Buying enough Windows Server 2025 core licenses does not automatically license the people and devices that will access the server.
For Windows Server 2025 Standard and Datacenter, Microsoft separates server licensing from access licensing. The server itself is licensed through the applicable core model. Users or devices accessing that licensed Windows Server environment generally need a Windows Server Client Access License, commonly called a CAL.
The difficult part is deciding whether to license by user or by device. A company with 40 employees using laptops, desktops and mobile devices may be better suited to User CALs. A warehouse with 100 shift workers sharing 25 terminals may get much more sensible coverage from Device CALs.
This guide explains that decision using actual workplace scenarios, while also covering CAL version compatibility, remote workers, branch offices, external users and the separate RDS CAL layer.
A Windows Server CAL is an access right.
It does not license the physical CPU cores of your server. It does not give you another Windows Server VM. It is not a copy of Windows Server, and it does not add features to the operating system.
Instead, it gives an assigned user or device the right to access appropriately licensed Windows Server software, subject to the applicable Microsoft licensing terms.
That creates two different licensing questions:
Server question: Is the Windows Server installation itself properly licensed?
Access question: Are the users or devices accessing that server properly licensed?
A business can answer the first question correctly and still have a CAL problem.
For example, suppose a company fully licenses a 24-core server with Windows Server 2025 Standard. That solves the server-side core requirement. If 50 employees then authenticate to that server for files, applications, Active Directory or other Windows Server services, the organization must separately evaluate CAL coverage for those users or their devices.
The fundamental difference is simple.
| CAL type | Assigned to | Best suited to | Access model |
|---|---|---|---|
| User CAL | A specific user | People who use multiple devices | Licensed user can access licensed Windows Servers from their devices |
| Device CAL | A specific device | Shared computers, terminals and shift environments | Licensed device can be used by multiple people to access licensed Windows Servers |
The server capabilities being accessed do not suddenly become different because you choose User rather than Device CALs.
The difference is what you are counting.
With User CALs, count the people who require access.
With Device CALs, count the devices from which that access occurs.
That distinction can dramatically change the required CAL quantity.
A User CAL is assigned to a user.
That licensed user can access the organization’s licensed Windows Server instances from multiple devices rather than needing a separate base Windows Server CAL for every device the person uses.
Consider an employee named Sarah.
She accesses company Windows Servers from:
If Sarah is properly covered by a Windows Server 2025 User CAL, licensing her by user is usually much cleaner than attempting to assign a Device CAL to every endpoint she might use.
This is why User CALs are often a natural fit for professional, hybrid and remote workforces.
Imagine a consulting company with 40 employees.
Those employees collectively use 65 devices because many have both a desktop and laptop.
If all 40 employees need Windows Server access, the basic comparison is:
User model: 40 User CALs
versus potentially:
Device model: up to 65 Device CALs, assuming all 65 devices access the servers.
The exact commercial comparison still depends on current CAL pricing and whether every endpoint actually accesses Windows Server, but the workforce structure clearly favors investigating User CALs first.
The important variable is the number of unique accessing users, not the number of Windows Servers those users access.
A properly assigned User CAL can allow that user to access the relevant corresponding Windows Server software across the organization’s licensed servers.
A Device CAL is assigned to a device rather than a person.
Any number of users can use that licensed device to access the organization’s licensed Windows Servers, subject to the applicable licensing terms.
This makes Device CALs particularly relevant where many employees share a relatively small number of computers.
Think about:
Training-room computers.
In these environments, licensing every individual employee can make less sense than licensing the smaller pool of devices actually used to access the server.
Suppose a manufacturing facility employs 90 workers across three shifts.
There are 30 fixed workstations, and every worker accesses Windows Server resources only from those shared terminals.
The high-level comparison is:
User model: 90 User CALs
versus:
Device model: 30 Device CALs
That workforce pattern strongly favors evaluating Device CALs.
But there is an important condition.
If some of those 90 employees also access Windows Server from personal laptops, home computers or other company devices, the access model changes. A Device CAL assigned to one factory terminal does not license an employee when that employee switches to an unlicensed laptop.
The device strategy works best when server access genuinely stays on the shared devices.
Do not choose between User and Device CALs merely by comparing the number of employees with the number of PCs on an asset inventory.
Count the people and devices that actually access Windows Server.
