MICROSOFT LICENSING · MODULE 9 · SERVER PRODUCTS & ACCESS LICENCES
Server products and CALs:
Who needs which access licence?
A server licence permits the software to run, but it does not always answer who may access it. That is where CALs, CAL-equivalent licences, and product-specific External Connectors apply.
The short answer
License the server first, then every access that requires a right.
The right choice may be a User CAL, Device CAL, additive CAL, CAL-equivalent Microsoft 365 licence, or External Connector. It depends on the product, feature, individual, and actual access path.
- 01A CAL is an access right, not a server licence.
- 02User CALs are assigned to people; Device CALs are assigned to devices.
- 03RDS and other advanced functions can require an additive CAL on top of the base CAL.
- 04External Connectors cover only qualifying external people and eligible server products.
- 05Microsoft 365 or Office 365 can contain selected CAL rights, but not automatically SQL or RDS CALs.
Explained simply · The essential terms
Three terms that make server access easier to understand
A server licence permits the software to run. An access licence answers a different question: which person or device may access it?
User CAL
An access licence is assigned to one specific person, who may access the relevant server from different devices.
Device CAL
An access licence is assigned to one specific device, allowing different people to access the relevant server from that device.
External Connector
For eligible server products, one licence per server can cover access by qualifying external people.
A practical example: Ten employees access Windows Server using three shared PCs. Depending on actual use, ten User CALs or three Device CALs may be appropriate. The server itself still needs a separate licence.
Separate the two licensing layers
A server licence and an access licence are different
Many Microsoft server products answer two separate questions: may the software run, and which person or device may use it?
The licence for running software
Depending on the product, you license a server instance, physical server, VM, or a defined number of cores.
A CAL for a user or device
A Client Access License permits one assigned person or device to access the corresponding server software.
An additive CAL is layered on top
Accessing advanced functionality often requires an additional additive access licence alongside the base CAL.
Conversely, a correctly licensed server instance does not automatically cover the required internal user or device access.
User or device?
When does a User CAL or Device CAL fit?
Both models can be combined within an organisation. Choose the metric that reflects actual use economically and can be evidenced reliably.
| Typical situation | Possible choice | Why? |
|---|---|---|
| One person uses a laptop, tablet, and terminal | User CAL | One assigned user can access the server from several devices. |
| Several shifts share a small number of fixed devices | Device CAL | Different people can access the server through one licensed device. |
| Office users plus shared production devices | Consider a combination | User and Device CALs can be combined to match actual use. |
| Only one service account connects directly | Do not count only the account | Indirect human access can still require licensing under multiplexing rules. |
Ten named people do not need fewer CALs merely because no more than three work at the same time.
Base and additional rights
What are Base CALs and Additive CALs?
A Base CAL provides fundamental access. An Additive CAL provides a defined advanced function and does not replace the Base CAL.
Windows Server CAL is the base
Normal access to Windows Server Standard or Datacenter requires a Windows Server CAL or recognised equivalent.
RDS CAL is additional
A remote desktop session generally requires an appropriate RDS User or Device CAL in addition to the Windows Server Base CAL.
Further additive access rights
Active Directory Rights Management Services and Microsoft Identity Manager can also require additive rights. Microsoft Entra ID P1 or P2 can satisfy the relevant MIM User CAL requirement.
Standard plus Enterprise CAL
The Exchange Standard CAL is the base. Enterprise functions such as selected archives, holds, or DLP require the Exchange Enterprise CAL as well.
Standard plus Enterprise CAL
The SharePoint Standard CAL covers base functions. Defined Enterprise functionality requires the Enterprise CAL in addition.
Core CAL Suite and Enterprise CAL Suite
The Core CAL Suite bundles selected base rights. The Enterprise CAL Suite includes those rights and selected additive CALs; it is not an add-on to the Core CAL Suite.
Check SQL and RDS separately
Even the Enterprise CAL Suite does not include a SQL Server CAL. The Core CAL Suite does not include additive CALs such as the RDS CAL.
An Exchange Enterprise CAL does not convert Exchange Server Standard into Enterprise. CAL requirements follow the accessed function, not automatically the server edition.
Windows Server and Remote Desktop
Which access rights does Windows Server require?
Windows Server Standard and Datacenter are licensed by cores. Accessing users or devices also need appropriate access rights, whether the server was licensed physically or by eligible VM licensing.
Windows Server User or Device CAL
Every relevant user or device needs a CAL of the same or a later version than the accessed server software.
Windows Server CAL plus RDS CAL
A person or device accessing an RDS session host also needs an appropriate RDS CAL. An RDS CAL 2022 cannot cover a Windows Server 2025 session host.
Apply product exceptions carefully
Microsoft provides specific exceptions for access by another licensed server, web or HPC workloads, and a physical OSE used solely to manage virtual OSEs. These are not broad CAL exemptions.
The RDS grace period is not a licensing discount
The technical RDS grace period helps set up a licence server. It does not remove the contractual requirement for suitable RDS access rights.
