Does assigning "Basic + Test Plans" or "VS Enterprise" access levels incur additional licensing costs for Azure DevOps Server users authenticated with local Active Directory accounts?

Question

Hello,

I have a Visual Studio Enterprise subscription and would like to clarify the licensing implications for Azure DevOps Server (on-premises).

Our Azure DevOps Server is deployed on-premises, and users authenticate using local Active Directory accounts rather than Microsoft accounts or Microsoft Entra ID accounts.

In this scenario, if a local AD user account is assigned the "Basic + Test Plans" or "VS Enterprise" access level in Azure DevOps Server, would this result in any additional licensing fees or subscription costs?

Specifically, I would like to know whether a user who already has an active Visual Studio Enterprise subscription can be assigned the VS Enterprise (or Basic + Test Plans) access level without requiring any additional purchase, even when the Azure DevOps Server account is a local AD account that is not directly linked to a Microsoft account.

Thank you for your help.

Answer 1

A user with an active Visual Studio Enterprise subscription can be assigned the "VS Enterprise" or "Basic + Test Plans" access level in an on-premises Azure DevOps Server using local Active Directory accounts without incurring any additional licensing fees or purchase requirements. A valid Visual Studio Enterprise Subscription includes an Azure DevOps Server User Client Access License, which is often called a CAL. This CAL covers your access rights for your on-premises deployments.

The "VS Enterprise" access level in Azure DevOps Server maps directly to the entitlements of your active subscription. This subscription already includes full features and Test Plans functionality. Using local Active Directory accounts does not invalidate your subscription rights. On-premises Azure DevOps Server relies on administrative assignment and CAL coverage. It does not require mandatory cloud identity linking for license compliance.

Because it is an on-premises deployment authenticated via local AD, Azure DevOps Server does not require the local AD identity to be tied to a Microsoft Entra ID or a public Microsoft Account to honor the subscription-based CAL coverage. Your organization should ensure that the number of active Visual Studio Enterprise subscriptions matches or exceeds the number of users assigned to these higher-tier access levels on the server. Your team remains responsible for tracking that every local AD user given this access level actually holds a matching, active subscription in real life.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin