Demystifying RDP part 4: The Windows Server CAL explained

While I’ve covered the RDS CAL, we have yet to get to the Windows Server licensing.

I also previously covered accessing and visualizing RDP environments and the basics of RDP, VDI, and RDS in this series.

When desktops or applications are deployed on Windows Server, licensing requirements apply.

Typically, you’ll need to take a Windows Server CAL (available per user or device) next to (or on top of) the RDS CAL into account.

But first, have you downloaded your free trial of Parallels Secure Workspace?

The Microsoft licensing model

Microsoft has different models for the consumption of RDS CALs. From a high-level perspective, there are several main types:

As per the release mentioned above, Microsoft customers previously had to bring their own RDS CAL with SA to support RDS deployments in the customers’ environment.

Now, a CSP can sell RDS subscriptions directly through the CSP program, eliminating the need for customers and partners to purchase different licenses through various programs.

This model enables a faster licensing cycle due to CSP integration with other Microsoft licenses, including Windows Server, SQL Server, and Office, making it easy for partners to simplify the buying process.  In addition to those license models, special pricing is available for non-profit organizations, educational institutions, etc. Those discounts don’t apply to all models.

VDI licensing options

When do you need Windows Virtual Desktop Access (VDA)?

In the VDI scenario, you remotely connect to a Windows Client (i.e., the operating system that might run on your laptop/desktop). When using VDI and thus not connecting to an RD Session Host or a Windows Server, you don’t need RDS and Windows Server CALs.

However, you do need to make sure that your Windows (client) licensing is properly set up. This is when Windows Virtual Desktop Accessor VDA comes into play.  You will require a VDA license every time you connect to a Windows client that is centrally hosted (i.e., running in a data center or on a virtual machine on a hypervisor). You will also require VDA licensing if you remotely connect to a Windows desktop that is not your primary device (for instance, not your main desktop that is connected to the company network at your office or work site).

You will not require additional VDA licensing when remotely connecting from a Windows device to a desktop or laptop on the company network. For example, a typical scenario is that a desktop is left powered on in the office at night. A remote worker can access that workspace from a personal home device over RDP. Clearly, there are more scalable, secure, or cost-efficient scenarios (from a power perspective), but it is an option, nonetheless.

Now, let’s assume a different user accesses your VDI. In that case, it’s not the primary user accessing their principal device, and thus, additional VDA licensing will be needed to add this additional user. A typical “extra user” is a contractor or a colleague.

Let’s take it one additional step further: if you connect to your primary desktop/laptop that is connected to the company network and you try to connect from a non-Windows device (e.g., an Apple MacBook), then you’ll also need a VDA license or a Windows 10 Enterprise E3/E5 as you’ll discover below.

Windows 10 Enterprise E3, E5, and SA licensing

Windows Virtual Desktop Access (VDA) is included in Windows 10 Enterprise E3 and E5 licenses. With Windows 10 Enterprise E3 and E5 user licensing, you have the rights for remote access for up to five different devices (provided they are linked to the same user). Those include devices with non-Windows operating systems (e.g., an iPad). The host Windows client system can also be hosted in a data center.

Windows 10 Enterprise E3 or E5 is available per device and per-user licensing. Windows SA used to be exclusively available for licensing on a per-device basis, but in 2014, Windows SA and Windows VDA licenses also became available on a “per-user” basis, and Windows SA came with VDA built in.

As of this publication, however, Microsoft is mainly selling Windows 10 E3 and E5 user licenses.

Windows Virtual Desktop

Microsoft has introduced Windows Virtual Desktop on Azure, which has been generally available since September 2019. The licensing requirements for WVD on Azure are different from the default rules.

Can I connect to VDI over RDS?

Yes, that’s a possibility. In such a case, you access the Windows client using the Remote Desktop Services setup. You must purchase a VDA license (which might be covered by Windows 10 Enterprise E3 or E5) and an RDS CAL. You will not need the Windows Server CAL, however.


Given Windows E3 and E5 basically include the Software Assurance, you have the right to upgrade (or downgrade in theory) at any time.

License models

Like RDS, Windows E3, E5, and VDA are available in multiple licensing models. It’s just slightly more complex, however. The table below provides a good overview.

Demystifying RDP 4

The following tree summarizes the options available in some common scenarios:

Decision tree windows CAL

RDP To Linux

Another option is to use the RDP to access a machine without Windows. In today’s world, we can safely assume that it is Linux.

From a Microsoft licensing perspective, no costs apply.

This makes sense, given that you don’t use a Windows client (so no VDA is needed), no Windows Server (no Windows Server CAL is needed), and no RDS (no RDS CAL is needed).

However, license costs might apply for other (non-Microsoft) RDP suites.

RDP licensing, RDS, and VDI all get a boost with Parallels Secure Workspace

Parallels Secure Workspace doesn’t enable you to cut in RDS or VDI-related licenses as such. It is a layer on top, and all the rules of the game will apply.

On the bright side, however, the licensing is much less complex as it is user-based on a concurrent level.

No matter what features you use, how often you use them, from what device you use, or how many applications/desktops you use. Simple and transparent.

Start your Parallels Secure Workspace journey today!