Windows Virtual Licensing: VDA and Microsoft 365 E3/E5 Rights

Windows Virtual Licensing: VDA and Microsoft 365 E3/E5 Rights

Licensing Windows for virtual desktop use has evolved from device-based schemes to flexible per-user models.

Microsoft 365 E3/E5 subscriptions and standalone Windows Virtual Desktop Access (VDA) licenses now allow organizations to license Windows on a per-user basis for virtual environments.

CIOs and CTOs must understand these options to ensure compliance and cost-efficiency when enabling Windows on virtual desktops and non-Windows endpoints.

Read Licensing Virtual Desktops and Windows 365 for CIOs.

Windows Virtualization Licensing

Virtual desktop infrastructure (VDI) and cloud-hosted Windows desktops are now core to enterprise IT strategy.

Traditionally, Windows desktop OS licensing was tied to devices, making it challenging to run Windows legally on virtual machines or personal devices. Microsoft addressed this by introducing per-user Windows licensing.

In essence, instead of licensing every endpoint device, you can assign Windows virtualization rights to a user.

This shift accommodates remote work and BYOD by letting licensed users access a Windows 10/11 Enterprise VM from any device.

The result is greater flexibility (one user license covers multiple devices) and simpler compliance tracking.

However, compliance requirements remain strict. A user must still have a proper Windows license to access a Windows VM hosted on a server or cloud.

Microsoft offers two primary ways to achieve this per-user coverage: Windows Enterprise E3/E5 (usually via Microsoft 365 subscriptions) and Windows VDA subscriptions.

The right choice depends on whether the user’s primary device is already Windows-based or not, as well as the organization’s broader licensing strategy.

Read Windows 365 Cloud PC Strategy for CIOs: Sizing, Licensing, and Cost Planning.

Microsoft 365 E3/E5 Per-User Windows Rights

Microsoft 365 Enterprise E3 and E5 plans include a Windows 10/11 Enterprise E3 or E5 license for each user. This grants the user Windows Enterprise usage rights across up to five devices concurrently.

In practice, a single-user subscription can activate Windows Enterprise on the user’s laptop, desktop, virtual desktop sessions, and other devices as needed.

Crucially, Microsoft 365 E3/E5 includes Virtual Desktop Access (VDA) rights for the user. This means the licensed user can legally run Windows Enterprise in a data center or cloud VM and access it remotely from any device.

If your organization already provides M365 E3 or E5 to employees (for Office, EMS, etc.), no additional OS licensing is needed for those users’ VDI access – it’s bundled in.

There is one important caveat: Microsoft 365 E3/E5 user licenses assume the user has a “qualifying OS” on their primary work device.

In other words, the user’s main PC should already have a base Windows Pro or Enterprise license (often via OEM or volume license). The M365 E3/E5 serves as an upgrade to Enterprise and also provides virtualization licensing on top of that.

In scenarios where users are on corporate-owned Windows machines, this requirement is naturally met.

The M365 license then simply upgrades those devices to Enterprise and enables additional rights, such as virtualization and advanced security (E5 includes features like Defender for Endpoint).

From a feature standpoint, Windows Enterprise E5 vs. E3 doesn’t change virtualization rights – both allow VDI access. The difference is in premium features (E5 adds advanced security, analytics, etc.).

For licensing virtual use, E3 is typically sufficient. Many enterprises choose E5 for broader security benefits, but it’s not mandatory for VDI.

Windows VDA Add-Ons for Non-Windows Devices

For users on devices that don’t have a base Windows OS (think of MacBooks, Linux workstations, thin clients, or personally owned devices), Microsoft offers Windows Virtual Desktop Access (VDA) licenses.

VDA is essentially a per-user (or per-device) subscription that grants Windows Enterprise rights without requiring a qualifying underlying OS.

This is ideal for BYOD and non-Windows endpoint scenarios.

