How Many CALs Do You Actually Need? Counting Users Without Guessing

Fix it now

A CAL appears in no console, is not enforced by the software and never stops anything working, which is exactly why counts drift and why a review looks at them first. Count people and count devices separately, per product, and buy whichever number is smaller for each population – you may hold both against the same server.

1. Count user CALs where people reach the server from more than one device, or from hardware you do not own. A user CAL permits one user, using any device.
2. Count device CALs where several people share one machine. A device CAL permits one device, used by any user – and unattended tills, scanners and appliances need one because there is no user to attach a licence to.
3. Buy both, and record the two populations separately. Nothing requires a single model, and forcing one on a mixed workforce produces either a shortfall or a shelf of unused licences.
4. Match the version. Windows Server 2025 CALs permit access to Windows Server 2025 and prior versions, so a newer CAL reaches an older server and never the other way round.
5. Add RDS CALs on top for anyone using a session host – they never replace the base Windows Server CAL – and repeat the whole exercise for Exchange and for SQL Server if it is licensed Server plus CAL, which is Standard edition only.
6. Use an External Connector licence for people outside the organisation rather than trying to buy them individual CALs. It is required for each physical server accessed.

Two exceptions are documented and small. Two users may be given administrative access to server software without CALs, and Remote Desktop supports two concurrent remote connections for administration with no RDS CAL required.

If you have two numbers per product and they are written down with today’s date next to them, the buying decision is done. Below is the counting method in full, the traps that produce a shortfall, and the reassignment rule that governs what you can move later.

Why it happens

Two separate things are being licensed and it helps to keep them apart. The server licence covers the software running on the hardware, priced by physical core on modern Windows Server with a minimum of 8 core licences per processor and 16 per server. The CAL covers the right of a user or a device to access that software. Buying one without the other leaves you half licensed, and the missing half is invisible from inside Windows.

The trigger is access, not login. If a person or device uses the server’s services in any way, directly or through something else, that is an access. This is where undercounts begin, because people count named accounts in the directory and stop – missing the scanner writing to a share, the till authenticating against the domain, and the contractor who connects twice a year. Microsoft closes the obvious escape route explicitly: any method used to pool connections or reduce the number of operating system environments, devices or users a product directly manages does not reduce the number of licences needed.

Remote Desktop Services behaves differently and only half-visibly. RDS CALs are issued by a licence server and can be counted from a console, which makes people assume shortfalls announce themselves. Per-device RDS CALs cannot be over-allocated and up to 20 per cent can be revoked. Per-user RDS CALs can be over-allocated – in breach of the licensing agreement – and none can be revoked. A per-user RDS shortfall is therefore exactly as silent as a Windows Server CAL shortfall, and it is the one people are most confident about.

Full reference

A counting method you can repeat every year

1. List every named human who could reach the server. Include part-timers, contractors, seasonal staff, directors with a mailbox and the external accountant if they connect at all.
2. List every device that connects without a person present: multifunction printers, tills, cameras writing to a share, monitoring agents, building systems and line-of-business appliances.
3. For each human on the first list, write down how many devices they use to reach the server.
4. Move everybody with two or more devices into the user CAL pile.
5. Move every shared device with several users into the device CAL pile, and remove those users from the user pile only where the shared device is their sole route in.
6. Add every unattended device from step two to the device pile.
7. Add the two piles together, then add the headcount you already know is arriving inside the licence period.
8. Repeat the whole exercise per product: Windows Server first, then RDS, then Exchange, then SQL Server if you licensed it Server plus CAL.

Two numbers come out of that. Buy both. There is no requirement to pick one model for the whole organisation, and forcing a single model onto a mixed workforce produces either a shortfall or a shelf of licences nobody uses.

Which model wins, worked through

The traps that produce a shortfall

• Multiplexing. Microsoft’s Universal License Terms state that any method used to pool connections or reduce the number of OSEs, devices or users a product directly manages does not reduce the number of licences needed. You licence the far end of the chain, however many hops sit in between.
• Treating the two administrative Remote Desktop connections as general capacity. They exist to administer the server; running somebody’s daily work through them needs RDS CALs.
• Version drift. Windows Server 2025 CALs permit access to 2025 and prior versions, so upgrading a server without upgrading the CALs leaves every access unlicensed on paper while nothing visibly breaks.
• Assuming CALs are concurrent. They are not. You need a CAL for every user or device with access, not for the peak number connected at once.
• Counting only Windows Server. Exchange Server SE needs a Standard CAL for each accessing user or device, with the Enterprise CAL sold as an add-on requiring one Standard CAL plus one Enterprise CAL.
• Trying to cover the public with individual CALs instead of an External Connector licence.

What you can move, and how often

Counts change, and the Product Terms govern what you can do about it. A licence may be reassigned to another device or user, but not less than 90 days since the last reassignment of that same licence. The published exceptions are permanent hardware failure or loss, termination of the user’s employment or contract, and temporary reallocation of CALs and management licences to cover an absence or an unavailable device. In every case the software must be removed, or access blocked, from the former device or user.

That rule is why joiners and leavers need a process rather than an instinct. Reassigning a departing employee’s CAL to their replacement is explicitly permitted. Rotating a small pool of CALs around a large team as people take holidays is not, and the temporary reallocation allowance is narrower than it first sounds.

Write the count down with its date and its assumptions, and keep it next to the invoices. A CAL count you cannot reproduce is worth very little when somebody asks you to justify it eighteen months later, and reproducing it from scratch under time pressure is how findings get made.

Where the count is zero

The cheapest CAL strategy is not needing them. An office whose files and mail have moved to Microsoft 365 may have nothing left for a server to do, in which case the entire question disappears – no server licence, no core minimums, no CALs, no version alignment at the next upgrade. That is a legitimate answer to ‘how many CALs do we need’, and it is worth putting on the same page as the counting exercise before anybody signs an order.

Questions people ask about this