Microsoft CALs - Client Access Licenses

Microsoft Client Access License (CAL) 101

Microsoft licensing is complicated and ever changing. A Client Access License is an important and common piece of the Microsoft licensing portfolio.

For that reason it’s critical that you understand the types of CALs that are out there, when you need them, and how to license them to ensure compliance.

There’s a table of contents below so you can jump directly to the most relevant topic(s) for you.

Also, if you’d prefer a 1 page CAL licensing cheat sheet, the ‘Cliff’s Notes’ so to speak, you can get that below.

Table of Contents

 

What is a Client Access License?

A Client Access License gives a client (a user or device) the right to access a server. This is important to understand because you’re still able to access a server, in most cases, without actually purchasing a CAL.

This means that it can be easy to fall out of compliance, and one more reason Office 365 is important to Microsoft.

Types of CALs

While there are many product specific CALs, which are listed below, Microsoft essentially has 2 types of CALs.

  1. Base CALs
  2. Additive CALs

Base CALs are required for any user or device to be able to access a specific server.

When a server has both a Base and Additive CAL option, they are often referred to as Standard and Enterprise CALs.

Additive CALs provide additional functionality, above and beyond with the Base CALs provide.

Also, Additive CALs require a user or device first be licensed with a Base CAL (hence the name Additive)

Here’s a list of CALs by Server/Product:

  • Windows Server CAL
  • Exchange Server
    • Standard CAL
    • Enterprise CAL (Requires Standard CAL)
    • Enterprise CAL with Services (Requires Standard CAL)
  • SharePoint Server
    • Standard CAL
    • Enterprise CAL (Requires Standard CAL)
  • Skype for Business Server
    • Standard CAL
    • Enterprise CAL (Requires Standard CAL)
    • Plus CAL (Requires Standard CAL)
  • Project Server CAL
  • Dynamics AX
    • Self Serve CAL
    • Task CAL
    • Task Additive CAL
    • Functional CAL
    • Functional Additive CAL
    • Enterprise CAL
    • Enterprise Additive CAL
  • Dynamics CRM
    • Essentials CAL
    • Basic CAL
    • Basic Additive CAL
    • Professional CAL
    • Professional Additive CAL
  • SQL Server CAL
  • Remote Desktop Services CAL
  • System Center Configuration Manager (SCCM) CML – technically a Client Management License
  • System Center Endpoint Protection (SCEP) SL – technically a Subscription License
  • Core CAL Suite
  • Enterprise CAL Suite
  • Visual Studio Team Foundation Server CAL
  • Microsoft Identity Manager CAL
  • Windows MultiPoint Server CAL
  • Windows MultiPoint Server CAL with Windows Server CAL
  • Active Directory Rights Management Services (ADRMS) CAL
  • Windows Small Business Server
    • CAL Suite
    • Premium Add-on CAL

A client access license is for internal employees and contractors.

In some cases, you may need an External Connector (EC) license for non-employees however, if you’re providing a service, such as hosting a Windows Server or an application you will likely require a Service Provider License Agreement (SPLA).

Just something to note, not something we’ll talk about more in this guide.

User CAL or Device CAL?

A Client Access License is generally available in two options.

  1. User CAL
  2. Device CAL

You’ll notice there are no concurrent CALs listed. That’s because Microsoft does not have a concurrent licensing model. This is important to note because other software vendors do and often times companies mirror the concurrent licensing model of another vendor to their Microsoft CALs.

There are exceptions such as per Operating System Environment (OSE) instead of per device like with the System Center Products. Also with System Center products you’ll find they are Client Management Licenses rather than Client Access Licenses.

Getting back to User CALs and Device CALs now…

A User CAL gives an individual user the right to access the server that corresponds to that CAL from as many as 5 devices. That could be a mobile device, tablet, laptop, desktop, any type device they would use to access that server.

A Device CAL gives an individual device the right to access the server that corresponds to that CAL ONLY from that one device, regardless of how many users touch that device.

So a User CAL makes sense for someone with multiple devices, maybe someone in IT, Managers, Sales reps, etc… Anyone with multiple devices.

A Device CAL then makes sense for someone who will only ever use one device for work or shared devices. A PC on a shop floor in a manufacturing facility, a call center with multiple shifts or maybe PCs in a nursing station. If you have multiple users for a single device that’s a perfect scenario for a Device CAL.

Client Access License (CAL) Suites

In the list of CALs we ran through you may have noticed the Core CAL Suite and the Enterprise CAL Suite. As the names imply these are a suite of CALs.

These CAL Suites simply bundle many of the most common CALs and encourage you to use some Microsoft products people either want or Microsoft wants you to use.

Here’s a breakdown of what’s included in each:

Core CAL Suite

  • Windows Server CAL
  • Exchange Standard CAL
  • SharePoint Standard CAL
  • Skype for Business Standard CAL
  • System Center Endpoint Protection
  • System Center Configuration Manager CML

Enterprise CAL Suite

  • All of the CALs listed in the above Core CAL Suite PLUS…
  • Exchange Server Enterprise CAL with Services (includes Data Loss Prevention & Exchange Online Protection)
  • Exchange Online with Archiving for Exchange Server
  • SharePoint Server Enterprise CAL
  • Skype for Business Enterprise CAL
  • Windows Server Active Directory Rights Management Service (ADRMS) CAL
  • Advanced Threat Analytics

Generally speaking, if you’re using 3-4 of the CALs in a Suite, it’s less expensive than buying the individual CALs. With SharePoint being the most expensive of the CALs here, any 2 CALs plus SharePoint you’ll experience a savings.