There are two flavors of VDA:

• VDA Per User: A user-based subscription that allows that user to access Windows virtual machines from any device. There are no device limits or prerequisites – unlike Windows E3, you don’t need to own a Windows device at all for the user to be licensed. This covers scenarios like contractors using personal Macs or employees using thin clients to connect to a virtual Windows desktop.
• VDA Per Device: A device-based subscription assigned to a specific device (for example, a thin client in a kiosk or lab). Any user can use that device to access a Windows VM. Per-device VDA is less common now but can be economical for shared stations.

In practice, a Microsoft 365 E3/E5 user already includes VDA rights, so you generally don’t need a separate VDA license for those users.

VDA is most relevant if you have users who are not covered by a Microsoft 365 (M365) subscription with Windows or devices that are ineligible for an Enterprise Mobility + Security (EMS) upgrade.

For example, if you have a pool of contractors on short-term assignments using personal devices, you might purchase per-user VDA licenses for each of them rather than full M365 subscriptions.

One common point of confusion is whether a user needs both a Microsoft 365 E3/E5 license and a VDA license. In almost all cases, it’s either one or the other, not both.

If a user has Windows Enterprise via M365, that covers their virtual use rights. If they don’t, you can license them with a standalone Windows VDA. Always avoid “double licensing” the same user – it adds cost with no benefit.

Microsoft’s licensing briefs and Q&A forums confirm that an E3 or VDA subscription alone is sufficient for a user to access a Windows VM, as long as it’s the correct one for their device scenario.

Cost and Licensing Model Comparisons

Licensing Windows for virtual use can be achieved through different SKUs and agreements. It’s important to understand the cost implications of each route:

• Microsoft 365 E3 (per user) – Includes Windows Enterprise E3 rights, plus Office 365 and EMS. Approx. $32–$38 per user per month (commercial list price). Ideal for those who want an all-in-one user license that covers Office apps, security, and Windows. It covers up to 5 devices per user with Windows Enterprise and VDI rights.
• Microsoft 365 E5 (per user) – Includes Windows Enterprise E5 rights with advanced security features. Approx. $57–$62 per user per month. Use this option if you require additional security, compliance, and analytics tools; otherwise, E3 is more cost-effective for purely VDI needs.
• Windows 10/11 Enterprise E3 Standalone (per user) – This is just the Windows Enterprise OS portion (often sold via volume licensing or cloud subscription), typically around $7–$10 per user per month. It requires the user to have a primary device with a qualifying OS. It provides the user with Windows Enterprise and VDI access rights but no access to Office or other products.
• Windows VDA Per User – A standalone VDI rights license for users without a qualifying OS. Roughly $8–$12 per user/month (pricing varies by agreement). This license can be assigned to any user, regardless of what device they use, and grants full Windows Enterprise virtual access rights on any device.
• Windows VDA Per Device – Approximately $100 per device per year (retail, approximately $8.30 per month). Used for licensing single devices (e.g., a shared PC or thin client) that multiple users might use to access a virtual desktop. Each licensed device allows any user on it to connect to a Windows VM.

Real-World Pricing Example: A government licensing program published rates of about $5.44/month for VDA per device vs. $7.40/month for VDA per user. While the per-user cost is higher, it covers multiple devices for one user, often yielding savings if a user uses 2 or more devices. Volume discounts in enterprise agreements can reduce these prices, sometimes to under $15 per year for a Windows per-user add-on in large deals.

In enterprise agreements, it’s common to negotiate these licenses as part of a bundle. For instance, if you’re adding Windows VDI rights for hundreds of contractors, you might negotiate a discounted Windows VDA E3 per-user SKU rather than paying the retail price.

Similarly, upgrading an Office 365 E3 user to a full Microsoft 365 E3 license (which includes Windows rights) may be more cost-effective than purchasing Office and a separate Windows VDA.