A useful decision process is:
If your users greatly outnumber the devices, Device CALs deserve attention.
If your devices outnumber the users, User CALs often make more sense.
If both groups contain very different working patterns, a mixed model may be more appropriate.
Remote work is one of the clearest situations where licensing by user can simplify the design.
Suppose 25 employees can work from the office or remotely.
Each employee has a corporate laptop, while some also use a workstation at headquarters or another approved endpoint at home.
A device-based model may require you to keep track of every device through which Windows Server access occurs.
A User CAL follows the licensed user instead.
This does not mean remote work technically requires User CALs. Device CALs remain valid where the devices themselves are the logical licensing unit.
The point is economic and administrative: one person using several endpoints is the pattern User CALs were designed to handle.
Physical location is not the deciding factor. Working from home does not remove the Windows Server access-licensing requirement simply because the employee is outside the office.
Now reverse the scenario.
A distribution center employs 120 staff, but Windows Server access occurs through only 24 shared workstations distributed around the site.
Employees arrive for their shifts, authenticate from one of those shared devices and do not access company servers from personal devices or home.
Licensing 120 individuals could be unnecessary if access can instead be appropriately covered through the 24 devices.
This is exactly where a Windows Server Device CAL can be more efficient.
Device CALs are therefore worth investigating when your environment has:
The more users rotate through the same endpoints, the stronger the potential case for Device CALs.
A branch office does not automatically require its own special type of Windows Server CAL.
The decision still comes back to users versus devices.
Imagine a company with headquarters and four branch offices.
Thirty sales employees move between offices and regularly use laptops. Licensing by user is often easier because their Windows Server access is tied to the employees rather than one particular workstation at one particular location.
Now imagine that each branch contains three fixed workstations that are shared by many part-time employees.
Those devices could create a much stronger Device CAL case.
The geographic layout is secondary.
What matters is who or what accesses Windows Server.
A User CAL assigned to an employee is not normally a “one server” or “one branch office” access license. Likewise, a Device CAL is based on the licensed device, not the building in which that device happens to sit.
Organizations do not necessarily have to make one global User-versus-Device choice.
Microsoft permits customers to use a combination of User and Device CALs.
This can make sense in a company with two very different workforces.
Suppose a business has:
The important part is maintaining enough valid access licenses so every relevant user or device access path is properly covered.
For a pure User CAL model, the starting calculation is:
User CAL requirement = number of unique users requiring Windows Server access
For a pure Device CAL model:
Device CAL requirement = number of unique devices used to access Windows Server
That sounds simple, but inventory quality matters.
Suppose a business employs 60 people.
Only 45 actually access Windows Server.
If the organization licenses by user, the calculation should focus on those 45 accessing users rather than blindly licensing every person on the payroll, subject to any applicable licensing or agreement requirements.
Likewise, a business may own 100 PCs but only 55 of them ever connect to Windows Server resources. The Device CAL calculation should be based on the actual licensing requirement, not simply a hardware purchase report.
The hard part is usually not arithmetic.
It is discovering all the access paths.
CALs are frequently misunderstood as server-specific licenses.
Suppose one employee accesses:
That does not normally mean the employee needs five Windows Server User CALs.
A Windows Server User CAL is assigned to that user and permits access to the corresponding Windows Server version, or permitted earlier versions, across the customer’s appropriately licensed servers.
Similarly, one Device CAL is assigned to a device rather than separately to each Windows Server the device contacts.
This is one reason you should not calculate base CAL requirements by multiplying:
users × number of Windows Servers
That is not the Windows Server CAL model.
Another mistake is assuming a CAL is unnecessary because users do not connect directly to Windows Server.
Consider an internal application.
Employees open a web or desktop front end. That application then retrieves information from a Windows Server backend on their behalf.
The fact that another application, middleware component or pooling device sits between the employee and Windows Server does not automatically reduce the number of required Microsoft access licenses.
Microsoft refers to this type of architecture as multiplexing or indirect access. In general, multiplexing does not eliminate CAL requirements for users or devices that ultimately access Windows Server functionality, data or services.
This is especially important when designing large application platforms.
Do not calculate Windows Server CALs from the number of middleware servers or database connections if hundreds of people are actually accessing the service through them.
A base Windows Server CAL is fundamentally a licensing entitlement, not server software that you install to unlock another user account.
