewal costs in your IT budget. Skipping SA to save money could backfire if those users still need Azure access – without SA, the CALs lose their cloud rights, and you’d have to buy new licenses or switch to monthly subscriptions at potentially higher cost. Include RDS SA costs in cost forecasts and treat them as non-negotiable for any CAL used in Azure.
• Monitoring License Utilization: Use tools and processes to continuously monitor how RDS licenses are being used. This not only ensures compliance (as discussed) but also feeds into planning. If you notice a trend (e.g., RDS usage increasing by 20% annually), you can proactively include additional licenses in your next agreement rather than reactively scrambling later. Conversely, if usage is dropping (say due to moving to AVD or attrition), you might reduce the RDS component in the next true-up. Align your license inventory with actual needs to avoid shelfware or shortages.
• Vendor Management and Support: Engage regularly with Microsoft or a licensing partner. Complex licensing questions or unique use cases (such as covering a partner access scenario or using third-party multi-tenant environments) can often be clarified by Microsoft’s licensing desk or through official documentation. Having a clear, written confirmation of your licensing positions can be valuable in the event of a dispute. When negotiating contracts, ask for clarifying terms in writing for Azure usage of RDS – for instance, an addendum that explicitly states your rights to use RDS CALs on Azure under your agreement. This can prevent misunderstandings later.

By treating Azure RDS licensing as a strategic component of your cloud migration and contract negotiations, you turn it from a headache into another lever for cost optimization and value.

The goal is to align your licensing model with your business needs – and revisit that alignment as those needs evolve.

Recommendations (Expert Tips)

• Maintain Software Assurance: Always keep RDS User CALs under active SA if you intend to use them in Azure. This ensures you retain cloud usage rights and avoid compliance gaps.
• Assess AVD Viability: Evaluate Azure Virtual Desktop for your remote desktop needs. If your users are eligible via existing licenses, AVD can eliminate separate RDS CAL costs and simplify management.
• Choose the Right Model per User Profile: Use perpetual CALs for steady, long-term users and subscription licenses (CSP or SAL) for temporary or fluctuating users. This hybrid approach optimizes cost and flexibility.
• Monitor and Reconcile Usage: Implement a regular audit (monthly or quarterly) of Azure RDS usage vs. licenses owned. Revoke access for users not covered by licenses and re-harvest CALs from departing employees.
• Don’t Overbuy “Just in Case”: Avoid the temptation to purchase more RDS CALs than needed. Instead, leverage the ability to quickly add CSP subscriptions if demand spikes. This prevents shelfware and wasted budget.
• Include RDS in Cloud Governance: Incorporate RDS licensing checks into your cloud deployment checklist to ensure seamless integration. Whenever a new Azure VM with RDS is provisioned, have a governance step to account for how that instance’s user access will be licensed.
• Stay Informed on Licensing Changes: Designate someone on the ITAM team to track Microsoft licensing news (product terms updates, blog posts from Microsoft, etc.). Early awareness of changes (like the 2025 SPLA update) allows smoother transitions.
• Engage Experts if Needed: Don’t hesitate to consult Microsoft licensing specialists or third-party licensing experts for an annual review. A small investment in expert advice can prevent costly licensing mistakes or missed opportunities in your enterprise agreement.
• Utilize License Management Tools: Leverage tools (such as Microsoft’s License Manager or third-party SAM tools) that can help track RDS CAL assignments and Azure usage. Automation reduces the chance of human error in compliance tracking.
• Plan for External Access Separately: If you have external users needing RDS access, treat their licensing as a separate line item. Whether via External Connector licensing or service provider SALs, ensure it’s explicitly managed – don’t assume your internal CALs cover non-employees.