It’s worth modeling out the 3-year total cost under different scenarios:

• Adding Windows E3 standalone to an existing Office 365 E3 license vs.
• Converting to M365 E3,
• vs. using VDA per user for certain populations.

The table below summarizes key licensing options for virtual desktop rights:

Table: Common Windows virtualization licensing options, their use cases, and approximate costs. Actual prices vary based on volume licensing agreements and regional pricing.

Enterprise Agreement customers often secure better pricing, particularly when bundling licenses or committing to Microsoft 365 plans on a large scale.

Compliance and Practical Considerations

When implementing VDI or any virtual desktop solution (e.g., VMware Horizon, Citrix, or Azure Virtual Desktop), proper licensing is not optional – Microsoft compliance audits can and do happen. Unlicensed Windows VMs can incur significant penalties.

Here are practical considerations and pitfalls to avoid:

• Audit Readiness: Keep clear records of which users have been assigned Microsoft 365 E3/E5 or Windows VDA licenses. Each Windows VM instance should be associated with a licensed user or device. In VDI management systems, you can use Windows Subscription Activation to automatically activate Windows 10/11 Enterprise VMs using the user’s AAD credentials if they have an E3 or E5 subscription – this helps ensure that only licensed users can initiate a session.
• BYOD Policy Alignment: If your workforce uses personal devices, decide whether to standardize on providing a corporate Windows device or license them via VDA. Some companies issue inexpensive Windows laptops (which include an OEM Windows license) to avoid VDA costs for contractors, whereas others embrace BYOD and cover it with per-user VDA licenses. Align this decision with HR and security policies (e.g., you may require Intune management – note that Intune is included in M365 but not with standalone VDA).
• Mix-and-Match Licensing: You don’t have to choose a single licensing approach for all your products. Many organizations use a mix, e.g., full M365 E3 for employees, but purchase a handful of monthly VDA user licenses via CSP for short-term contractors. The key is to ensure anyone accessing a Windows VM is covered by one of the eligible licenses. Microsoft’s Product Terms list all the qualifying licenses (Windows Enterprise, VDA, M365, etc.) that confer virtualization rights – make sure every scenario is accounted for.
• Double-Check Third-Party Advice: Many enterprises rely on reseller or partner guidance for licensing, but misinterpretations are common. For example, some resellers mistakenly suggest that you need to stack multiple licenses (such as buying VDA on top of E3). If in doubt, refer to Microsoft’s official licensing documentation or seek a second opinion. The rules boil down to this: each user or device requires one qualifying Windows license for VDI – no more, no less.
• Remote Desktop (RDS) and Other Considerations: Remember that Windows OS licensing (E3/VDA) is one piece of the puzzle. If you’re using traditional RDS or Citrix on Windows Server, that involves RDS CALs and possibly different licensing. But for Windows 10/11 client OS VMs, E3/VDA covers the client OS. (If using Azure Virtual Desktop service, those user licenses also make you eligible for Azure-hosted Windows 10/11 multi-session without separate OS fees, though you still pay Azure VM runtime costs).

Read Remote Desktop Services (RDS) Licensing: CALs, Cloud Alternatives, and Enterprise Strategy.