A Windows Server or RDS CAL 2025 can cover appropriate older versions. A CAL 2022 cannot access Windows Server 2025 or an RDS session host 2025. When Windows Server is licensed by individual VM, all CALs used for access must also be subscription licences or have active Software Assurance.
Definition changed in October 2024
Who actually qualifies as an External User?
External does not simply mean that a person is absent from payroll. Since 1 October 2024, Microsoft's definition also considers contractors' working hours and regular on-site work.
Employees of the customer or its affiliates
Employees of the customer and affiliated organisations do not qualify as External Users.
Contractors working more than 30 hours per week
A contractor or agent who typically works more than 30 hours per week on average for the customer or its affiliates is not an External User.
Contractors on site every working day
A contractor or agent who typically works on site each working day is also not an External User.
Customers, guests, or occasional providers
Other people can qualify. The current definition and the relevant product right must still be assessed case by case.
The official Microsoft definition controls—not the technical identity, account type, or internal label.
External Connector or product-specific right?
External access is licensed differently across products
An External Connector is not a universal pass for every Microsoft server. Product Terms determine whether an EC, individual CALs, or the server licence covers external base access.
| Product | Typical external-access logic | Important |
|---|---|---|
| Windows Server | Individual CALs or one Windows Server External Connector per accessed server | Advanced functions can require additive CALs or additive ECs. |
| Remote Desktop Services | Windows base right plus RDS CAL, or suitable base and additive EC rights | A Windows Server EC alone does not automatically cover RDS. |
| Exchange Server SE | External base-function access is licensed with the server | Advanced Enterprise functionality requires both Base and Additive CALs for external users. |
| SharePoint Server SE | Product Terms license External User Access with the server | Check both the External User definition and accessed functionality. |
| Project Server SE | External access also requires a CAL or recognised equivalent | There is no general external-user exemption. |
| SQL Server | Individual SQL CALs under Server/CAL, or core licensing without SQL CAL counting | Windows Server access rights for the operating system remain separate. |
If qualifying external people access several Windows Servers, each accessed server can require its own suitable External Connector.
Key server products at a glance
Which product adds which access layer?
A complete position often contains several layers. The application server, Windows Server, SQL Server, and other components can each require their own rights.
| Server product | Server side | Access side |
|---|---|---|
| Windows Server Standard/Datacenter | Core licences for physical-server or eligible VM licensing | Windows Server CAL, CAL equivalent, or suitable EC for external access |
| SQL Server Standard | Server licence or core licensing | SQL CAL under Server/CAL; no SQL CAL under core licensing |
| SQL Server Enterprise | Generally core licensing for newly acquired licences | No additional SQL CAL under core licensing; assess Windows access separately |
| Exchange Server Subscription Edition | Server licence per running instance | Standard CAL as base; Enterprise CAL added for defined functions |
| SharePoint Server Subscription Edition | Server licence per running instance | Standard CAL as base; Enterprise CAL added for defined functions |
| Project Server Subscription Edition | Own server licence plus technical SharePoint, SQL, and Windows dependencies | Project Server CAL or expressly listed CAL equivalent per user or device |
| Skype for Business Server SE | Server licence per running instance | Standard CAL plus Enterprise or Plus CAL for corresponding advanced functions |
| System Center | Management Licences based on the managed environment | Not a classic User CAL model; count managed servers and clients under product rules |
A Project Server user can simultaneously require Project Server, SharePoint Server, SQL Server, and Windows Server rights. Assess every layer separately.
Check existing cloud licences first
Which Microsoft 365 or Office 365 plans can replace CALs?
Microsoft identifies selected User Subscription Licences as CAL equivalents. They apply only to the licensed user, exact SKU, and relevant agreement—not automatically to the whole tenant.
| Plan | Windows Server Base CAL | Exchange Server SE | SharePoint Server SE |
|---|---|---|---|
| Microsoft 365 F1/F3 | Yes, in the current equivalency table | No | No |
| Microsoft 365 E3/E5/E7 | Yes | Base and additive rights | Base and additive rights |
| Office 365 E1 | No | Base right | Base right |
| Office 365 E3/E5 | No | Base and additive rights | Base and additive rights |
| Enterprise Mobility + Security E3/E5 | Yes | No | No |
The table follows the EA/EAS Product Terms and must not automatically be applied to CSP. Microsoft explicitly states that Microsoft 365 E3/E5 purchased through CSP does not include Exchange SE Extended Use Rights. Office 365 Nonprofit E1 also does not satisfy the listed CAL/ML requirements. Always assess the exact SKU, agreement programme, server rights, and CAL rights separately.
Understand Subscription Edition
Why active subscription or Software Assurance rights matter
Exchange, SharePoint, Project, and Skype for Business are now offered as Subscription Editions. Running and accessing them requires product- and agreement-specific active subscription or Software Assurance rights.
Keep both sides current
For Exchange and SharePoint Subscription Edition, both server licences and used CALs must be subscription licences or have active Software Assurance.