Checklist: 5 Actions to Take

1. Inventory Your RDS Entitlements: Compile a list of all RDS CALs, subscriptions, and eligible Microsoft 365 licenses your organization currently has. Ensure you are aware of the counts and SA status.
2. Map Azure Usage: Identify all Azure VMs or services where RDS is enabled (e.g., any Windows Server with Remote Desktop Services roles or Azure Virtual Desktop deployments). Document the number of users connecting and whether they are internal or external.
3. Align Licenses to Usage: For each Azure RDS deployment, assign the appropriate licenses from your inventory. For example, 50 users on Azure VM “X” are covered by 50 RDS User CALs (SA active), and 20 contractors on VM “Y” are covered by 20 RDS SALs via the provider. Plug any gaps by acquiring additional licenses or subscriptions immediately.
4. Submit Compliance Forms: If you are using volume licenses (CALs with SA) on Azure and haven’t done so, file the License Mobility Verification form with Microsoft for those deployments. Mark your calendar for the 90-day renewal check – don’t reassign those licenses elsewhere too soon.
5. Optimize and Plan: Based on the current state, determine any necessary changes. For instance, if some RDS CALs are unused, plan to reduce purchases at the next renewal. If Azure Virtual Desktop could replace some RDS setups, schedule a pilot. Also, budget for upcoming needs (like replacing SALs by 2025). Review these plans quarterly to adjust for any organizational changes.

FAQ

Q: Do we need RDS CALs for users accessing a Windows Server VM on Azure?
A: Yes. Any user accessing a Remote Desktop session hosted on a Windows Server in Azure requires an RDS CAL (with active SA) or an equivalent subscription license. Azure VM pricing includes the Windows Server license, but not the RDS user licenses – those must be obtained separately.

Q: Can we use our existing on-prem RDS CALs for Azure deployments?
A: You can bring your own RDS CALs to Azure if those CALs have active Software Assurance. This Software Assurance grants “extended rights” to use the CAL in a cloud environment. You’ll need to submit a License Mobility verification to Microsoft. Note that RDS CALs without SA, or Device CALs, cannot be used for Azure sessions.

Q: What’s the difference between an RDS CAL and an RDS SAL in the cloud context?
A: An RDS CAL is a client access license you buy (usually per user) and own, typically with SA for cloud use. An RDS SAL is a subscription (rented) license through a Service Provider License Agreement. In Azure, an enterprise would use SALs if it is getting RDS as a service from a third-party provider or if it opts for a CSP subscription model. Functionally, both cover a user’s rights to use RDS, but CALs are a one-time purchase (capex) with ongoing SA, whereas SALs are pay-as-you-go (opex). Keep in mind SPLA SALs on Azure are expected to retire or change after 2025.

Q: How do we license external users or third parties who need RDS access in our Azure environment?
A: External (non-employee) users aren’t covered by your regular RDS User CALs. There are two main approaches: (1) Obtain an External Connector license for Windows Server/RDS (a single license that covers all external users per server). This is often used on-premises; its applicability to Azure should be confirmed with Microsoft, as it may require self-hosted scenarios. (2) Have those external users covered under a provider’s SPLA with RDS SALs, or issue them guest accounts that are assigned RDS User SL subscriptions. In any case, explicitly license each external user via one of these methods. It’s advisable to consult Microsoft on the best approach for external user licensing in Azure to ensure compliance.

Q: What are the risks of not managing Azure RDS licensing properly?
A: The risks include compliance audit failures, which can result in financial penalties and forced purchases. Microsoft audits can impose back-dated charges for unlicensed usage (often at high list prices) and sometimes penalties (e.g., 125% of cost or additional fees). Beyond financial risk, there’s also the risk of service disruption – in extreme cases, misuse of licensing could lead Microsoft to suspend services; however, they typically seek remediation through licensing true-ups. There is also reputational risk within the organization: failing to comply with software licenses reflects poorly on IT governance. In summary, ignoring RDS licensing can become very expensive and disruptive, so it’s better to invest time in proper management upfront.

Do you want to know more about our Microsoft Advisory Services?

Please enable JavaScript in your browser to complete this form.

Name *

First

Last

Email *

Company

Message *

Submit