Windows Server 2025 CAL Review: User or Device, and How Many You Need

Fix it now

A client access licence is not software. Nothing installs, nothing activates and nothing stops working if you are short, which is exactly why this is the easiest part of Microsoft licensing to get wrong. It is a purchased right for a user or a device to access a Windows Server, and the only place its absence shows up is a review of your records.

1. Buy one per user or per device that accesses the server. The server licence covers the software; it grants nobody the right to use it.
2. Pick the type by ratio, not preference: a user CAL covers one user on any device, a device CAL covers one device used by any user. Count both ways and buy the smaller number for each group.
3. Match the version to your newest server. A CAL allows access to its own version of the server software and earlier ones, never a later one.
4. Buy one set for the organisation, not one per server. A CAL covers that user or device across your licensed servers.
5. Use a Windows Server External Connector where external users are involved, remembering that it is priced per physical server accessed.
6. Write down who holds what, with dates. A spreadsheet is what a review actually asks for, and its absence is itself the finding.

Mixing user and device CALs across the organisation is normal and usually cheapest. Nothing requires you to standardise on one type for tidiness.

If you know your counts and your CAL version matches your newest server, you are done. If you are not sure your count is defensible, the next section covers where it usually goes wrong.

Why it happens

The server licence permits you to install and run Windows Server on hardware. It grants nobody the right to use it. That second right is the CAL, and it is required for authenticated access to server functionality: file shares, print queues, directory authentication, and applications hosted on the server.

Unlike Remote Desktop Services CALs, Windows Server CALs are not installed anywhere and not issued by any service. There is no console showing how many you have consumed and no warning when you exceed your entitlement. Everything keeps working, which is precisely the problem: the shortfall appears years later when somebody asks for evidence, and by then the people who made the decisions have moved on.

The two types are defined simply. Each user CAL permits one user, using any device, to access instances of the server software on your licensed servers. Each device CAL permits one device, used by any user, to do the same. That is the whole distinction, and it makes the choice arithmetic rather than preference: count the users, count the devices they use to reach the server, and buy whichever number is smaller for each group of people.

Both types carry the same version rule, and it runs one way. A CAL allows access to the corresponding version of the server software or earlier versions. So 2025 CALs reach backwards across a mixed estate and 2019 CALs do not reach forwards to a 2025 server. Buying CALs that match your newest server and letting them cover everything older is usually both the cheapest and the tidiest way to stay compliant.

Multiplexing is the classic error and it is worth stating in Microsoft’s own terms: using hardware or software that reduces the number of devices or users that directly access the software does not reduce the number of CALs required. Putting middleware, a web front end or a pooled service account between people and the server changes nothing, because the requirement follows the humans and devices at the far end. Any design that claims to need one CAL because only one account connects is describing a position that does not exist.

External access is the other boundary, and there is a specific licence for it rather than a grey area. External users can be covered by CALs each, or alternatively by a Windows Server External Connector licence, which is acquired for each physical server that is accessed. That per-server basis is the part people miss when they price it: three servers reachable by external users means three External Connectors, not one.

Full reference

User or device: pick by the ratio

Where the count goes wrong

• Counting concurrent users. Windows Server CALs are assigned to named users or specific devices; there is no concurrency model to count against.
• Assuming CALs are per server. One CAL covers that user or device across your licensed servers, so a second small instance does not double the count.
• Using older CALs against a newly deployed server. The version rule only runs backwards.
• Forgetting devices that authenticate with nobody sitting at them: the multifunction printer scanning into a share, the till, the badge reader, the monitoring appliance.
• Leavers. A CAL assigned to somebody who left two years ago is not covering their replacement unless somebody reassigned it and recorded that they did.
• Assuming a service account reduces anything. It does not, and multiplexing is the rule everyone reads about after the review rather than before.

Reassignment, records and what a review asks for

Licences may be reassigned to any of your licensed servers within the same server farm as often as needed, and reassigning a CAL when staff change is ordinary practice. The condition is that it is actually done and recorded, because the record is the only evidence the entitlement exists. There is no technical artefact to point at.

Build the list once and maintain it. Each purchase, the quantity, the type, the version, and which named users or devices it is assigned to, with dates. It takes an afternoon and it is the difference between a routine review and an expensive one. If your organisation cannot produce that list today, that is the finding, regardless of how many CALs you actually bought.

Buying, downgrade rights and Software Assurance

• Volume licence CALs are perpetual and carry downgrade rights, so 2025 CALs can be used against earlier server versions and let you standardise on one CAL version across a mixed estate.
• Software Assurance on CALs is what keeps them current as you upgrade servers, which is the cost to weigh against buying a new CAL version outright later.
• Datacenter includes no CALs. Neither does Standard. The edition changes virtualisation rights, not access rules.
• Windows Server 2025 Essentials is the exception that proves the rule: it does not require Windows Server CALs, and it pays for that with hard user and device ceilings and an OEM-only channel.
• Remote Desktop users need a Windows Server CAL and an RDS CAL. The two stack; budgeting for only one is the most common gap in small deployments.

A count you can defend, in five steps

1. List every user who authenticates to any Windows Server, including administrators, contractors and part-time staff.
2. List every device that authenticates without a person assigned to it.
3. Split staff into groups by working pattern, and price user against device CALs for each group separately.
4. Identify any external access and price External Connectors per physical server against per-user CALs.
5. Record the result, assign the CALs by name, and diary a recount for the next server refresh.

Questions people ask about this