Review

Exchange Standard CAL vs Enterprise CAL: What the Add-On Really Buys

10 min read Updated October 4, 2026 Microsoft Licensing Guides

Fix it now

The Exchange Enterprise CAL is an add-on, not an upgrade: Microsoft’s rule is that a user must hold one Standard CAL plus one Enterprise CAL to use Enterprise CAL features. What the add-on buys is In-Place Archive, In-Place Hold, multi-mailbox search, journal decryption, information protection and data loss prevention – not anything to do with sending mail.

Buy a Standard CAL for everyone. It covers mail, calendar, contacts, tasks, Outlook on the web, apps for Outlook, site mailboxes and role-based access control.
Buy the Enterprise CAL only for the people covered by an archiving, hold, discovery or data loss prevention obligation, on top of their Standard CAL.
Do not buy it for retention policies. Default and custom retention policies, and per-database journaling, are Standard CAL features.
Scope compliance features to a group rather than the whole organisation, and keep the group and the licence list in step.
Check what you already hold. Exchange Online Plan 1 and Plan 2 licences give CAL equivalency for Exchange Server SE, and the larger Microsoft 365 plans carry the same compliance ground.
If mailbox size rather than compliance is the real problem, a quota plus a retention policy solves it on Standard CALs.

If nobody in your organisation is under a retention, hold or discovery obligation, stop here: Standard CALs are the whole requirement. Below is exactly what each level covers and how scope creep turns a targeted purchase into a company-wide one.

Why it happens

Understanding that the Enterprise CAL is additive rather than alternative is the difference between a sensible bill and one paid twice. Microsoft states it directly: the Enterprise CAL is sold as an add-on to the Standard CAL, and to enable Enterprise CAL features the user must be licensed with one Standard CAL plus one Enterprise CAL. There is no such thing as replacing a Standard CAL with an Enterprise one.

The line between the two is not where most people assume. Microsoft’s published Standard CAL list covers email, calendar, contacts and tasks; Outlook on the web with Firefox, Chrome, Safari and Edge support; apps for Outlook and Outlook on the web; site mailboxes; role-based access control; journaling at per-database level; and retention policies, both default and custom. That is a wider list than the phrase ‘basic email’ suggests, and it is why so many organisations are quoted Enterprise CALs they do not need.

The Enterprise CAL adds journal decryption, In-Place Archive, multi-mailbox search, In-Place Hold, and information protection and control – transport protection rules, Outlook protection rules and Information Rights Management search. Data loss prevention sits here too: Microsoft describes DLP as a premium feature that requires an Exchange Enterprise CAL.

You are being quoted Enterprise CALs for retention

You have this one if The requirement is a retention policy that deletes or moves mail after a set period, and somebody has priced Enterprise CALs for the whole company.

Retention policies, default and custom, are listed by Microsoft under the Standard CAL. So is per-database journaling.
What the Enterprise CAL adds in that area is In-Place Hold – preventing deletion while a matter is live – and In-Place Archive, the second mailbox with its own retention.
If the requirement is ‘old mail should go away’ rather than ‘nothing may be deleted while we are in litigation’, you already have it.

A feature was enabled organisation-wide

You have this one if A data loss prevention policy applies to the whole transport pipeline, or a hold covers every mailbox, and only the compliance team ever looks at the results.

Licensing follows the users whose mail the capability operates on, not the users who read the reports. If the feature is applied to a mailbox, that mailbox’s user needs the Enterprise CAL.
Scope the policy to a security group, and review the group and the licence list together on the same schedule.
It takes one afternoon for somebody to widen a policy to all users, and an audit to discover it. Put the scoping decision in writing next to the licence count.

The environment is hybrid and DLP is not doing what you think

You have this one if You have licensed Enterprise CALs for DLP, and messages between two on-premises users are not being inspected.

Microsoft states that in hybrid environments with some mailboxes on-premises and some in Exchange Online, DLP policies are applied only in Exchange Online.
Messages sent between on-premises users never leave the on-premises environment, so no DLP policy applies to them.
If internal on-premises mail is what you need inspected, confirm the design does what the obligation requires before buying the CALs for it.

Note what is absent from the Enterprise CAL description entirely: no performance benefit, no larger mailbox, no extra protocol, nothing an ordinary user would notice. It exists for the organisation’s obligations, which is why the decision belongs to whoever owns compliance rather than whoever owns the mail server.

Full reference

What each CAL level covers

Capability	Standard CAL	Standard plus Enterprise CAL
Email, calendar, contacts and tasks	Yes	Yes
Outlook on the web (Firefox, Chrome, Safari, Edge)	Yes	Yes
Apps for Outlook and Outlook on the web	Yes	Yes
Site mailboxes	Yes	Yes
Role-based access control	Yes	Yes
Journaling, per database	Yes	Yes
Retention policies, default and custom	Yes	Yes
Journal decryption	No	Yes
In-Place Archive	No	Yes
Multi-mailbox search	No	Yes
In-Place Hold	No	Yes
Information protection and control: transport protection rules, Outlook protection rules, IRM search	No	Yes
Data loss prevention	No	Yes
How it is bought	Per user or per device, for everyone	Additionally, for the same user or device, on top of a Standard CAL

Who genuinely needs the add-on

Start from the obligation rather than the job title. If your organisation is subject to a retention requirement that forbids deletion, faces litigation, handles regulated financial or health information, or has a policy requiring that certain correspondence be preserved and searchable across mailboxes, the people covered by that obligation need the add-on. That is often legal, finance, HR, the board and anyone in a regulated function, and it is frequently a small fraction of headcount.

