If you run a Microsoft server on-premises (Windows Server, SQL Server, Exchange, SharePoint), the server license itself isn't the whole picture. Anything that connects to it (a user, a device, or both) needs a Client Access License on top. CALs are where most companies either overspend or accidentally fall out of compliance.
The choice comes down to two flavors: User CAL or Device CAL. Here's how to tell which one fits your environment, and where the trap doors are.
What a CAL actually is
A CAL is a paper license. It doesn't get installed and doesn't have an activation key (RDS CALs, which we'll get to, are different and do). A CAL is simply Microsoft's way of saying you've paid for the right to access the server software.
You need CALs for Windows Server Standard or Datacenter, SQL Server licensed under the Server+CAL model, Exchange Server, and SharePoint Server. You don't need them for cloud equivalents (Microsoft 365, Azure-hosted services), which are licensed per user or per seat already.
Two things people get wrong about CALs constantly:
- CALs are not the same as the server license. Buying Windows Server gets you the right to install the OS. It does not get you the right for anyone to use it. You still need CALs.
- CALs have to match (or exceed) the server version. A Windows Server 2022 CAL won't grant access to a Windows Server 2025 server. The newer CAL works backwards (a 2025 CAL covers a 2022 server), but not forwards.
You get a 120-day grace period from server install to procure CALs. After that, you're out of compliance and exposed to a Microsoft Software Asset Management (SAM) audit.
User CAL vs. Device CAL: the core difference
| User CAL | Device CAL | |
|---|---|---|
| Assigned to | A specific person | A specific device |
| Who can use it | That one person, on any number of devices | Any number of people, on that one device |
| Best for | Employees using multiple devices | Devices used by multiple people |
| Tracking | By the server, not enforced | Tracked and enforced by the license server |
| Over-allocation | Possible (and a compliance risk) | Not possible |
A User CAL licenses the person. They can connect from a laptop, a desktop, a phone, a tablet, a home machine, any number of devices, and it's one CAL.
A Device CAL licenses the endpoint. Anyone using that device can access the server. Five people sharing a kiosk PC need one Device CAL, not five User CALs.
When User CALs win
User CALs are the right answer for most modern businesses. The pattern that drives this: most employees today use multiple devices in a typical day. Email on the laptop, Teams on the phone, occasional remote access from a personal machine. If you bought a Device CAL for every endpoint that person touches, you'd be buying three or four CALs per employee for no reason.
User CALs are right when:
- Employees use multiple devices to access the server
- You have an active directory environment with named users
- Headcount is stable or growing
- You have more devices than users in the org
When Device CALs win
Device CALs are the better choice in a narrower set of cases, but in those cases they're significantly cheaper.
Device CALs are right when:
- Shift workers share a fixed set of machines (call centers, retail floors, manufacturing lines, healthcare facilities)
- Kiosks or shared terminals (lobby check-in, warehouse scanners, time-clock stations)
- 24/7 operations where day and night shifts use the same PCs
- You have more users than devices
A 50-person retail store with 10 shared POS terminals needs 10 Device CALs, not 50 User CALs. The math is obvious once you map device count against user count.
What about Remote Desktop Services (RDS)?
If users connect to your server through Remote Desktop Services, that's a separate license on top of the standard CAL. RDS CALs grant remote access; standard CALs grant local access. Most hybrid and remote-work setups need both.
Two practical notes on RDS CALs:
- RDS CALs do have activation keys (unlike standard CALs) and are installed and tracked through the RDS licensing server.
- You can mix RDS User and RDS Device CALs in the same environment, but it makes auditing harder. Pick one as the default.
For pricing on the current versions, Windows Server 2025 RDS User CALs and Windows Server 2025 RDS Device CALs are on the site. The full RDS CAL catalog covers all current and supported back-versions.
Quick decision framework
Three questions get most companies to the right answer:
- Do you have more users than devices, or more devices than users? More users than devices → Device CALs. More devices than users → User CALs.
- Are your devices shared by multiple people on different shifts, or are they personal to one employee? Shared → Device CALs. Personal → User CALs.
- Do users access the server from multiple devices in a typical week? Yes → User CALs. No → either works; pick on cost.
When in doubt, default to User CALs. The industry is moving toward per-user licensing across the board, and User CALs travel with the person if they change roles or devices.
Can you mix them?
Yes, technically. Microsoft permits a mix of User and Device CALs in the same environment. We generally don't recommend it. It makes audit prep harder, makes seat planning harder, and makes the math harder to explain to finance. The exception is when you genuinely have two distinct populations (an office of knowledge workers using User CALs, plus a shared-floor operation using Device CALs). In that case, run them as cleanly separated as you can.
CAL gotchas worth flagging
A few things that catch IT teams off guard:
- CALs don't travel. If an employee leaves, you can reassign the CAL to a new hire. If a device is retired, you can reassign the CAL to a replacement. But CALs can't be sold or transferred to another company.
- Version mismatches are silent. A 2022 CAL connecting to a 2025 server will technically work for a while because Microsoft doesn't enforce CAL versioning at the protocol level. You only find out it's a compliance problem when you get audited.
- Software Assurance covers version upgrades. If you bought your CALs with SA, your CALs upgrade with the server. Without SA, you're buying new CALs on every major version (2019 → 2022 → 2025).
- Software Asset Management audits happen. Microsoft runs them on a regular cadence, and the penalties for being short on CALs are significant. If you ever get a SAM letter, talk to a licensing partner before responding directly.
The bigger licensing picture
For most on-prem Microsoft environments, the licensing stack ends up looking like:
- The server OS license (Windows Server, sold per core, 16-core minimum)
- CALs for every user or device that accesses it
- RDS CALs on top of the above, if remote desktop is in play
- Possibly SQL Server, Exchange Server, or SharePoint Server licenses with their own CALs
It's enough complexity that a 30-minute conversation with a licensing partner usually pays for itself. Our Windows Server 2025 licensing calculator handles the core-count math, and the full Windows Server licensing guide walks through the edition and CAL decisions in more depth.