Observe its own prerequisites
Current Project Server Subscription Edition Product Terms require active Software Assurance and define separate server and access rights.
Check Planner and Project plans
Microsoft lists Planner Plan 1, Planner and Project Plan 3/5, Project Essentials, and Project Professional 2021 with active Software Assurance among Project Server access equivalents.
Expiry changes the use right
When the necessary active entitlement ends, the Subscription Edition cannot simply continue unchanged. Any entitlement to an earlier version must be verified.
It describes a continuously serviced model with specific prerequisites. An old perpetual server purchase does not automatically cover the current Subscription Edition.
Indirect access still counts
Why a portal, bot, or service account does not automatically reduce CALs
Multiplexing pools or obscures connections technically. Licensing still considers the people or devices directly or indirectly accessing the Microsoft product or its data.
A front end placed before SQL Server
If 100 users indirectly access SQL Server through a custom web portal, Server/CAL licensing does not count only the portal or service account.
A bot or workflow as intermediary
Automated transfers, pooling, and data rerouting do not automatically reduce the required number of access licences.
Assess another licence model
With many or unknown SQL users, core licensing can be economically and administratively more suitable than Server/CAL.
A single connection pool does not mean a single user. Microsoft states explicitly that multiplexing does not reduce the number of licences required.
A practical example
60 office users, 12 shared devices, and a customer portal
An organisation runs Windows Server, SQL Server, Exchange Server SE, and an application for external customers.
| Use | What to assess | Why? |
|---|---|---|
| 60 office users with Microsoft 365 E3 | Check existing CAL equivalents | M365 E3 can include Windows, Exchange, and SharePoint access rights for the licensed user. |
| 12 shared shift-work PCs | Compare Device CALs with suitable user rights | A small number of devices is shared by many employees. |
| 20 users start remote desktop sessions | Add 20 RDS User CALs or suitable Device CALs | M365 E3 does not automatically include the RDS CAL. |
| Customer portal on two Windows Servers | Check the External User definition, web-workload exception, and potentially two ECs | Without an applicable exception, one EC can be required per accessed server. |
| The portal accesses SQL Server Standard | Compare SQL core licensing with Server/CAL | The portal does not make indirect customer access automatically licence-free. |
Inventory people, devices, server instances, functions, and indirect data flows before forming a defensible and economical licence combination.
Common licensing mistakes
These six assumptions often create gaps
- 01We licensed the server, so every access is included.
- 02An RDS CAL replaces the Windows Server Base CAL.
- 03Microsoft 365 E3 automatically contains every Microsoft server CAL.
- 04Every external contractor can be covered by an External Connector.
- 05One service account means only one CAL is required.
- 06An older CAL can access a newer server version.
At purchase and every review
Ten questions for defensible access licensing
- 01Which server products and versions are actually running?
- 02How is every server instance or core correctly licensed?
- 03Which people and devices access each product directly or indirectly?
- 04Does the use require a Base CAL, Additive CAL, or both?
- 05Are User CALs, Device CALs, or an evidenced combination more economical?
- 06Which Microsoft 365, Office 365, or online-service licences are genuine CAL equivalents?
- 07Do some users still require separate RDS, SQL, or Project Server rights?
- 08Do supposedly external people meet the definition effective since October 2024?
- 09How many servers do external people actually reach, and which ECs would be required?
- 10Are versions, multiplexing, agreement programme, and active SA or subscription prerequisites documented?
The key takeaway
Always assess the server, access, and advanced function separately.
A server licence does not replace a CAL. An Additive CAL does not replace the Base CAL. A Microsoft 365 licence replaces only the access rights Microsoft expressly identifies as CAL equivalents for that exact SKU and user.
Current and verifiable
Official Microsoft sources used for this article
CAL equivalents, External User rights, subscription prerequisites, and available products depend on the SKU, agreement, programme, and date. Current Product Terms and contract documents remain authoritative.
- 01Microsoft Licensing Guidance: Base and Additive CALs↗ (opens in a new tab)
- 02Microsoft Licensing: Server and Windows Server CAL FAQs↗ (opens in a new tab)
- 03Microsoft Licensing: Updated External User definition↗ (opens in a new tab)
- 04Microsoft Learn: Remote Desktop Services CAL licensing↗ (opens in a new tab)
- 05Microsoft Product Terms: Windows Server Standard and Datacenter↗ (opens in a new tab)
- 06Microsoft Product Terms: CAL and ML Equivalency Licenses↗ (opens in a new tab)
- 07Microsoft Product Terms: Exchange Server↗ (opens in a new tab)
- 08Microsoft Product Terms: SharePoint Server↗ (opens in a new tab)
- 09Microsoft Product Terms: Project Server↗ (opens in a new tab)
- 10Microsoft Product Terms: Skype for Business Server↗ (opens in a new tab)
- 11Microsoft Licensing Guidance: Multiplexing↗ (opens in a new tab)
- 12Microsoft Licensing Guidance: SQL Server↗ (opens in a new tab)
Note: This article provides clear general guidance and does not replace individual agreement, licensing, or legal review.