We have eight Windows Server VMs running entirely in Azure and no on-premises servers. They currently use pay-as-you-go licensing, but we plan to apply Azure Hybrid Benefit with our own qualifying Windows Server licenses under a 36-month term. The VMs include a domain controller, SQL Server, file server, and application server. Employees access the applications through web browsers from local Windows PCs, with the sites connected to Azure through site-to-site VPNs. RDP is used only by administrators, not for regular remote desktop sessions.
Our MSP says we will need Windows Server User or Device CALs because local users and devices access the Azure-hosted servers. However, Microsoft's Azure licensing guidance seems to indicate that CALs are not required for Windows Server instances running in Azure. Is the MSP correct, or are CALs unnecessary in this setup?
3 Answers
Windows Server CALs generally aren’t required for users or devices accessing Windows Server VMs hosted in Azure, whether the VM uses Azure’s included licensing or Azure Hybrid Benefit. The Azure service charges include the access rights that would otherwise be covered by CALs. You still need enough qualifying Windows Server licenses with Software Assurance or an eligible subscription to cover the VMs.
Make sure the Windows licenses actually qualify for Azure Hybrid Benefit and that the licensing quantity is sufficient. A common baseline is at least eight Windows Server core licenses per VM, subject to the edition, license entitlements, and the specific licensing program. SQL Server is a separate issue: for an IaaS SQL VM, you generally need eligible SQL Server core licenses with Software Assurance or a qualifying subscription.
The answer is still no CALs for those Azure-hosted instances, assuming they really are running in Azure and not on an on-premises Windows Server. The exemption applies regardless of whether access comes through a VPN or from users located at a local office. If you later add on-premises Windows Server infrastructure, that separate environment may require CALs; Azure access rights don’t automatically cover it.
The documentation can be easy to misread because it doesn’t always state the CAL exemption in one sentence. For audit protection, it’s worth opening a Microsoft licensing support case and keeping the written response with your licensing records.