Recommendations

• Choose Per-User Licensing for Flexibility: Opt for per-user Windows licensing (via M365 E3/E5 or Windows VDA subscriptions) instead of per-device licensing. This covers multi-device use cases and remote access seamlessly.
• Leverage Existing Microsoft 365 Investments: If you already provide Office 365 or EMS to users, consider upgrading to Microsoft 365 E3 or E5 to include Windows virtualization rights in one bundle. It often simplifies management and can be cost-effective in an enterprise agreement.
• Use VDA for BYOD and Non-Windows Scenarios: Assign Windows VDA per-user licenses to users who primarily use non-Windows endpoints (e.g., Mac, Linux, thin clients). This ensures they are compliant when accessing a Windows virtual desktop without needing a company-issued Windows PC.
• Avoid Redundant Licensing: Do not double-pay for the same rights. A user with M365 E3 or E5 does not require an additional VDA license. Audit your license assignments to ensure each user/device has the correct single license type covering their Windows usage.
• Negotiate Volume Discounts: When contracting with Microsoft, discuss your VDI plans. For example, if you need 500 VDA licenses for contractors, negotiate that as part of your agreement – you may secure better pricing or concessions (like promo discounts or inclusion in an Enterprise Agreement).
• Track Usage and Stay Compliant: Implement a process to track which users are using virtual desktops. Ensure those users remain licensed, especially if roles or devices change. Remove or reassign licenses when people leave or no longer need access to optimize costs.
• Review Product Terms Regularly: Microsoft licensing rules are constantly evolving. Have your licensing team or partner periodically review the latest Product Terms and licensing guides for Windows virtualization. This will keep you informed of any changes (e.g., new offerings like Windows 365 Cloud PC or changes in VDA eligibility) that could impact your strategy.
• Plan for Security and Management: Remember that licensing E3/E5 can bring additional security tools (Windows Defender ATP, etc.). Use these to secure your VDI environment. If you opt for VDA standalone, ensure you have alternative endpoint management and security solutions for those users and devices.

FAQ

Q1: Do we need a Windows VDA license if a user already has Microsoft 365 E3/E5?
A1: No – a Microsoft 365 E3/E5 user license already includes Windows Enterprise with virtual access rights. That user is covered to use Windows VMs on any device. You would only need a VDA license for users who don’t have a M365 E3/E5 or similar Windows Enterprise license. It’s an either/or choice for each user.

Q2: Our employees use personal Macs to connect to a virtual Windows 10 desktop – how do we license this?
A2: In this BYOD scenario, you should assign each user a Windows VDA per-user license (unless they already have an M365 subscription with Windows). The VDA per-user license will cover their use of a Windows VM from a non-Windows device. Alternatively, providing them a corporate M365 E3 license would also cover it, but VDA is a simpler, lower-cost option if you don’t need the full M365 suite.

Q3: How many devices or virtual machines can one per-user license cover?
A3: A per-user Windows license (whether via M365 E3/E5 or standalone Windows E3/VDA) allows that user to use Windows on any of their devices, typically up to 5 devices at a time. This includes physical installations and virtual desktop instances. For example, a single user could be using a Windows laptop, a secondary desktop PC, and multiple virtual desktop sessions, all under one license. The key is that it’s the same licensed user accessing those devices.

Q4: What is the difference between Windows Enterprise E3 and Windows VDA in simple terms?
A4: Both ultimately grant rights to use Windows 10/11 in virtual environments. Windows Enterprise E3 (part of M365 E3) assumes the user has a Windows machine already and upgrades it to Enterprise, adding virtualization rights. Windows VDA is meant for users or devices that don’t have an underlying Windows OS – it gives virtualization rights from scratch. Think of E3 as “Windows for a user who has Windows Pro already” and VDA as “Windows for a user with no Windows device.” Functionally, once assigned, both let the user access an Enterprise Windows VM; the difference is in the prerequisites and how they are sold.

Q5: How can we ensure we’re compliant with Microsoft’s licensing when running VDI?
A5: Ensure every user or endpoint that accesses a Windows virtual desktop is associated with a valid license (M365 E3/E5, Windows E3/E5, or VDA). Keep an up-to-date list of licenses purchased and to whom they’re assigned. Use Azure AD or your VDI software to enforce that only licensed users can launch a session. During Microsoft true-ups or audits, be prepared to provide proof of license assignments that cover all active VDI users. It’s also wise to consult Microsoft’s official licensing guides annually and work with a licensing specialist or reseller to double-check compliance as your environment changes.

Read more about our Microsoft Licensing Service.

Would you like to discuss our Microsoft Advisory Services with us?

Please enable JavaScript in your browser to complete this form.

Name *

First

Last

Email *

Company

Message *

Submit