CAL Licensing Definition
What Is The CAL Licensing Definition?
A Client Access License (CAL) is the legal right for one user or one device to connect to server software, purchased separately from the license for the server itself. A CAL is an entitlement, not a piece of software. Nothing is installed, and in most cases no key is ever issued.
Buying Windows Server gives you the right to run the operating system on a machine. It does not give anyone the right to use it. That second right is the CAL, and Microsoft sells it either per named user or per device.
What a CAL License Does, and What It Does Not
Every Windows Server deployment involves two separate purchases. The server license covers installing and running the operating system. CALs cover the people or machines connecting to it.
Skipping the second purchase is the single most common Microsoft licensing mistake, and it is expensive precisely because nothing stops you. Windows Server does not check CALs. It will happily accept connections from 200 users when you have bought 20. The obligation is contractual, and it surfaces during a software audit rather than at login.
A CAL is an entitlement you can be audited against, not a key you install.
This is where the widespread misconception about certificates and product keys comes from. Windows Server User CALs and Device CALs are documented rights. You will have a purchase record, a licensing agreement number, or an entry in your volume licensing portal, and that is the whole artifact.
Remote Desktop Services CALs are the one partial exception. Those are installed on a Remote Desktop Licensing server, and per-device RDS CALs are genuinely issued and tracked. Per-user RDS CALs are not. Microsoft’s own documentation is direct about this: per-user RDS CALs are not enforced by RD Licensing, so connections succeed regardless of how many licenses the server holds, and tracking compliance is the administrator’s responsibility.
The Types of CAL
Five license types cover almost every access scenario. Most organizations end up holding at least two.
| CAL type | What it covers | Best fit |
|---|---|---|
| Windows Server User CAL | One named person, connecting from any number of devices | Staff who move between a laptop, a desktop, and a phone |
| Windows Server Device CAL | One device, used by any number of people | Shared workstations, shift-based teams, kiosks, lab machines |
| RDS CAL (per user or per device) | Remote Desktop Services access, required in addition to a Windows Server CAL | Anyone using a full remote desktop or a published application |
| External Connector | Unlimited external non-employees accessing one server | Client portals, partner-facing applications |
| Core CAL or Enterprise CAL Suite | Bundled CALs across several server products | Organizations also running Exchange, SharePoint, or Configuration Manager |
User CAL
A User CAL is assigned to a person. That person can then reach the server from as many devices as they like: office desktop, home laptop, tablet, phone. Nothing needs to be tracked at the device level.
User CALs win in most modern environments. If your team averages more than one device each, this is the cheaper model.
Device CAL
A Device CAL is assigned to a machine, and anyone can use that machine to reach the server. A nursing station used by four shifts of staff needs one Device CAL, not four User CALs.
The rule of thumb is a ratio. More devices than people, buy User CALs. More people than devices, buy Device CALs. Mixing both across one environment is allowed and often the cheapest outcome.
RDS CAL (Terminal Services CAL)
An RDS CAL covers remote graphical access to a Windows Server session, which is what most people mean by a remote desktop. Older documentation calls it a Terminal Services CAL, since Remote Desktop Services was renamed from Terminal Services in Windows Server 2008 R2.
The critical point is that RDS CALs stack. They do not replace Windows Server CALs, they sit on top of them, so a remote worker needs both. That doubles the per-person access cost and catches out a lot of first-time terminal server deployments.
The requirement also follows the technology, not the vendor. Brokering connections through Citrix or Parallels RAS changes nothing, because the licensing obligation comes from the Windows Server underneath. If you are setting this up yourself, our walkthrough on how to install and activate RDS CALs covers the licensing server configuration step by step.
External Connector License
An External Connector covers all external users, meaning people who are not your employees or contractors, accessing a single server. It is priced per server rather than per person, so it only pays off at high external user counts. Below that threshold, buying individual CALs costs less.
CAL Version Compatibility
CALs are tied to a Windows Server version, and compatibility runs one direction only.
A newer CAL can access an older server. An older CAL cannot access a newer one. Windows Server 2022 CALs will not cover access to a Windows Server 2025 machine, so a server upgrade means a CAL purchase alongside it.
