Windows Server CALs Explained: User CAL vs Device CAL (and How Many You Need)
User CAL vs Device CAL comes down to what you license: a User CAL covers a person and a Device CAL covers a device, and each gives the right to access Windows Server software. Apart from a few exceptions Microsoft lists, every user or device that accesses the server software needs a CAL.
Buying Windows Server is only half the licensing job. The server license covers the machine. Client Access Licenses (CALs) cover the people or devices that connect to it. Get the CAL count wrong and you’re either under-licensed or paying for licenses you don’t use.
This guide explains what a Windows Server CAL is, the difference between a User CAL and a Device CAL, and how to count what your business needs, with four worked examples you can copy.
What is a Windows Server CAL?
A Windows Server CAL is a license that gives a user or a device the right to access Windows Server software. Microsoft’s Product Terms say that, apart from a few listed exceptions, all server software access requires CALs (or a “CAL Equivalent” license).
That rule is broad on purpose. Apart from the exceptions Microsoft lists (covered below), any user or device that accesses the server software needs a CAL, not only people who sign in to the server’s own desktop.
Microsoft calls this the Base CAL. Some advanced features need an extra Additive CAL on top of it. The most common one is the Remote Desktop Services (RDS) CAL, which we cover in our RDS CALs guide. This article is about the base Windows Server CAL that almost every network needs.
User CAL vs Device CAL: the core difference
Microsoft offers Windows Server CALs in two types:
User CAL: permits one user, using any device, to access the server software.- Device CAL: permits one device, used by any user, to access the server software.
That’s the whole rule. The skill is in matching it to how your people actually work.
| User CAL | Device CAL | |
|---|---|---|
| What it’s assigned to | One named person | One physical device |
| Covers | That person on every device they use | Every person who uses that device |
| Best when | Each person uses several devices (desktop, laptop, phone, tablet) | Several people share one device (shifts, front desk, shared terminals) |
| Watch out for | People who share a PC still each need their own CAL | Each extra device a person uses needs its own CAL |
When User CALs make sense
Choose User CALs when you have fewer people than devices. A typical office worker might reach the server from a desktop at work, a laptop at home over VPN, and a phone that syncs files. With User CALs, that’s one license for that person.
When Device CALs make sense
Choose Device CALs when you have fewer devices than people. Think of a clinic reception PC used by three receptionists across a day, or a shop-floor terminal shared by a whole shift. With Device CALs, that’s one license for that device.
You can mix both
You don’t have to pick one type for the whole company. Microsoft’s licensing guide says customers may use a combination of User and Device CALs (and External Connector licenses) as required. Many small businesses license office staff by user and shared terminals by device.
How to count the CALs you need: 4 worked examples
The method is the same every time:
List everyone who accesses the server, and every device they use to do it.
For each group, count people and count devices.
License each group with whichever number is smaller.
Example 1: A 12-person office where everyone has several devices
- 12 employees.
- Each uses a desktop, a laptop, and a phone to reach files on the server.
- That’s 36 devices.
User CALs: 12. Device CALs: 36. Answer: 12 User CALs.
Example 2: A warehouse with shared PCs across shifts
- 3 shared PCs on the warehouse floor.
- 15 workers across three shifts sign in to them. None of them access the server any other way.
User CALs: 15. Device CALs: 3. Answer: 3 Device CALs.
Example 3: A mixed business
- 8 office staff, each with their own laptop and phone.
- 2 shared kiosks on the shop floor, used by 10 production staff who don’t access the server from anywhere else.
License the office staff by user (8 User CALs, instead of 16 Device CALs). License the kiosks by device (2 Device CALs, instead of 10 User CALs). Answer: 8 User CALs + 2 Device CALs.
The catch: if one of those production staff also checks the server from a personal phone, the kiosk Device CAL doesn’t cover that phone. They’d need a User CAL, or that phone would need a Device CAL.
Example 4: Two servers, same 12 people
Your business from Example 1 adds a second Windows Server for a line-of-business app.
A CAL isn’t tied to a single server. Microsoft’s licensing guide says each user CAL lets one user access instances of the server software on their licensed servers, and each device CAL does the same for one device. So the same 12 User CALs cover those 12 people on both servers. Answer: still 12 User CALs (as long as both servers run a version the CALs cover; see the version rule below).
The version rule: CALs must match or be newer than the server
This is the rule that catches people during a server refresh. Microsoft says CALs permit access to the same version or earlier versions of the server software.
| Your CALs | Can access Windows Server 2025 | Can access Windows Server 2022 | Can access Windows Server 2019 |
|---|---|---|---|
| Windows Server 2025 CALs | Yes | Yes | Yes |
| Windows Server 2022 CALs | No | Yes | Yes |
| Windows Server 2019 CALs | No | No | Yes |
In practice:
If your server runs Windows Server 2025, you need Windows Server 2025 CALs.- If your server runs Windows Server 2022, either 2022 or 2025 CALs work. See the Windows Server 2022 User CAL, the 2022 5 User CAL pack and the 2022 5 Device CAL pack.
