We run eight Windows Server virtual machines entirely in Azure, with no on-premises servers. The environment includes a domain controller, SQL Server, file server, and application servers. Employees access the applications through web browsers from Windows PCs at local sites, connected to Azure over site-to-site VPN. RDP is used only by administrators, and this is not an RDS or Terminal Services setup.
The VMs are currently PAYG, but we plan to switch to Azure Hybrid Benefit using our own qualifying Windows Server licenses with a 36-month term. Our MSP says we will then need Windows Server User or Device CALs because local users and devices access the servers over the VPN.
Is that accurate? My understanding is that Windows Server access licenses are included when the workloads run in Azure, even when Azure Hybrid Benefit is used. Are there any important exceptions or licensing details I'm overlooking?
4 Answers
The conclusion is fairly clear, but the documentation can be easy to interpret differently because some pages explain the Azure PAYG model more explicitly than the bring-your-own-license model. For audit protection, it would be sensible to get written confirmation from Microsoft or have your licensing specialist cite the exact product terms that apply to your agreement. The key distinction is Azure-hosted servers versus any separate on-premises Windows Server installation.
For Windows Server workloads running in Azure, separate Windows Server User or Device CALs generally aren’t required for users or devices accessing those Azure VMs. The access rights are covered by the Azure service model, including when the VM uses Azure Hybrid Benefit. You still need properly licensed Windows Server core licenses with active Software Assurance or an eligible subscription, and the Azure Hybrid Benefit licensing requirements must be met.
The fact that users connect through a site-to-site VPN doesn’t normally change the answer. If the servers being accessed are all Azure-hosted, Windows Server CALs aren’t required for that access. The situation can be different if you also run Windows Server workloads on-premises; Azure’s included access rights don’t extend to separate on-premises servers.
Make sure the SQL Server licensing is checked separately. If SQL Server is running as an IaaS VM, SQL Server core licenses with Software Assurance or an eligible subscription are typically needed to use the applicable hybrid licensing benefits. Also verify that each Windows VM has enough Windows Server core licenses assigned—commonly at least eight cores per VM, subject to the specific Azure Hybrid Benefit rules.
That makes sense. I’ll ask for confirmation in writing and separately verify the Windows core coverage and SQL Server licensing before switching to Hybrid Benefit.