Exchange Server SE CAL Review: Standard vs Enterprise CAL, Explained

Fix it now

Exchange has two CAL types and the second is additive: to enable Enterprise CAL features a user must hold one Standard CAL plus one Enterprise CAL. It is also entirely independent of the server edition, so an Enterprise server does not need Enterprise CALs and Enterprise CALs do not need an Enterprise server.

1. Buy a Standard CAL for every user or device that accesses the server. It is always required and it covers ordinary mailbox use.
2. Add Enterprise CALs only for the users who need what they actually unlock: In-Place Archive, In-Place Hold, multi-mailbox search, journal decryption and information protection and control.
3. Check Microsoft’s current CAL comparison before assuming a feature is on the Enterprise side, because retention policies and journaling sit on the Standard CAL.
4. Choose user or device CALs by working pattern. User CALs suit people with several devices; device CALs suit shared workstations used by successive shifts.
5. Check what you already own. Exchange CAL rights are bundled into CAL suites and several Microsoft 365 plans, and organisations regularly buy rights they hold.
6. Skip Enterprise CALs entirely if a third-party archiving or compliance product already covers the requirement. Paying twice for retention is common.

Under Subscription Edition, CALs are covered by active Software Assurance or a qualifying subscription rather than bought outright, so the discipline is keeping the entitlement current rather than matching CAL versions to servers.

If you know which users need the compliance features, you can buy on that. The next section is about what the Enterprise CAL actually contains, which is not what most comparisons say.

Why it happens

Every user or device that accesses the Exchange server needs a Standard CAL. If that person also needs the compliance features, you add an Enterprise CAL for them on top. Microsoft states this plainly: the Enterprise CAL is sold as an add-on to the Standard CAL, and to enable Enterprise CAL features the user must be licensed with one Standard CAL plus one Enterprise CAL. There is no combined licence, so the total for an Enterprise CAL user is two licences rather than one.

Now the part worth checking against Microsoft’s own comparison rather than against a summary, because the split is not where most articles put it. On Microsoft’s current Exchange Server CAL comparison, the Standard CAL side carries email, calendar, contacts and tasks, Outlook on the web, apps for Outlook and Outlook on the web, site mailboxes, role-based access control, journaling and retention policies. The Enterprise CAL adds journal decryption, In-Place Archive, multi-mailbox search, In-Place Hold, and information protection and control, which covers transport protection rules, Outlook protection rules and information rights management search.

Two things follow from that list. Retention policies are not a reason to buy Enterprise CALs, which is the single most common mistake in this purchase and an expensive one across a whole organisation. And data loss prevention does not appear among the Exchange Server CAL features at all, so if transport DLP is your requirement, establish where it is actually coming from before you buy an Exchange CAL expecting it.

Assignment is per user or per device and you may mix the two types. A hundred staff might all hold Standard CALs while only the twenty in finance and legal hold Enterprise CALs as well. That is the intended pattern, and buying Enterprise CALs for everyone because it seems tidier is a straightforward waste of money on a licence most of them will never exercise.

The multiplexing rule applies here exactly as it does elsewhere in Microsoft licensing. A mobile device management gateway, a mail-enabled application or a portal that reads mailboxes on users’ behalf does not reduce the number of CALs owed, because the people at the far end still need covering. Counting only the direct connections is how an Exchange licence position ends up short without anybody noticing.

Under Subscription Edition the CALs are covered by the same entitlement as the servers: active Software Assurance or a qualifying subscription rather than a perpetual purchase. That removes the old trap of CALs falling behind the server version, and replaces it with a different discipline. The subscription has to stay current, and if it lapses the deployment is not licensed regardless of what is installed.

Full reference

What each CAL covers, on Microsoft’s current comparison

If a comparison you are working from puts retention policies or data loss prevention on the Enterprise CAL, check it against Microsoft’s current table before you buy. Retention policies sit on the Standard CAL, and data loss prevention is not listed among the Exchange Server CAL features at all.

Is the Enterprise CAL a purchase you can justify

For most organisations this is a compliance purchase rather than a productivity one, and the test is simple. Has anyone ever asked you to preserve a mailbox against deletion, produce a user’s mail for a dispute, or search across mailboxes without exporting them by hand? If the answer is no and no regulator is likely to ask, the Standard CAL is enough and you should keep the money.

If the answer is yes, it is usually yes for a specific group of people rather than for everybody. Buy accordingly, and record which users hold which tier, because that record is what you will be asked for.

Counting users and devices without getting it wrong

• Every person who uses a mailbox, including part-time staff, contractors and anyone with a delegate relationship.
• Every device that accesses the server with no named user attached to it.
• Users behind any gateway, portal or mail-enabled application that reads mailboxes on their behalf.
• Anonymous senders on the internet do not need CALs. Mail arriving from outside is not access in the licensing sense.
• Room, equipment and shared mailboxes are worth raising with your reseller rather than assuming either way, because Microsoft’s CAL pages do not publish an exemption list for them.

Check what you already hold before ordering

1. List the Microsoft 365 plans your users are on. Several enterprise plans carry equivalent on-premises rights.
2. Check any CAL suites you own, because Exchange Server CAL rights are bundled into them.
3. Identify the users who genuinely need archiving, hold or discovery, and count only those for Enterprise CALs.
4. Check whether a third-party archiving or compliance product you already pay for covers the same requirement.
5. Only then price the shortfall. Organisations that moved most users to the cloud and kept a server for a subset frequently already hold the rights they are about to buy again.

Common ways this purchase goes wrong

• Buying Enterprise CALs for the whole organisation because mixed assignment feels untidy.
• Buying Enterprise CALs for retention policies, which the Standard CAL already covers.
• Buying Exchange Enterprise CALs expecting transport data loss prevention, which is not on Microsoft’s Exchange Server CAL feature list.
• Forgetting the users behind an application or gateway, which is the multiplexing rule catching up with you later.
• Letting the entitlement behind the CALs lapse, which under Subscription Edition leaves the deployment unlicensed even though nothing stops working.

Questions people ask about this