none
Device CAL vs User CAL - external users and questions

    Question

  • I'm trying to get a better understanding of CAL's so forgive me if these questions are easy questions.

    Currently we have external users (non-company) web-app users who connect remotely that authenticate through AD, my understanding is the following from: http://www.microsoft.com/licensing/about-licensing/client-access-license.aspx

    Device CALs

    With a Device CAL, you purchase a CAL for every device that accesses your server, regardless of the number of users who use that device to access the server. Device CALs may make more economic and administrative sense if your company has workers who share devices, for example, on different work shifts.

    User CALs

    With the User CAL, you purchase a CAL for every user who accesses the server to use services such as file storage or printing, regardless of the number of devices they use for that access. Purchasing a User CAL might make more sense if your company employees need to have roaming access to the corporate network using multiple devices, or from unknown devices, or simply have more devices than users in your organization.

    I'm also under the understanding that since our external users auth through AD that a CAL is required, but what's not clear to me is if a device CAL is applicable to our enviorment, in the sense of does device CAL's cover external users. 

    So my question is this:

    using a 'Device CAL' for a web application on a WebServer that authenticates through a 2008DC with external clients satisfy CAL requirements in this scenario?

    Tuesday, June 05, 2012 3:47 PM

Answers

  • Your understating is correct but i partially agree with your opinions. Its correct that device CALs are assigned to devices but note that those CALs are tied to those devices and if a device is retired/crashed then the CAL will not be revoked automatically by the license server wherein for User CALs license is leased to the user per session basis and is checked in to the license pool automatically which means the number of licenses you buy is equal to the number of concurrent connections to the server by any users any device. Therefore I always prefer Per User CALs as they are easy to mange and more efficient.

    To clear the second point, a CAL is not required if a user is only authenticating against AD, it's required when users access a terminal server (RD session host) remotely or in your case the web application on your web server. So to answer your question I suggest you implement Per User CALs for your clients.

    Also refer - http://www.microsoft.com/licensing/about-licensing/client-access-license.aspx

    HTH


    Sachin Gadhave
    MCP, MCSA, MCTS


    Tuesday, June 05, 2012 4:57 PM

All replies

  • Your understating is correct but i partially agree with your opinions. Its correct that device CALs are assigned to devices but note that those CALs are tied to those devices and if a device is retired/crashed then the CAL will not be revoked automatically by the license server wherein for User CALs license is leased to the user per session basis and is checked in to the license pool automatically which means the number of licenses you buy is equal to the number of concurrent connections to the server by any users any device. Therefore I always prefer Per User CALs as they are easy to mange and more efficient.

    To clear the second point, a CAL is not required if a user is only authenticating against AD, it's required when users access a terminal server (RD session host) remotely or in your case the web application on your web server. So to answer your question I suggest you implement Per User CALs for your clients.

    Also refer - http://www.microsoft.com/licensing/about-licensing/client-access-license.aspx

    HTH


    Sachin Gadhave
    MCP, MCSA, MCTS


    Tuesday, June 05, 2012 4:57 PM
  • Thank Sachin,

    I total follow you but, from your post, I'm assuming that 1 Device CAL "would" suffice but may not be the ideal situation. 

    However if the is scenario, lets say I have 400 concurrent users, would not a device cal be more economically viable?  And it's also my understanding that VM's do not require additonal CAL's so if redundancy is handled via VM, would this not be a better solution?


    • Edited by Star-Guy Tuesday, June 05, 2012 6:40 PM
    Tuesday, June 05, 2012 6:13 PM
  • Hi,

    for licensing it's best to contact your reseller or the MS Licensing team for an accurate answer.

    In general, *all* authenticated access requires a CAL.
    In general, if the authenticated access is to be used by "externals", then you may need an "External Connector" license.
    (this depends on the product/s)

    CAL's do not operate on a "concurrent" access concept. (almost no MS products operate on that basis).
    In general, CAL's are appropriate for user-accesses/device-accesses that "belong" to your company, and "EC's" are appropriate for those that do not belong to your company.
    EC's are applied on a per-product+per-server basis, e.g. if you have a single WindowsServer offering TS/RDS sessions to "external accesses", buy a single TS/RDS "EC" and "assign" it to that TS/RDS server, this means an unlimited number of "external" accesses is permitted.


    Don

    Tuesday, June 05, 2012 11:09 PM
  • Thank Sachin,

    I total follow you but, from your post, I'm assuming that 1 Device CAL "would" suffice but may not be the ideal situation. 

    However if the is scenario, lets say I have 400 concurrent users, would not a device cal be more economically viable?  And it's also my understanding that VM's do not require additonal CAL's so if redundancy is handled via VM, would this not be a better solution?


    Yes in case of a device oriented user access per device CAL model is the best solution in this case.


    Sachin Gadhave
    MCP, MCSA, MCTS

    Wednesday, June 06, 2012 10:19 AM
  • Is one PC joined to domain considered a "device" that needed a device cal?
    Friday, November 09, 2012 3:46 AM
  • Is one PC joined to domain considered a "device" that needed a device cal?

    for Windows Server CAL's, you can purchase a per-user CAL or per-device CAL.

    If the PC is domain-joined, and a domain-user-account is used to logon to the PC, that is classified as an authenticated logon to a Windows Server. This is considered "access", so yes, a CAL is required for this access to be considered licensed/legitimate.

    You can choose to purchase either a per-user(PU) CAL, or a per-device(PD) CAL, in this scenario.

    It is an economic/financial/commercial decision for you, to choose PU or PD CAL's for your scenario.
    The use-rights are identical.
    There are "calculators" and "advisors" on the MS VL website to help illustrate the options.
    If you are a large organisation with broad MS technology products, you may find it economical/beneficial to consider CoreCAL or EnterpriseCAL, or other similar "bundle" offerings from MS.


