Sean Wallbridge
Kelly and I were having a discussion the other day about Microsoft licensing for a customer and the question of CAL’s came up. Kelly was a bit confused by the whole concept (and she’s NOT alone in that …) so I had to explain to her what it is all about. She said, “There’s a blog post in that!”, so here it is …
CAL’s (Client Access License) are the “right to connect” licenses that Microsoft sells alongside all of their server products. As a general rule of thumb, you require a CAL to connect to a given server (like Server 2012 R2) or a server service (like SQLserver) and the CAL needs to match what you are connecting to. So, if you have a Server 2012 R2 server that hosts SQLserver you would need both a Windows Server CAL and a SQLserver CAL to “talk” to SQL on the server. And, as you might surmise, this can get a whole lot more complicated if you have a lot of Microsoft server products installed.
There are multiple ways of licensing CAL’s but the basics are actually pretty simple … you can CAL by DEVICE or by USER. A DEVICE CAL will license a given device to connect to the appropriate server or service regardless of the user logged in to the device. A USER CAL will license a given user to connect to the appropriate server or service regardless of the device used. Read the two preceding sentences carefully because there is a world of difference between the two CAL types and a possible monumental (and costly) licensing headache for you if you get it wrong. Generally, CAL’s are simply a license that you buy and keep “on the shelf” so that you can pull them out for examination if Microsoft ever audits you (don’t laugh, we have seen a marked uptick recently in the number of Microsoft customers that are getting audited for license compliance). However, there are some types of CAL’s that are actually applied to a server; good examples would be Terminal Server/RDS CAL’s and SharePoint Enterprise CAL’s. And, in the case of Terminal Server/RDS CAL’s you absolutely have to get the CAL type correct as you cannot mix and match DEVICE and USER CAL’s on the same Terminal/RDS server.
Now you might be thinking that CAL cost could quickly add up, and you would be correct, specially so when you start talking about things like SQL CAL’s. Microsoft does have some licensing tricks to help soften the financial blow for certain types of CAL’s. For example, you can license SQLserver using the “processor model” instead of the CAL model. In this case you can purchase SQLserver licenses that license unlimted user/device connections by the CPU socket (physical or virtual) on the SQLserver. There are a clearly defined set of rules that need to be followed in this instance in order to ensure you have the correct number of licenses purchased. But all of that said, it is much more cost effective to go this route if you have a reasonable number of users as CAL cost can mount up very quickly. In many cases the “cross over point” for SQL is between 25 and 30 CAL’s.
Microsoft Cloud services such as Office365 and Azure essentially provide implicit USER CAL licensing, there is no extra explicit CAL licensing required (a definite advantage over traditional licensing and one you need to factor into your calculations when you compare on-premises licensing costs against Cloud licensing costs).
Keep in mind that when you purchase Microsoft on-premise licensing it is incumbent upon you, as part of accepting the licensing agreement, to ensure you have also purchased the appropriate number and type of CAL’s. CAL’s are as much a part of the licensing equation as the actual server license itself. And CAL’s are invariably the thing that organizations get caught out on when they get audited. Rule of thumb: When in doubt make sure you double check with your Microsoft reseller or even with Microsoft themselves. Microsoft, like other software vendors, takes a dim view of organizations that attempt to “skirt the rules”.
Hello Rob,
Is it allowed to mix CAL’s. For example: there are 100 users and 100 devices.
I buy 100 Windows Server USER CAL’s and 100 Exchange DEVICE CAL’s. Is this allowed or do they need to be the same (USER/USER and DEVICE/DEVICE). Many thanks!!!!
Rene
You can mix and match but I would have to ask why you are doing this? A USER CAL allows a USER to access the given service from anywhere on any device. A DEVICE CAL allows a single DEVICE to do the same. If you have Exchange DEVICE CAL’s then you are licensing 100 Devices to access Exchange regardless of the user on the device. So, any user can access Exchange from any of those 100 devices. But, the users cannot access (legally) Exchange form any device that does not have a CAL. Is this what you want? Let’s say you have those 100 devices (eg PC’s) in one room. All your users can access Exchange from any of those 100 devices in that room. But any device OUTSIDE that room can’t access Exchnage. If that is what you want then you are good. However, if you want your users to access Exchange form any device, anywhere then you need USER CAL’s.
Hi Rob,
We have a SBS 2011 with all up 25 standard user cals with sa. Now there are 22 users, 5 shared mailboxes and some of the users have multiple mailboxes setup. The Exchange server console indicates that 50 cals are required. Is this correct should it be 50, I find it all somewhat confusing. thanks.
Wow! That sounds really odd.
From and SBS and Exchange point of view, each HUMAN requires a CAL (unless you are using DEVICE CAL’s in which case every device that access the system requires a CAL). A shared mailbox does not require a CAL neither does an alias or a Distribution Group. When you say that some users have multiple mailboxes set up I’m assuming you mean that they also have multiple Windows logins set up, is that correct? If that is the case then I can understand why the Exchange console would be complaining about the CAL’s as there is no way for it to understand that one HUMAN can have multiple ID’s. My take would be that if you only actually have 22 users and you have 25 USER CAL’s then you are within the terms of the MS license agreement. You might consider aliases instead of separate ID’s/mailboxes to make things a bit “cleaner” but it’s not required. A USER CAL is consumed by ONE HUMAN regardless of how many identities/logins they have on the system.
Hope that helps!
Rob
The Microsoft SQL Server 2012 Licensing Reference Guide states on page 9 “Note: Devices not operated by humans require device CALs, even when connecting to SQL Server indirectly.” Does this mean any I/O device that sends data indirectly to the SQL Server and then that data is stored requires a Device Cal ?
Hi, Gary:
Correct, EVERY connection to a SQL server has to be CAL’s somehow. If you have a lot of devices/users that need to connect you may find it cheaper to look at the processor/core licensing options as it can get expensive very quickly to start purchasing a zillion CAL’s. You r best bet is to add up all the CAL’s you need and compare the cost to licensing SQL by the cpu/core as there is a “saw off point” where the cost for cpu/core licensing becomes much more attractive than CAL licensing.
Robert