This is a common point of confusion because Remote Desktop Services has its own licensing infrastructure and RDS CAL management.
Standard Windows Server User and Device CALs should not be confused with RDS CALs.
Buying more base Windows Server CALs does not involve increasing the physical core count, enabling an operating-system role or converting Standard into Datacenter.
It covers access rights.
Organizations should therefore maintain accurate purchasing and assignment records even though a standard Windows Server CAL is not something an administrator simply “adds” through Server Manager to increase an on-screen user counter.
Yes. CAL version rights work backward, not forward.
A Windows Server 2025 CAL can provide access to Windows Server 2025 and permitted earlier Windows Server versions.
This is useful in mixed estates.
For example, an organization may operate Windows Server 2025 domain controllers while an older application still runs on Windows Server 2022. A correctly licensed Windows Server 2025 CAL can cover the corresponding user or device access to those earlier Windows Server versions.
The opposite direction is the important trap.
As a general version-rights principle, no.
A Windows Server CAL permits access to the corresponding server version and earlier versions, not later server releases.
That means an ordinary Windows Server 2022 CAL should not be treated as sufficient access licensing for Windows Server 2025.
If an organization upgrades its server infrastructure from 2022 to 2025, CAL compatibility must be reviewed as part of the migration budget.
Some customers may have subscription licensing, Software Assurance or other commercial rights that provide access to newer CAL versions. Those rights depend on the actual licensing agreement and should be verified rather than assumed.
The safe planning principle is:
Newer CAL to older server: generally supported.
Older CAL to newer server: generally not sufficient without additional upgrade/version entitlement.
Another source of confusion appears when a business owns current Windows Server licensing but runs an older Windows Server version.
Server downgrade rights concern which server software version the organization is entitled to run.
CAL version rights concern which server versions a particular CAL can access.
These are related but separate.
Do not assume that because a Windows Server 2025 server license gives you a right to run an earlier server version, every older CAL automatically gains rights to access Windows Server 2025 later.
When planning an eventual return to the current release, include CAL versioning in the upgrade plan.
Remote Desktop Services adds another licensing layer.
A Windows Server CAL is the base access license for Windows Server Standard or Datacenter.
An RDS CAL is an additive access license associated with Windows Server Remote Desktop Services functionality.
Where RDS licensing applies, the RDS CAL does not simply replace the ordinary Windows Server CAL.
A user or device may need:
Windows Server CAL + Windows Server RDS CAL
depending on the functionality being used.
This distinction is critical for businesses deploying session-based desktops, RemoteApp or other RDS scenarios.
Buying 50 Windows Server User CALs should not be interpreted as automatically including rights for 50 users to consume RDS functionality.
Likewise, an RDS CAL is not a substitute for properly licensing the Windows Server itself.
Because RDS licensing has additional user-versus-device and administrative-access considerations, it should be calculated as its own layer rather than blended into the base CAL count.
Not every person accessing a Windows Server is necessarily an employee.
Customers, suppliers, business partners and other external users may also need access to applications or services running on Windows Server.
Microsoft provides two broad approaches for qualifying external-user access:
Individual CALs for the users or devices.
Or an appropriate Windows Server External Connector assigned to each server that qualifying external users access.
An External Connector can be useful when a server is accessed by a large or unpredictable external population because it is licensed to the server rather than requiring an individual base CAL for each external user.
However, the definition of an “external user” matters.
Do not assume anyone with a contractor email address is automatically external for Microsoft licensing purposes. Microsoft’s licensing definitions exclude employees and also treat certain regularly engaged or on-site contractors and agents differently.
For a small number of external users, individual CALs may be simpler or more economical.
For a public-facing business application with a large qualifying external population, an External Connector may be worth evaluating.
The correct answer depends on who the users are, which servers they access and the licensing agreement under which the software was acquired.
Not literally every technical network connection should be interpreted as one CAL.
Microsoft licensing includes specific exceptions and special workload rules. For example, certain server-to-server access and particular web or HPC workload scenarios can have different CAL treatment.
There are also product- and program-specific exceptions.
That is why a CAL inventory should focus on genuine Windows Server access rather than trying to count network packets or TCP sessions.
At the same time, do not use technical architecture as a way to artificially hide users. A reverse proxy, application gateway, middleware server or connection pool does not normally erase the licensing requirement for the people or devices accessing Windows Server indirectly.