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    Friday, November 09, 2012 7:07 AM
  • Thank you
    Friday, November 09, 2012 7:26 AM
  • Sorry for bumping an old thread.

    We are planning to buy CAL for a web app hosted by a Windows 2012 Standard Edition server. We would like to know if User CAL is counted by "no. of concurrent connections" or by "Total no. of users".

    And in the above posts, Mr. Gadhave said the former while Don said the latter.

    For example,

    if we have 10 employees, but at most 5 of them will be connecting to the server at the same time, how many User CAL do we need? 5 or 10?

    If the answer is 10, then is there another type of CAL for concurrent connections?

    Tuesday, November 19, 2013 10:08 AM
  • It depends, if you have 10 employees that are sharing 5 computers then it would be acceptable to have 5 per-device CALS. However if you have 10 different users, and you are going with per-user CALs you will need 10.
    Wednesday, November 20, 2013 12:30 AM
  • Thanks.

    Hope MS can add this clarification (about concurrent access) to their official description of how CAL works. There are so many contradicting answers on the web........

    Wednesday, November 20, 2013 4:27 AM
  • Thanks.

    Hope MS can add this clarification (about concurrent access) to their official description of how CAL works. There are so many contradicting answers on the web........

    Neither are concurrent based.
    If you have purchased per-device, then only those devices are licensed.
    If you have purchased per-user, then only those users are licensed.
    You might purchase both types, and apply a per-user approach for some situations, and, apply a per-device approach for different situations.

    e.g. if you have a pool of pc's used by shift-workers (example, a 24x7 call centre, where you have 250 pc's and 500 users, but only 250 pc's/users are in use at one time) it might be economical to purchase per-device (buy 250 per-device CALs, instead of 500 per-user CALs). Every user (250) must permanently have a CAL, you cannot "save" buying any CALs on a basis of 30 people on average are sick/holiday so we only buy 220.

    but if another situation example, you have 250 users who each have 2 pc's (1 pc each at Location_A and 1 pc each at Location_B), the user can only use one pc at a time, so per-user CALs would = 250, instead of per-device CALs would = 500)

    The decision is completely a financial (savings) decision, based on how many pc's/users can *possibly* be in use at any one time.

    Concurrent licensing models (not applicable to CAL), allow that not all machines/connections will always be in use at any one time, hence possible savings.
    CALs are licensed on *possible* use, not *actual* use.

    If your example was, you have 500 pc's and you have 500 users, then there is no savings possible in either licensing model, so choose the licensing model that would suit your expected/planned growth (if any).


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)


    • Edited by DonPick Wednesday, November 20, 2013 7:28 AM
    Wednesday, November 20, 2013 7:23 AM
  • Thanks. Very detailed explanation~~
    Thursday, November 21, 2013 3:22 AM
  • Sorry for bumping an old thread.  

    We are planning to buy CAL to be complaint with Microsoft.
    I am a bit confused, can somebody help me.
    I have this scenario : 140 users, 160 computers ( Windows, Linux, Mac ) and 200 virtual Linux test computers, all on the domain.

    Help :)

     


    Tuesday, January 21, 2014 10:22 AM
  • We are planning to buy CAL to be complaint with Microsoft.
    I am a bit confused, can somebody help me.
    I have this scenario : 140 users, 160 computers ( Windows, Linux, Mac ) and 200 virtual Linux test computers, all on the domain.

    if you have 140 users (people), and 160 computers (physical devices), you could buy 140 per-user CALs, or you could buy 160 per-device CALs. Whichever is less expensive for you. Probably, 140 per-user CALs is less expensive for you, check with your reseller.

    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    Tuesday, January 21, 2014 1:02 PM
  • Humm.. What about this 200 linux test computers connected to the domain ( yes to the Windows domain ), i thought that i have to buy cals fro them to.

    Tuesday, January 21, 2014 3:58 PM
  • Humm.. What about this 200 linux test computers connected to the domain ( yes to the Windows domain ), i thought that i have to buy cals fro them to.

    If the 200 Linux machines are being used by the 140 people, or used from the 160 computers/devices, then you have acquired CALs for them already. If these Linux machines are to be used by other people/devices, then you must acquire CALs for them and again, consider if there are more (or less) people vs. devices.

    The Linux machines, if virtual, are not considered devices (because a device is a physical item).
    One way to consider this, is that a device will have a keyboard/screen, and for CALs that are licensed/assigned on a per-device basis, how many keyboard/screens does your audience have?
    (each keyboard/screen = 1 device)
    For CALs that are licensed/assigned on a per-user basis, how many pairs of human hands does your audience have? (each pair of human hands = 1 user)


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    Wednesday, January 22, 2014 8:22 PM
  • Thanks. :)

    Very detailed explanation and useful answer ( it saved a lot of $$$ ).

    Thursday, January 23, 2014 3:41 PM
  • Hello,

    I would please like your help on how to actually setup in CRM 2011 device CALs. For example, if we have 10 Device CALs and 20 Users working on these CALs. Will CRM let us create 20 Users with Device CAL license type? How The users are connected with Devices? 

    Sorry to interfere in the thread. 

    Thank you very much for your reply in advance.


    Wednesday, March 19, 2014 4:00 PM
  • I would please like your help on how to actually setup in CRM 2011 device CALs. For example, if we have 10 Device CALs and 20 Users working on these CALs. Will CRM let us create 20 Users with Device CAL license type? How The users are connected with Devices? 

    for Dynamics products, like CRM, the dedicated Dynamics forums might be best for your question :)

    https://community.dynamics.com/


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    Wednesday, March 19, 2014 7:58 PM