A Microsoft user CAL costs about $42 and a device CAL costs about $42 as well, so the saving comes not from the unit price but from counting the smaller population: users when people outnumber devices, devices when devices outnumber people. A Client Access License (CAL) is the right for a person or a machine to access a Windows Server-based workload. The server license alone is never enough. CALs are where mid-size estates quietly overspend, because the user-versus-device decision is usually made once and never revisited as the workforce changes.
What a CAL is and when you need one
A CAL grants access, not installation. You buy the server license to run Windows Server, Remote Desktop Services, SharePoint Server, or Exchange Server, and then you buy a CAL for every distinct user or device that touches that workload. Internet-facing and unauthenticated access is handled separately through the External Connector license. CALs apply to on-premise and to self-hosted server workloads on Azure infrastructure. They do not apply to the platform-as-a-service equivalents such as Azure SQL Database or SharePoint Online, where access is bundled into the subscription.
User CAL versus device CAL
A user CAL lets one named person access the workload from any number of devices. A device CAL lets any number of people access the workload from one shared device. The rule that decides the cheaper model is a head count comparison. If people outnumber devices, license devices. If devices outnumber people, license users.
| Workforce pattern | Users | Devices | Cheaper CAL |
|---|---|---|---|
| Office knowledge workers, laptop plus phone plus desktop | 1,000 | 3,000 | User CAL (1,000) |
| Shift-based call center, shared workstations | 2,400 | 800 | Device CAL (800) |
| Hospital ward, shared clinical terminals | 1,800 | 500 | Device CAL (500) |
| Remote sales team, personal devices | 600 | 1,500 | User CAL (600) |
Most modern estates have shifted toward user CALs because each person now carries several devices. The exceptions are shift-work environments where many people share few machines. Counting both populations before each renewal is a five-minute exercise that frequently changes the answer.
CAL pricing by workload
CAL list prices vary by the server product they apply to. Windows Server CALs are the base. Remote Desktop Services, SharePoint, and Exchange each add their own CAL on top, which is why bundling matters.
| CAL type | Approx. list (user or device) | Required for |
|---|---|---|
| Windows Server CAL | $42 | Any Windows Server access |
| RDS CAL | $155 | Remote Desktop session hosts |
| SharePoint Server Standard CAL | $110 | SharePoint Server access |
| SharePoint Server Enterprise CAL | $95 (additive) | Advanced SharePoint features |
| Exchange Server Standard CAL | $85 | Exchange mailbox access |
| System Center CAL | $130 | Endpoint management |
Core CAL Suite and Enterprise CAL Suite
The CAL Suites bundle multiple CALs at roughly half the cost of buying them separately. The Core CAL Suite includes Windows Server, Exchange Standard, SharePoint Standard, and System Center management CALs. The Enterprise CAL Suite adds the advanced security and compliance CALs and the enterprise tiers of Exchange and SharePoint. For any organization that uses three or more Microsoft server products, a suite almost always beats standalone CALs.
Negotiation lever: CAL Suites are sold as additive components on top of the base Core CAL, not as a single replacement, so an estate can run the Core CAL Suite for the general population and add the Enterprise CAL Suite only for the smaller group that needs advanced security. Splitting the population this way, rather than buying the Enterprise suite for everyone, commonly removes 20 to 35 percent of total CAL cost without losing any capability the workforce actually uses.
External Connector and unauthenticated access
When external users such as customers or partners access a Windows Server workload, you can either buy a CAL for each of them or buy one External Connector license per server. The External Connector covers unlimited external users for that server. The breakeven is roughly 200 external users per server. Below that, individual CALs are cheaper. Above it, the External Connector wins. Internal employees and contractors are never covered by an External Connector and always require a normal CAL.
When Microsoft 365 replaces CALs
Microsoft 365 E3 and E5 include the Windows Server, RDS, SharePoint, Exchange, and System Center CAL rights as part of the per-user subscription. An estate that has moved its workforce to Microsoft 365 E3 or E5 should not be buying standalone CALs for those same users, yet many do, because the standalone CALs sit on a separate line of the agreement and never get cancelled. This double payment is one of the most common findings in a Microsoft license review. The suite comparison in our Microsoft 365 E3 vs E5 vs F3 guide shows exactly which CAL rights each plan absorbs.
RDS CALs and per-session counting
Remote Desktop Services CALs are the most expensive CAL at about $155 and the most frequently miscounted. An RDS CAL is required for every user or device that connects to a Remote Desktop Session Host, on top of the base Windows Server CAL, so a remote desktop user actually consumes two CALs. The RDS licensing server tracks issued device CALs but does not enforce user CALs, which means an estate can drift out of compliance silently. The grace period for a new RDS deployment is 120 days, after which connections fail without valid CALs. Estates running virtual desktop infrastructure on Windows Server should reconcile RDS CAL counts every quarter, because the connecting population changes faster than the license records.
