What is a Windows Server CAL and when do you need it? A CAL (client access license) is the right of a user or a device to access a Windows Server. It is not software and is not installed. With Windows Server Standard and Datacenter, every user or device that accesses the server needs a CAL, in addition to the server license. There are only a few exceptions, for example for publicly accessible web content.
Quick decision
| Situation | CAL needed? |
|---|---|
| Employees sign in to the domain | Yes |
| Access to file shares or printers of the server | Yes |
| Access through an application that runs on the server | Yes |
| Working on the server via Remote Desktop | Yes, plus an RDS CAL |
| Visitors open a public website on the server | No |
| One licensed server accesses another | No |
| Host that only runs virtual machines | No (for the host itself) |
| Windows Server Essentials | No, but fixed upper limits instead |
What a CAL is
For Windows Server, Microsoft separates two rights. The core licenses allow you to run the server software. The CAL allows access to this software. Both together make up complete licensing. How the server side is counted is described in
Licensing Windows Server: cores, VMs, CALs.
The Windows Server CAL is the base client access license. For certain features, Microsoft requires additional client access licenses that are added to the base CAL:
| Client access license | What for | Relationship to the Windows Server CAL |
|---|---|---|
| Windows Server CAL | every access to the server | base |
| Remote Desktop Services CAL (RDS CAL) | Remote Desktop sessions, hosted interfaces | additional |
| Active Directory Rights Management Services CAL | rights management for documents | additional |
The RDS CAL is covered in
RDS CAL: licensing Remote Desktop Services.
Per user or per device
CALs come in two types:
- The user CAL covers one person, regardless of how many devices they use for access.
- The device CAL covers one device, regardless of how many people work on it.
You may mix both types. Which type gives the smaller number in which kind of business is shown in
User CAL or device CAL.
When you do not need a CAL
Microsoft’s product terms name the following exceptions for Windows Server:
| Exception | Meaning |
|---|---|
| Access by another licensed server | server-to-server connections need no CAL |
| Web workload | content of a publicly accessible website |
| HPC workload | compute nodes in a cluster for high-performance computing |
| Physical environment that only hosts and manages VMs | the Hyper-V host itself |
| Synchronization with Microsoft Entra ID | access only for syncing between Active Directory and Entra ID |
Important for the web exception: it concerns public web content. An intranet or a line-of-business application in the browser that your employees sign in to is not such a case. The employees need CALs for that.
For the host exception, what runs in the virtual machines counts: if users access a VM with Windows Server, they need CALs for it. Microsoft gives an example: if a newer version runs on the host only as a hypervisor and an earlier one in all VMs, CALs of the earlier version are enough.
Indirect access counts too
A CAL is also needed when users do not access the server directly but through another system. If 20 employees work with an inventory management system whose service runs on the Windows Server, 20 users or their devices need a CAL. An application placed in front, a portal or a shared account does not reduce the number. Microsoft deals with this under the term multiplexing.
External users
For people outside the company, such as customers or suppliers with access to your server, there are two ways: one CAL per external user or one External Connector license per server, which covers any number of external users. Your own employees and on-site contractors do not count as external; they need CALs.
How to count correctly
- List all people who access any of your Windows Servers, and all devices from which access takes place.
- Decide for each group whether users or devices are the smaller number.
- A CAL is valid for all your licensed Windows Servers of the same or an earlier version. Two servers do not double the number of CALs.
- Choose the CAL version according to the newest server that is accessed, see Which CAL version fits which server.
Sample calculations in license quantities:
- Office with 12 employees, one server: 12 user CALs.
- 25 employees, two servers (domain controller and file server): 25 user CALs, not 50.
- Warehouse with 6 terminals and 18 employees working in shifts: 6 device CALs.
The license calculator takes the numbers: you enter users and devices, it suggests the type with the smaller total and adds the server licenses.
Typical cases
Medical practice with 8 PCs and 14 staff. The PCs are shared. 8 device CALs are fewer than 14 user CALs.
Engineering office with 10 employees, each with PC, laptop and smartphone. 10 user CALs cover all devices. Device CALs would be 30.
Web server with a public online shop. No CALs are needed for the visitors of the website. If employees access the same server internally, for example file shares, they need CALs.
Small business with Essentials. Windows Server Essentials needs no CALs but is limited to 25 users and 50 devices, see
Windows Server 2025 Essentials: limits and use.
At VivaKeys
- Windows Server 2025 User CAL and Windows Server 2025 Device CAL
- Windows Server 2022 User CAL and Windows Server 2022 Device CAL
- Windows Server 2019 User CAL and Windows Server 2019 Device CAL
All client access licenses, including those for SQL Server and Exchange Server, are in the
CALs category. These products have their own CALs; a Windows Server CAL does not cover access to SQL Server or Exchange. More on this in
Licensing SQL Server: core or CAL and
Exchange CAL: Standard or Enterprise.
Frequently asked questions
What do you need a Windows Server CAL for? For every access by a user or device to Windows Server Standard or Datacenter: signing in to the domain, file shares, print services and applications that run on the server.
Do CALs have to be installed or activated on the server? No. According to Microsoft, the Windows Server CAL is not a software product but a right of use. RDS CALs are different: they are installed on a Remote Desktop license server.
Do I need CALs for each server separately? No. A CAL entitles the user or the device to access all your licensed Windows Servers of the same or an earlier version.
What does 5 User CAL or 10 User CAL mean? These are quantities: access rights for 5 or 10 users. You need as many CALs as there are users or devices accessing the server.
Is a Windows Server CAL the same as an RDS CAL? No. The Windows Server CAL is the base for every access. The RDS CAL is added when people work on the server via Remote Desktop.
How does CAL licensing work for Windows Server? You license the server by cores and additionally buy one CAL per user or per device. The CAL must have the version of the server or be newer. For Remote Desktop, one RDS CAL per user or device is added.
Sources
Checked on 2026-11-10 against the publisher’s information:
- www.microsoft.com/en-us/licensing/product-licensing/client-access-license
- www.microsoft.com/licensing/terms/productoffering/WindowsServerStandardDatacenterEssentials/EAEAS
- www.microsoft.com/licensing/guidance/Windows-Server-2025
- www.microsoft.com/licensing/guidance/Base-and-Additive-CALs
- www.microsoft.com/en-us/licensing/product-licensing/windows-server