Standalone CA server, needs just server licensing or CALs?

Question

Company is wanting to go Entra only (no on-prem AD users). We need an internal standalone CA server setup for the certificate side, but want to confirm on the licensing side that just server licensing is needed and nothing like CALs are needed. Most of my colleagues believe certificate services in MS is just a feature that we can turn on so no extra licenses needed.

Answer 1

Hello TBone,

Thank you for posting question on Microsoft Windows Forum.

The followings are some plausible explanations to address your queries.

1.Server Licensing:

• You will need a valid Windows Server license for the server on which you install the standalone CA role. This license covers the operating system itself.

2.No CALs for Active Directory Certificate Services (AD CS) Itself:

• Unlike some other Windows Server roles (like Active Directory Domain Services, File Services, or Remote Desktop Services), Active Directory Certificate Services (AD CS) itself does not generally require Client Access Licenses (CALs) for users or devices to obtain certificates.

Some considerations for your Entra-only environment:

1.Standalone CA vs. Enterprise CA:

• Standalone CAs do not require Active Directory Domain Services (AD DS) to function. They are independent and don't publish certificates or CRLs to AD DS. This aligns well with your goal of being "Entra-only" with no on-prem AD users.
• Enterprise CAs are integrated with AD DS and rely on it for user accounts, security groups, and certificate templates. If you were setting up an Enterprise CA, you would inherently have AD DS, and thus likely require Windows Server CALs for users/devices accessing AD DS.

2.Other Server Roles/Services:

• Be mindful of any other server roles or services that might be running on the same server as your CA, or any other on-premises servers in your environment.

1. If you have any other Windows Server roles (like a file server, print server, DHCP, DNS, etc.) that users or devices access, those would typically require Windows Server CALs.
2. Your plan to be "Entra-only" suggests minimizing on-prem services, which helps reduce CAL requirements.

3.Future Needs:

• While a standalone CA doesn't require CALs, consider if your "Entra-only" environment might evolve to include other on-premises resources that users or devices need to access. If so, those interactions might necessitate CALs.

You can refer to the below article for further information relating to Licensing.

• https://www.microsoft.com/licensing/docs

Hope the above information is helpful!