Demystifying RDP part 3: Understanding Microsoft RDS and VDI licensing
When the Parallels Secure Workspace team and I talk with partners and customers, we frequently hear the same question about Microsoft RDS and VDI licensing.
How much does Microsoft RDS and VDI licensing cost?
The technology and architecture basis below RDS and VDI is complex, and the rules of the game are constantly evolving.
There is a vast matrix of possibilities!
When buying RDP-related licenses, you must work with a good advisor and thoroughly examine the Microsoft Product terms.
Before continuing with this blog post, read our blog post on the options and components of RDP. You should also check out part 2 on accessing and visualizing RDP environments.
Ready to start your journey with Parallels Secure Workspace? Download your free trial now.
The basics of RDS licensing
What is a CAL?
CAL stands for Client Access License in the context of Microsoft Remote Desktop Services (RDS) licensing.
A CAL is a software license granting a user or device the right to access and use Microsoft RDS features and services on a Windows Server. Microsoft defines a CAL as a Client Access License or a license that gives a user permission to access the services of the server. You probably depend on the network server software to perform file and print-sharing functions if your workstations are networked. Therefore, a CAL or client access license may be necessary to access this software legally.
When do you need a Microsoft RDS (Remote Desktop Services) CAL?
You need a CAL when you use Remote Desktop Services (RDS). According to Microsoft, each user and device that connects to a Remote Desktop Session host needs a client access license (CAL).
What about an RDP connection to a VDI (without using RDS)?
An RDS CAL is unnecessary for an RDP connection to a VDI (without RDS).
That said, you will need a Windows VDA (Virtual Desktop Access) license if you have an RDP connection to a VDI (not using RDS).
This requirement is covered with Windows E3 and E5 licenses and can also be purchased on top of Windows if you do not have the E3 or E5 versions.
Windows E3 or E5 is the evolution of the former Windows SA (Software Assurance). The former is typically user-based, while the latter is device-based licensing.
As Microsoft mentions, Windows Virtual Desktop Access (VDA) is an authorization strategy that requires each device seeking access to a Windows virtual desktop in a virtual desktop infrastructure (VDI) to be licensed.
VDA is a feature of Windows E3 and E5 subscriptions, meaning that primary users of devices with such a license can access their virtual desktops at no extra charge.
In a special case where you need to access a Windows client (and thus a VDI scenario) by using an RDS platform, you would require both the Windows VDA license (as part of Windows E3 or E5 or a standalone license) as well as an RDS CAL.
The picture below illustrates this on a high level:
RDS and VDI licensing options at a glance.
RDS CAL licensing options
Now that we have the basics covered, let’s go one level deeper into RDS CAL licensing.
The RD license server
This role is mandatory for Microsoft to be set up in your RDS environment. The RD license server can be deployed on the RD Session Host for small deployments.
For larger deployments, a separate virtual machine (VM) is advised. CALs must be uploaded to the license server.
If an appropriate RDS CAL is available from a license server, the client can connect to the RD Session Host server, provided the RDS CAL is also issued to the client. From there, they can connect to the desktop or apps they want to use.
There are typically grace periods during which the license server will accept connections.
What types of RDS CAL exist?
You must choose between a user CAL and a device CAL when using RDS.
In Microsoft RDS, there are two main types of CALs:
Device CAL (Per device ER DEVICE)
Each specific device has a device CAL assigned to it, allowing any user who logs in to that device to access RDS services. It is a device-based licensing model, meaning one Device CAL is required for each device that needs access, regardless of the number of users who use that device.
- CALs are physically assigned to each device
- CALs are tracked by the license server
- CALs can be tracked regardless of AD membership
- Up to 20% of CALs can be revoked
- CALs cannot be over-allocated
User CAL (Per user)
User CAL is assigned to a specific user, allowing that user to access RDS services from any device. It is a user-based licensing model, meaning one User CAL is required for each user who needs access, regardless of how many devices they use to connect.
- CALs are assigned to a user in AD
- CALs are tracked by the license server
- CALs cannot be tracked within a workgroup
- You cannot revoke any CALs
- CALs can be over-allocated (breach w/ agreement)
Organizations typically choose between User CALs and Device CALs based on their specific needs and the licensing model that aligns with their usage patterns. It’s important to note that CALs are separate from the Windows Server licenses themselves.
In addition to the server license, they are required to ensure compliance with Microsoft’s licensing terms. Failure to have the appropriate CALs can result in licensing violations and potential legal consequences.
Comparison of RDS CALs (for Windows Server 2016)
Not upward compatible.
As I explained in our RDP introduction blog, RDS is tied to a Windows Server version; i.e., the RDS versions of Windows Server 2008R2 and 2016 are hardwired into each platform and are pretty different from each other in terms of functionalities and performance. Now comes the tricky part: the CALs you bought for a Windows Server 2012 deployment will not be accepted on a Windows Server 2016 platform if you didn’t purchase the Software Assurance. However, the 2016 RDS CAL is downwards compatible with RDS 2012.
According to Microsoft, any RDS license server can host licenses from all previous versions of Remote Desktop Services plus the current version of Remote Desktop Services.
However, upward compatibility is possible if Software Assurance has been purchased for the RDS CAL licenses. In that case, you can upgrade to the latest available version.
If Software Assurance was not purchased, new RDS CALs must be purchased.
The following table puts the theory into practice (in case of no Software Assurance):
Microsoft RDS CAL version compatibility.
Ready to explore what Parallels Secure Workspace can do for you? Get your trial download here, and check out Part 1 and Part 2 of our series explaining RDP.