CAL versions and Software Assurance
A CAL must be the same version as the server it accesses or newer, which is the rule that quietly forces upgrades. A Windows Server 2025 deployment requires Windows Server 2025 CALs, and CALs bought for an earlier server version do not cover a newer one unless they carry Software Assurance. SA on CALs grants the right to use the latest version, so an estate with SA can upgrade the server without repurchasing every CAL. Without SA, every server upgrade triggers a full CAL repurchase. This is the single strongest argument for attaching SA to CALs in an Enterprise Agreement, and it should be modeled against the upgrade cadence rather than assumed.
| Scenario | CAL version rule | Cost effect |
|---|---|---|
| Server upgraded, CALs without SA | Repurchase all CALs at new version | Full CAL cost again |
| Server upgraded, CALs with SA | Use-rights to latest version included | No CAL repurchase |
| Newer CAL, older server | Permitted (CALs are forward compatible) | No issue |
| Older CAL, newer server, no SA | Not permitted | Compliance gap |
Multiplexing and the indirect access trap
Multiplexing does not reduce the number of CALs required, and assuming it does is one of the most expensive CAL mistakes. When users access a Windows Server workload through a middle tier, a web portal, or a pooling application rather than connecting directly, Microsoft still requires a CAL for each distinct end user behind that middle tier. A reporting application that lets 5,000 employees view data drawn from a SQL Server or a SharePoint Server requires CALs for all 5,000, not for the single service account the application uses to connect. This indirect access principle applies across the Microsoft server estate and mirrors the indirect-access exposure that drives findings at other vendors. The counting boundary is the human or device at the edge, never the application in the middle.
Counting and compliance in practice
A defensible CAL position rests on three counts kept current: total users, total devices, and the access path for each server workload. The reconciliation that recovers the most money compares standalone CAL lines against Microsoft 365 E3 and E5 coverage, because any user on E3 or E5 already holds the core CAL rights and a parallel standalone CAL for that user is pure waste. The second highest-value check is the user-versus-device split, which should be recalculated at each renewal rather than carried forward. The third is the RDS and External Connector boundary, where the breakeven math changes as the external population grows. Together these three checks typically remove 10 to 20 percent of CAL spend in an estate that has not reviewed its position in three years.
CAL Suites versus the Microsoft 365 path
The strategic question behind every CAL renewal is whether to keep buying CAL Suites or move the population to Microsoft 365, and the answer turns on three factors: how many server workloads the users touch, whether the organization wants the security and compliance features that only the cloud suites carry, and the size of the existing on-premise server estate. For a workforce that uses Exchange, SharePoint, and Windows file and print services on-premise and needs no cloud productivity, the Enterprise CAL Suite remains the lower-cost option at roughly half the price of standalone CALs. For a workforce already moving mail and documents to the cloud, Microsoft 365 E3 folds the same CAL rights into a per-user subscription that also delivers the cloud services, so paying for both is pure duplication.
The migration is rarely all-or-nothing. Most estates run a hybrid period where some users sit on cloud subscriptions and others remain on on-premise CALs, and the cost discipline is to ensure no user holds both at once. A reconciliation that tags every user with exactly one access model, cloud subscription or standalone CAL, removes the most common source of waste. The same reconciliation should confirm that service accounts and shared devices are licensed under the device-CAL model rather than consuming user subscriptions they do not need.
Server placement changes the calculation again. When a Windows Server workload moves to Azure as an infrastructure virtual machine, the CAL requirement follows it, because self-hosted server software on Azure still requires CALs for the accessing users or devices. Only when the workload moves to the platform-as-a-service equivalent, where access is bundled into the service, does the CAL requirement disappear. Estates planning a cloud migration should map which workloads become platform services, and therefore shed their CALs, and which remain infrastructure virtual machines that carry the CAL obligation with them. This mapping feeds the same baseline that drives the renewal and connects directly to the Windows Server on Azure decision.
The review cadence that keeps CAL cost honest
The recurring discipline is a quarterly count and an annual decision. Each quarter, reconcile the user and device populations and the access paths for every server workload so the position never drifts out of compliance or into waste. Once a year, at the renewal, decide whether each population stays on CAL Suites or moves to a Microsoft 365 subscription, and confirm that no user carries both at once. Estates that hold this cadence keep CAL spend tracking actual access rather than the high-water mark that a series of annual true-ups would otherwise leave in place, and they walk into each renewal with a defensible count rather than an inherited one.
Before any Enterprise Agreement renewal, reconcile your CAL lines against your Microsoft 365 coverage and your server estate on Azure. The full method sits in our Microsoft licensing pillar and EA complete guide, and a managed reconciliation is available through the Microsoft advisory practice and our software licensing advisory service. For self-hosted workloads moving to the cloud, pair this with our Windows Server on Azure analysis.