For unusual public web workloads, automated systems, external-user environments or highly integrated application platforms, verify the current Product Terms for the exact design.
Consider a 35-person professional services company.
Most employees have:
This is a strong User CAL scenario because the user count is lower and more stable than the endpoint count.
Licensing each employee by user avoids having to track CAL coverage for every additional workstation the employee might legitimately use.
Now consider a factory with 150 production employees working across three shifts.
They share 40 fixed PCs and terminals.
They do not normally access the Windows Servers from personal or home devices.
A Device CAL strategy can align much more closely with actual usage:
150 potential users versus 40 accessing devices.
In this environment, licensing the shared devices may be considerably more efficient than licensing every worker individually.
If supervisors also use personal laptops, those users or laptops need to be included appropriately rather than assuming the shared-terminal licensing covers every other access path.
Suppose a company operates ten branches.
Each branch has:
Three shared service-counter PCs.
One manager with a laptop.
Twenty rotating employees.
The shared counters are good candidates for Device CALs because many employees use a limited number of devices.
The ten managers may be better candidates for User CALs if they access servers from their branch laptop, headquarters devices and home.
This is an example where a mixed CAL strategy can be much more logical than declaring that the entire company must use User CALs or the entire company must use Device CALs.
Imagine an organization with 70 employees and a bring-your-own-device policy.
Employees may access approved Windows Server resources from:
Company desktops.
Company laptops.
Home PCs.
Personal tablets.
Other managed endpoints.
Trying to keep a Device CAL inventory aligned with that changing endpoint population can become difficult.
A User CAL model can be easier because access is licensed around the 70 named people rather than an unpredictable collection of devices.
The organization still needs technical security controls for BYOD. CAL assignment does not replace identity management, conditional access, VPN security, endpoint management or other technical protections.
Licensing entitlement and cybersecurity controls solve different problems.
The first common mistake is believing that core licenses replace CALs. They do not. Core licenses cover the Windows Server software on the server; CALs cover qualifying user or device access.
The second is purchasing Device CALs for a workforce that regularly uses several devices. The apparent saving can disappear quickly once every accessing endpoint is counted.
The third is doing the opposite: buying User CALs for hundreds of shift workers when all server access occurs through a small set of shared terminals.
Another mistake is assuming Windows Server 2022 CALs automatically cover Windows Server 2025. CALs generally provide rights to the corresponding or earlier server versions, not later ones.
Businesses also frequently confuse a base Windows Server CAL with an RDS CAL.Remote Desktop Services can require an additive RDS access license on top of the base Windows Server access requirement.
Finally, indirect access is sometimes ignored. Putting an application layer between the employee and Windows Server does not necessarily eliminate the CAL requirement.
Before purchasing CALs, document the real environment:
With those answers, the User-versus-Device decision becomes much more concrete.
Choose User CALs when people are the stable licensing unit.
They are particularly well suited to employees who use multiple computers, hybrid workers, mobile staff, managers who move between branches and organizations with fewer users than accessing devices.
Choose Device CALs when endpoints are the stable licensing unit.
They are usually more attractive for shared workstations, call centers, factories, warehouses, clinical stations, kiosks and multi-shift environments where many people use the same limited number of devices.
Use a mixed model when the organization contains both patterns.
And remember that the CAL decision is separate from the Windows Server edition decision. Choosing Windows Server 2025 Datacenter instead of Standard does not remove the ordinary base CAL requirement. Likewise, purchasing the required core licenses for the server does not automatically license every employee to access it.
For most organizations, the most reliable purchasing method is simple:
License the server first. Then license the people or devices that access it. Then identify any additive functionality, such as RDS, that creates another access-licensing layer.
That approach keeps Windows Server 2025 CAL planning aligned with the way the business actually works instead of treating CALs as an afterthought.
Calculate Windows Server 2025 core licensing for 16-, 24- and 32-core hosts, Standard VM stacking, Datacenter, and real server scenarios.
Learn how Windows Server 2025 Datacenter licensing works, when unlimited virtualization justifies the cost, and when Standard is still the better choice.
Learn how Windows Server 2025 Standard 16-core licensing works, including core minimums, 24- and 32-core servers, VM rights, stacking, and common licensing mistakes.