Work out the subset before you accept a company-wide quote. The exercise is: list the obligations, list the mailboxes each obligation applies to, take the union of those lists, and buy Enterprise CALs for that union only. Anything left over stays on a Standard CAL and loses nothing it was using.

User CALs, device CALs and the additive rule

CALs are required for each user or device that accesses the server software, so you assign to whichever of your two populations is smaller: device CALs where hardware is shared across shifts, user CALs where people work from several machines. The additive rule follows the same unit – the Enterprise CAL sits on top of the Standard CAL for the same licensed user or device, not on a different one.

Mixing is otherwise unrestricted. A warehouse licensed by device and an office licensed by user in the same organisation is normal, and adding Enterprise CALs to a handful of office users does not disturb it. Under volume licensing these CALs also appear inside bundled suites, so check what you already own before buying components separately.

The routes that may already cover you

Two checks are worth making before any purchase. First, Microsoft states that Exchange Online Plan 1 and Plan 2 licences provide Client Access Licence equivalency for Exchange Server SE, so users who already hold an Exchange Online seat may need nothing further. Second, there is a variant called the Enterprise CAL with Services, which adds cloud services on top; Microsoft notes that the cloud data loss prevention in Microsoft 365 comes with that variant and is not sold as a standalone plan. If a quote lists ‘Enterprise CAL’ without saying which, ask.

A quote showing Enterprise CALs alone for part of the workforce is either incomplete or is assuming Standard CALs you already own. Confirm which, because an Enterprise CAL without a Standard CAL underneath it does not license anything.

Cheaper routes that genuinely suffice

No retention obligation and no archiving requirement: Standard CALs for everyone, and nothing more.
Only legal and finance need archiving and hold: Standard CALs for all, Enterprise CALs for those teams, and the compliance features scoped to them.
Mailboxes are simply too large: a mailbox quota plus a retention policy is a Standard CAL feature and often solves the whole problem.
A regulated firm where every message must be preserved and searchable: Standard plus Enterprise CALs across the board, because the policy genuinely applies to everyone.
Users already holding Exchange Online Plan 1 or Plan 2: check CAL equivalency before buying anything for them.
An organisation already on a larger Microsoft 365 plan: check what you own, since the equivalent compliance capability is generally already in the plan.

When a licence is the actual fix

For the users genuinely covered by a retention, hold, discovery or data loss prevention obligation, the Exchange Server SE Enterprise CAL is the licence that makes those features legitimate, and it is bought in addition to their Standard CAL rather than instead of it. Arco supplies both levels in user and device forms. Tell us your headcount and which roles are actually in scope for compliance, and we will quote Standard CALs across the estate with Enterprise CALs only where they are needed, rather than the blanket figure that is easier to produce. We will also check whether Exchange Online seats you already hold give CAL equivalency for Exchange Server SE, and whether a wider Microsoft 365 plan already covers the same ground, before quoting anything new.

Questions people ask about this

Can I buy Enterprise CALs on their own?

No. Microsoft states the Enterprise CAL is sold as an add-on to the Standard CAL, and that to enable Enterprise CAL features the user must be licensed with one Standard CAL plus one Enterprise CAL. A quote listing Enterprise CALs alone either omits the Standard CALs or assumes you already own them.

Do I need the Enterprise CAL for retention policies?

No. Microsoft lists retention policies, both default and custom, and per-database journaling under the Standard CAL. The Enterprise CAL adds In-Place Hold, which prevents deletion while a matter is live, In-Place Archive, multi-mailbox search, journal decryption and information protection. If your requirement is that old mail is removed on a schedule, you already have it.

Does the Enterprise CAL depend on which server edition I run?

No. Server edition and CAL edition are separate decisions that unfortunately share the words Standard and Enterprise. The server edition governs how many mailbox databases can be mounted – five or one hundred. The CAL governs what a person is licensed to use. Enterprise CALs against a Standard server are perfectly normal.

If I put one mailbox on hold, do I need Enterprise CALs for everyone?

Only for the mailboxes the capability is actually applied to. The risk is configuration rather than licensing: organisation-wide policies are far easier to build than targeted ones, so a hold intended for one person is sometimes implemented as a policy covering everybody, and the licence requirement follows the policy scope.

Will data loss prevention cover my internal on-premises mail?

Not in a hybrid deployment. Microsoft states that where some mailboxes are on-premises and some are in Exchange Online, DLP policies are applied only in Exchange Online, and messages sent between on-premises users never leave the on-premises environment so no policy applies. Confirm the design meets the obligation before buying Enterprise CALs to satisfy it.

Was this article helpful?

Your feedback helps us improve our documentation.

Review Exchange Server SE Standard vs Enterprise: It Is About Databases Review Windows 10 ESU or Upgrade to Windows 11? Deciding Machine by Machine Review Windows 11 Home vs Pro: The Four Features That Justify the Upgrade Review Windows 11 Pro vs Pro for Workstations: Who Actually Needs ReFS?

← Back to Knowledge Base