CAL licensing explained: what you need and how many
A server license lets you run the server. It does not let anyone use it. That second part is what a Client Access License covers, and missing CALs are the single most common finding in software audits. This page explains what a CAL is, when you need one and how to work out how many.
What a Client Access License actually covers
The principle is the same across Microsoft server products: one license to run the software, another for every person or device that uses it. Both are required, and only one of them is usually budgeted for.
The server license
Covers running the server software itself. For Windows Server it is priced per physical processor core, with minimums of 16 cores per server and 8 per processor. It says nothing about who may connect.
The access license
Covers one user or one device connecting to that server. File shares, print services, directory services and domain logons all count as access. Without it the connection is not licensed, even though it works technically.
Additive licenses on top
Some workloads need a second access license in addition to the first. A Remote Desktop session needs an RDS CAL on top of the Windows Server CAL. An Exchange Enterprise CAL sits on top of the Standard CAL rather than replacing it.
User CAL or device CAL: which is cheaper for you
This is the question that decides the invoice. Both forms are valid, they may be mixed within the same organization, and in practice almost every company is cheapest with a mix.
User CAL
Licenses one named person for any number of devices. The right choice wherever people work from a desktop, a laptop and a phone, or from home and the office. Count people, not machines.
Cheaper when: devices per person is greater than one.
Device CAL
Licenses one device for any number of people. The right choice for shift work, shared terminals, shop floor machines and thin clients where several people use the same hardware in turn. Count machines, not people.
Cheaper when: people per device is greater than one.
A worked example
A company with 40 office workers, each using a desktop and a laptop, plus 12 shared workstations in production used across three shifts by 30 people. The economical answer is 40 user CALs for the office and 12 device CALs for production, not 70 CALs of one kind. Counting the wrong way here typically inflates the requirement by a third.
Three rules that decide whether an audit goes quietly
Most CAL shortfalls are not deliberate. They come from three rules that are easy to miss and expensive to get wrong.
Rule 1
Indirect access counts
If a business application pulls data from the server and passes it to thirty clerks, all thirty need a CAL, not the application. Microsoft calls this multiplexing. Putting software in front of the server does not reduce the license requirement, it only hides it. This is where the large audit claims come from.
Rule 2
The CAL must match the server version
A CAL must be at least as recent as the server it connects to. A 2022 CAL covers access to a 2019 server; a 2019 CAL does not cover a 2022 server. If a server migration is planned, buy the access licenses in the target version straight away rather than twice.
Rule 3
Devices without a user still count
Production terminals, point of sale systems, scanners and unattended machines access server services just as staff do. They are regularly left out of the count because no person is assigned to them, and they are just as regularly found in an audit.
Which products use access licenses
Windows Server, Remote Desktop Services, Exchange Server and SharePoint Server all follow the server plus CAL model. SQL Server offers a choice: server plus CAL, or per core licensing where the number of users is irrelevant. Above roughly 25 to 30 users, and whenever the number of people connecting cannot be determined, per core licensing wins. For an externally reachable application it is the only permitted option.
Buying access licenses pre-owned
CALs are volume licenses, and volume licenses may be resold. That makes them one of the clearest cases for buying pre-owned, because the product is identical and only the purchase route differs.
Why it is lawful
The Court of Justice of the European Union ruled in case C-128/11 that software sold outright may be resold, with no consent from the manufacturer required. The German Federal Court of Justice confirmed this for Microsoft volume licenses. The principle applies where the license was first placed on the market within the European Economic Area.
What you should insist on
Three documents, every time: proof that the license originated in the European Economic Area, the previous owner's written confirmation that their copies were destroyed, and an unbroken record of ownership from the first purchase to you. An invoice alone proves your purchase, not the seller's right to sell.
Where we supply
To businesses and public bodies within the European Economic Area. The exhaustion principle that makes resale lawful is tied to that territory, so we do not supply to the United Kingdom, Switzerland, the United States or other third countries. A VAT identification number is required.
What you receive
The license agreement in your company's name, a transfer declaration covering your quantity, the previous owner's deletion confirmation and the documented chain of ownership. Included in the delivery, at no extra charge, and available again years later if an audit asks for it.
Frequently asked questions about CALs
Do I need a CAL for every employee?
For every person or device that accesses server services, yes. Staff who never touch the server need none. The practical test is not the job title but whether the person authenticates against the domain or uses a file share, a printer or an application that reads from the server.
Does an RDS CAL replace the Windows Server CAL?
No. Both are required, and so is the server license itself. A fully licensed Remote Desktop workstation therefore consists of three parts. Two administrative sessions are available without an RDS CAL, but as soon as productive work happens on them the license applies.
Can I mix user and device CALs?
Yes, and it is usually the cheapest arrangement. Nothing requires a single form across the organization. User CALs for office staff and device CALs for shared workstations is the pattern that fits most companies.
What happens when the Remote Desktop trial period ends?
After 120 days the service refuses new connections until valid access licenses are installed on a license server. Until then everything runs normally, which is exactly why the requirement is so often discovered under time pressure.
Do test and development systems need CALs?
As soon as they are accessed productively, yes. Isolated laboratory environments can be assessed differently. Describe your setup and we will tell you what is actually required rather than what is easiest to sell.
Are pre-owned CALs technically different?
No. It is the same license with the same rights and the same security updates for as long as the version is in support. What differs is the purchase route, and that is documented rather than assumed.
Read further
Used Microsoft licenses for business
What we supply, how an order works and the four documents that come with every license. For companies and public bodies in the European Economic Area.
Microsoft volume licensing
Why volume licenses may be resold while OEM licenses and subscriptions may not, the judgments behind it, and how to identify which form your agreements use.
Not sure how many CALs you need?
Tell us how many users and devices access which servers. We will work out the requirement with you and quote for the matching pre-owned licenses.