CALs are backward compatible and never forward compatible.
The same rule governs RDS licensing servers. A licensing server can host CALs matching its own version or older, but not newer ones, which means the licensing server usually has to be upgraded before the session hosts it serves.
How CALs Are Counted
Three counting rules cause most compliance gaps.
CALs are network-wide, not per-server. Ten people accessing five Windows Servers need ten User CALs in total, not fifty. This surprises organizations in the generous direction, and it is worth knowing before you over-buy.
Authorization is the trigger, not activity. You license every user or device permitted to connect, not the number connected at once. Concurrency is irrelevant to Microsoft CAL terms. A security group with 90 members that only ever sees 30 simultaneous sessions still requires 90 licenses.
Indirect access still counts. If a web front end or middleware layer queries Windows Server on a user’s behalf, that user needs a CAL. Pooling connections through a service account does not reduce the count. This one regularly catches organizations running a CRM or ERP application with a Windows Server database behind it.
CAL Licensing for Cloud and Hosted Desktops
Moving a server to a public cloud does not remove the CAL requirement. Running Windows Server on Azure or AWS infrastructure still obliges you to license every user or device that connects to it.
Hosted providers work differently, and the mechanism is worth understanding because it changes who carries the paperwork. Under Microsoft’s Services Provider License Agreement (SPLA), providers report Subscriber Access Licenses (SALs) rather than selling CALs to customers. The provider counts its own subscribers and reports monthly, so the customer never buys, installs, tracks, or gets audited on a CAL.
Microsoft reshaped these rules on October 1, 2022, introducing the Flexible Virtualization Benefit and drawing a line between authorized outsourcers and what it calls Listed Providers, namely Alibaba, Amazon Web Services, Google, and Microsoft itself. Customers outsourcing to a Listed Provider acquire licenses from that provider directly.
That distinction explains why hosted Desktop as a Service offerings differ on licensing. Our multi-user cloud desktops run on Windows Server, so the Microsoft server and access licensing is carried on our side and there are no CALs for you to manage. Our single-user desktops run Windows 10 and Windows 11, and those require you to bring your own Windows license, because Microsoft does not permit a provider to supply client-operating-system licensing on shared hardware. Anyone weighing this against Microsoft’s own platform will find the same pattern in our breakdown of the true cost of Azure Virtual Desktop, where existing Windows, Microsoft 365, or RDS CAL entitlements determine whether user access costs anything extra.
Getting a straight answer on which licenses you already own is usually the hardest part of a migration. Talk to a cloud expert and we will map your current entitlements before you buy anything.
CAL Licensing Definition Frequently Asked Questions
Do I need a CAL for every employee, or only the ones connected at the same time?
Every employee authorized to connect, regardless of how many are connected at once. Microsoft CAL terms are based on authorization rather than concurrent use, so a group of 90 permitted users requires 90 User CALs even if sessions never exceed 30.
What is the difference between a CAL and an RDS CAL?
A Windows Server CAL covers basic access to the server, such as files, printing, or authentication. An RDS CAL covers remote graphical desktop or published application access through Remote Desktop Protocol. Remote desktop users need both, since the RDS CAL is an addition rather than a substitute.
Does a CAL come with a product key?
Windows Server User and Device CALs do not. They are contractual rights evidenced by a purchase record or licensing agreement, with nothing to install. RDS CALs are the exception and are installed onto a Remote Desktop Licensing server.
Can I use my Windows Server 2022 CALs with Windows Server 2025?
No. CAL compatibility only runs backward, so a 2022 CAL cannot cover access to a 2025 server. Newer CALs can cover access to older servers, which is why organizations upgrading their server version have to budget for CALs at the same time.
Do I still need CALs if my server runs in the cloud?
Yes, if you are running the Windows Server yourself on cloud infrastructure. CAL obligations follow the software, not the hardware location. Fully hosted providers licensing under SPLA report Subscriber Access Licenses on their side instead, which removes CAL management from the customer entirely.
What happens if I do not have enough CALs?
Nothing technically. Windows Server does not block unlicensed connections, and per-user RDS CALs are not enforced either. The exposure appears during a Microsoft software audit, where shortfalls are settled retroactively and typically at list price.
