Microsoft CAL licensing — user, device, suite and external connector explained.

What a CAL is — and what it gates.

A Microsoft Client Access License is a per-user or per-device right that authorises one named user, or one specific device, to access a Microsoft server product. The CAL is separate from the server licence: an Exchange Server licence permits the software to run; an Exchange CAL permits a user (or device) to receive mail from it. Without CALs, the server licence has no users. CALs are not transferable across products — an Exchange Standard CAL does not authorise SharePoint Server access, and vice versa.

CALs come in two flavours: User CAL (assigned to a named individual; that individual may access from any device) and Device CAL (assigned to a specific hardware unit; any user from that device may access). The choice is permanent at the assignment level — a User CAL cannot be reassigned to a device without a true-up.

User CAL vs Device CAL — the practical decision

User CALs win when knowledge workers have multiple devices each (laptop, mobile, tablet). Device CALs win when devices are shared by multiple users (factory floor terminals, hospital workstations, call-centre desks, retail point-of-sale). The break-even tends to be about 1.4 devices per user — above that, User CALs are cheaper; below that, Device CALs are cheaper. In our experience across 340+ Microsoft engagements, mid-market enterprises almost always over-buy User CALs and under-deploy Device CALs in their shared-workstation environments.

Core CAL Suite, Enterprise CAL Suite — and where the M365 question lives.

Rather than buying individual product CALs, most enterprises license the CAL Suites: Core CAL Suite (Exchange Standard, SharePoint Standard, Skype Standard, Windows Server, System Center Configuration Manager client management licence) or Enterprise CAL Suite (everything in Core plus Exchange Enterprise, SharePoint Enterprise, Skype Enterprise, Windows Server RMS CAL, Advanced Threat Management and System Center additional components). The Enterprise CAL Suite is roughly 1.7× the Core CAL Suite price.

The strategic question every Microsoft buyer faces: if I am moving to Microsoft 365 (which already includes Exchange Online, SharePoint Online, Teams and Windows licensing), should I retain on-prem CALs at all? The answer depends on hybrid posture. Pure cloud — no CALs needed. Hybrid with on-prem Exchange / SharePoint / SQL — CALs still required for each on-prem server. Mixed estates frequently double-pay during transition because the on-prem CAL renewal is not actively reduced when workloads migrate.

The hybrid trap

Microsoft licensing rules require that any user or device accessing the on-prem server still holds a CAL, even if the same user is also licensed for the cloud equivalent through M365. M365 entitlements do not substitute for on-prem CALs while the on-prem server exists. The remediation is decommissioning, not licence reassignment — and the decommissioning has to be auditable.

The External Connector and per-core licensing — where third-party access lives.

Standard CALs only cover internal employees and on-site contractors. The moment external users — customers, partners, vendors — access a Microsoft server, the licensing model has to switch. Two options: External Connector licences (per-server, unlimited external users) or the new SQL Server / SharePoint Server per-core licensing model (licence the server cores, no individual CALs for any user).

External Connectors are priced at roughly 25 CAL-equivalents per server. They make sense when the external user count is high and the server count is low. Per-core licensing makes sense for SQL Server back-ends serving public-facing applications, customer portals, and partner extranets where the user population is undefined or in the thousands.

Where CAL audits find money — the recurring patterns.

Microsoft SAM-engagement audits and SPLA reviews consistently identify CAL gaps in five places:

1. Service accounts and unlicensed admins. Domain accounts authenticating to Exchange, SharePoint or SQL that are not in the CAL count.
2. Mobile-device access without ActiveSync CALs on legacy Exchange Server installations.
3. Remote Desktop Services CALs missing on terminal servers serving multiple users — the per-user RDS CAL is the single most common audit finding.
4. External contractors counted as internal, leading to External Connector exposure.
5. SQL Server in server+CAL edition serving more named users than the CAL count permits — particularly in BI and reporting deployments.

For Microsoft estates with significant on-prem footprint or RDS deployments, independent CAL review captures cost reduction equal to three to eight times the advisory fee within the first true-up cycle. Our Microsoft audit defense team runs the pre-audit CAL reconciliation so the exposure is closed before Microsoft sees the numbers.