If you’re not using SharePoint, then you’ll generally need to be using 4 of the CALs to see a savings however, if you plan to implement SharePoint, or a fifth CAL, in the next 6-12 months, I recommend you at least compare the costs of adding that in later vs buying the CAL Suite now.

CAL Suites are a great way to not only save money but also to add products you’re interested in for very little additional cost (you still need to buy the server licenses as CALs simply provide the rights to access a particular server and do not provide the rights to run that server software).

The other benefit of purchasing CAL Suites vs individual CALs is the ease of managing a single suite vs managing as many as 6 or more CALs. You might be surprised how often companies purchasing individual CALs forget to include one or more CALs for a user or group of users, which creates a real, potentially costly, problem down the road.

How And When To Buy A Client Access License?

A client access license is required for any user or device that connects to a server. While this sounds simple, it’s not always the case.

There are several scenarios and rules, as well as different purchasing options to consider.

Is a Client Access License the only option?

In some cases a client access license is not required, such as with SQL Server per core licensing. If that is the case you’ll need to compare total costs and ease of management for each option.

User CAL, Device CAL, or both?

You need to consider whether you have someone with multiple devices vs a single or shared device, which we talked about above.

Also, you’re able to mix and match User CALs and Device CALs at your company, which is a common practice.

Consider a restaurant chain with 1,000 employees. That chain may have 200 true Users, people with multiple devices along with 800 users who share devices at each restaurant location.

Rather than purchasing User CALs for those 800 restaurant workers you would license the shared devices at each location, substantially lowering your costs.

This is true across industries and is common with retail, manufacturing, healthcare, and so on. Anytime you have a mix of shared devices and users I recommend looking at mixing User CALs and Device CALs.

Does a CAL Suite make sense?

You need to consider which CALs are needed and if there’s a CAL Suite that could make purchasing less expensive and easier to manage, which we covered above.

If you’re using 3-4, or more, of the CALs in a Suite, it’s generally going to be less expensive to purchase the suite, and easier to manage, than, purchasing the CALs individually.

This type of comparison is simple to do, and something your reseller should be able to do for you.

What about Online Services?

If you have any Online Services such as Exchange Online, Office 365 suites, etc… those provide on-premises rights (essentially CALs) in addition to their online rights.

This allows for the ability to migrate over time and have hybrid environments without doubling the cost.

It also allows you to purchase an online suite and still allow you to run pieces of the suite on-premises.

For example, maybe you want to keep SharePoint on-premises but move Exchange and Skype for Business Online. An Office 365 E Suite includes both online and on-premises rights for each which means you don’t have to pay for the E Suite and then buy Skype for Business CALs separately.

When we look at the Secure Productive Enterprise (SPE) offering, which includes E3 or E5, along with Windows 10 Enterprise and the Enterprise + Mobility (EMS) Suite you don’t just get all of those rights, but also no cost on-premises applications servers.

Specifically, Exchange, SharePoint, and Skype for Business.

There are limitations on this depending on how you purchased your SPE, meaning the agreement type. As of this writing, those free on-premises server deployments are not available via the CSP (Cloud Solution Provider) program.

Is Multiplexing a factor?

You need to know that “multiplexing”, using hardware or software to pool connections, reroute information, or reduce the number of users or devices that directly access or use a product, does not reduce the number of user or device CALs required.

SQL is a product I see tripping up companies a lot when it comes to multiplexing. Here’s how:

You have an application, it could be an EMR or ERP system, time clock or HR application, SharePoint, anything. Those applications connect to SQL however, your end users don’t directly access the SQL Server. Many people are under the impression that they would not need a SQL CAL in that scenario.

If you’re SQL Server is licensed by cores that would be correct. If your SQL Server is licensed in the Server/CAL model though, you’re required to have CALs for any User or Device that accesses that application.

Summary

While many people think they know when they need a Client Access License and when they don’t I regularly find myself educating folks on all that we talked about here. This has been true for as long as I’ve been in software licensing, 8+ years now.

With licensing models changing, more products being added to the Microsoft portfolio, and Microsoft continuing to do more in the cloud the complexity around licensing is only increasing. This means there will always be more to learn when it comes to simply purchasing or subscribing to Microsoft products.

Because of this, having a baseline understanding of the different programs and licensing models is key to accurately budgeting your Microsoft costs and to ensuring no surprises show up with an audit down the road.

Resources:

  • Microsoft Product Terms (Search for a Microsoft product to see terms of use, licensing options, and if CALs are required)

I hope you found this helpful and, if you did, I would appreciate you sharing this with anyone you feel would benefit as well.

If you have any questions you can contact me directly here – http://volumelicensingcourse.com/contact/.

Pete Bebber

www.volumelicensingcourse.com

Microsoft CAL Licensing Cheat Sheet

Cal lcs image

Licensing Microsoft Client Access Licenses (CALs) in 1 Page

Powered by ConvertKit