RDS CAL licenses for a shared jump server with rotating users

Question

Hi,

I have a Windows 2019 Server used by the DevOps team to monitor and perform certain maintenance activities in a centralized place with all the tools and firewall rules ready.

At any given time, only a maximum of 5 users need access but the team size is a bit bigger (8 to 10) and there is continuous rotation of members.

First, I thought I should just purchase 5 Device CAL licenses and assign them to the Windows Server, but the documentation page is a bit confusing for me: https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-client-access-license

I want these users to login with their Azure AD users, not local users, and for that I don't know if I need User CAL Licenses instead. But then, I don't know if I have to get a license per user or if they can share 5 between them.

I have the following questions:

• Is the Device License the recommended one for my use case?
• Can the device license be used by domain users or only local?
• If I should use the User CALs, are they assigned specifically to a user or can they be shared for by an AD group?
• Does the User License allow the assigned users to connect to other, Windows server then and not only mine?

Sorry for my limited understanding of Windows server licensing. Before posting the question I tried to read multiple blogs and documentation, but I was still not convinced.

Answer 1

Hello there,

At the basic a CAL allow you to consume network service provided by a Windows Server, what this mean is that even if you have a Windows Server license it does not mean you have CAL (Per user or device) to allow access to the network services provided by this server.

Below you will find a starting point regarding CAL : https://www.microsoft.com/en-us/licensing/product-licensing/client-access-license

This tool will help you understand a bit the kind of license you have in your environment : https://learn.microsoft.com/en-us/previous-versions//bb977556(v=technet.10)?redirectedfrom=MSDN

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--