- If you run a mix of versions, CALs for your newest server version cover the older ones too.
If you’re choosing between Windows Server 2025 and 2022 for a new server, our Windows Server 2025 vs 2022 guide covers the differences, including this CAL rule.
There’s one useful nuance for virtualization. Microsoft says CALs aren’t required for access to a physical operating system that’s used only to host and manage virtual machines. For example, if a 2025 host runs only 2022 virtual machines, your users need CALs that cover 2022, not 2025.
When you don’t need a CAL
Microsoft lists a few situations where Windows Server CALs aren’t required:
- Server-to-server access. One licensed server accessing another doesn’t need a CAL.
- Public web workloads. Content served on a publicly available website, web app, or web service doesn’t need CALs for the people visiting it.
- High-performance computing (HPC) workloads, as Microsoft defines them.
- A host used only for virtualization. As above, access to a physical OS that only hosts and manages VMs.
- Entra ID sync. The Product Terms say users don’t need Windows Server CALs when the server software is accessed solely to sync Active Directory with Microsoft Entra ID.
If your situation isn’t on Microsoft’s list, assume a CAL is needed.
Employees vs external users
Microsoft treats two groups differently:
- Internal users, meaning your employees and your onsite contractors or agents, need CALs.
- External users, such as customers, suppliers, or partners, can be covered by CALs or by a Windows Server External Connector license. Microsoft says an External Connector is required for each physical server that external users access.
If a small number of outside people sign in to your server, CALs are often simpler. If you expect many external users on one server, ask us about External Connectors through Request a Quote.
Already on Microsoft 365 E3 or E5? Check before you buy
Microsoft recognizes certain CAL Equivalent licenses. Its Windows Server 2025 licensing guide lists the Core CAL Suite and the Microsoft 365 E3 and E5 User subscription licenses as examples. If your users already have one of these, check the Product Terms’ CAL equivalency list before buying separate Windows Server CALs for them.
A note on “per server” mode
The Product Terms also allow a one-time alternative to assigning CALs by user or device: you can dedicate a number of base CALs to one server instance so that up to that many users or devices can access it at the same time. Most small businesses with one or two servers stick with per-user or per-device licensing, because those CALs work across all their licensed servers.
Quick checklist before you order
- Count users and devices that access each server, including remote and mobile access.
- Decide User or Device CALs per group, picking the smaller number for each.
- Match the CAL version to your newest Windows Server version.
- Add RDS CALs on top if people will run desktops or apps on the server through Remote Desktop.
- Decide how external users will be covered.
If you’re setting up a new server, the Windows Server 2025 Standard + 5 User CALs bundle covers the server and your first five users. You can add more Windows Server 2025 User CALs as you grow. Not sure which edition you need? Our Windows Server 2025 Standard vs Datacenter guide walks through it, and you can see every option on our Windows Server licenses page. If you’re planning a move off an older server, our Windows Server 2016 guide covers the wider licensing picture.
Microsoft’s Comparison of Windows Server editions page lists the features in Standard and Datacenter, so you can check what each edition includes.
Frequently asked questions
A User CAL lets one person access Windows Server from any number of devices. A Device CAL lets one device access Windows Server, no matter how many people use it. Choose User CALs when people have several devices each, and Device CALs when several people share one device.
Yes. Microsoft allows a combination of User and Device CALs. Many businesses license office staff with User CALs and shared terminals, such as reception or shop-floor PCs, with Device CALs.
No. A Windows Server CAL lets its user or device access Windows Server on any of your licensed servers, as long as the CAL version is the same as or newer than each server’s version.
No. CALs only cover the same or earlier versions of Windows Server. Windows Server 2025 CALs can access 2025, 2022, and 2019 servers, but 2022 CALs can’t access a 2025 server.
If people use Remote Desktop Services to run a desktop or apps on the server, yes. The RDS CAL is an additional license that sits on top of the base Windows Server CAL, not a replacement for it.
External users can be covered by CALs, or by a Windows Server External Connector license for each physical server they access. The right choice depends on how many external users you have and how many servers they reach.
Need help counting CALs?
Tell us how many servers you have, which Windows Server versions they run, and how many people and devices connect. We’ll help you work out the right mix of User CALs, Device CALs, and server licenses.
- Business or volume orders: request a quote.
- Questions about an order: email support@solveditservices.com (fastest), or call (447) 223-5297.
- More answers are on our FAQ page.