Azure RDS Licensing: Windows Server Remote Desktop Services in the Cloud Explained

The RDS Licensing Framework on Azure

Remote Desktop Services (RDS) on Azure presents a licensing model that is significantly more complex than traditional on-premises deployments. Organisations moving workloads to Azure frequently discover that the licensing obligations they understood in their data centre do not translate directly to the cloud environment — and that the differences carry material cost and compliance implications.

The fundamental licensing requirement for RDS on Azure mirrors the on-premises structure: users or devices accessing Windows Server sessions through Remote Desktop Services require both a Windows Server Client Access Licence (CAL) and an RDS Client Access Licence. These two CAL layers are distinct and both must be in place for every accessing user or device. Neither the Azure subscription fee nor the Windows Server VM cost on Azure substitutes for these CALs.

Understanding this dual CAL requirement is the starting point for any Azure RDS licensing analysis. It is the most frequent source of compliance gaps in enterprise Azure environments, particularly in organisations that migrated RDS workloads to Azure without a formal licensing review.

Windows Server CAL Requirements

Every user or device that accesses a Windows Server environment — including through RDS — requires a Windows Server CAL. In an Azure context, this means that users accessing session-based desktops or applications hosted on Windows Server VMs need a Windows Server CAL assigned to them. Windows Server CALs are typically acquired through Volume Licensing as part of an enterprise agreement and are version-current, meaning a Windows Server 2022 CAL covers access to all previous versions.

For organisations with an existing Enterprise Agreement covering Windows Server CALs for their on-premises users, those CALs may extend to Azure in certain licensing scenarios — but the specific terms depend on your EA provisions and whether Software Assurance is active. CALs without Software Assurance do not carry licence mobility rights to Azure infrastructure.

RDS Client Access Licences

The Remote Desktop Services CAL is the second mandatory layer. RDS CALs are available in two assignment models: Per User and Per Device. The Per User model assigns the CAL to a named user, allowing that user to access RDS sessions from any device. The Per Device model assigns the CAL to a specific device, allowing any user to access RDS sessions from that device.

Choosing between Per User and Per Device depends on your access patterns. Organisations where users frequently access sessions from multiple devices (laptops, desktops, mobile devices, shared terminals) typically benefit from Per User licensing. Organisations with dedicated workstations or shared-device scenarios where multiple users share a smaller number of devices may achieve better economics from Per Device licensing.

RDS CALs are purchased through Volume Licensing and must be installed on an RDS Licence Server within your environment. Windows Server 2025 RDS User CALs are priced at approximately $96 to $200 per licence depending on purchasing channel, with five-user packs ranging from $480 to $1,000 at standard volume rates.

Windows Server Licensing Models in Azure

Beyond CALs, organisations must also correctly licence the Windows Server operating system running in Azure VMs. Microsoft provides two primary options for Windows Server in Azure: pay-as-you-go licensing included in the Azure VM cost, and Bring Your Own Licence (BYOL) through Azure Hybrid Benefit.

Pay-As-You-Go Windows Server

Azure includes Windows Server licensing in the VM price for standard compute tiers. Microsoft charges Windows Server PAYG at $33.58 per core per month for a dedicated rate, which works out to approximately $0.046 per core per hour for standard instances. This PAYG model is the simplest from an administrative perspective — no Volume Licensing required, no separate CAL tracking for the host OS, simply the combined VM and OS cost charged to your Azure subscription.

However, PAYG Windows Server in Azure does not eliminate the RDS CAL requirement. The PAYG licence covers the server OS but not the right for users to access RDS sessions. The CAL obligation exists independently of how the Windows Server licence is procured.

Azure Hybrid Benefit for Windows Server

Organisations with Windows Server licences that include Software Assurance can apply Azure Hybrid Benefit, which allows the use of on-premises Windows Server licence rights on Azure VMs, replacing the Azure PAYG licence cost. Azure Hybrid Benefit can reduce Windows Server costs on Azure by up to 40 percent compared to PAYG rates.

The critical requirement is active Software Assurance (SA) coverage. Licences without SA cannot be applied through Azure Hybrid Benefit. For organisations with a significant volume of Windows Server Standard or Datacenter licences under SA through their EA, Azure Hybrid Benefit represents one of the most substantial available cost reductions for RDS workloads in Azure.

The October 2025 SPLA Changes: Impact on Azure RDS

Microsoft implemented significant licensing changes effective October 1, 2025, that directly affect how Windows Server and Remote Desktop Services are licenced in public cloud environments. These changes have the broadest impact on service providers but carry compliance implications for enterprise customers as well.

End of SPLA on Listed Public Clouds

From October 1, 2025, service providers are prohibited from using their own Service Provider Licence Agreement (SPLA) licences to licence Windows Server and RDS on Microsoft's designated Listed Providers — Azure, AWS, Google Cloud, and Alibaba Cloud. This means that hosting providers who previously delivered Windows Server RDS sessions on public cloud infrastructure using SPLA licences must transition to alternative licence vehicles.

For enterprise customers, this change is relevant in two scenarios. First, organisations using managed service providers for RDS on Azure must confirm that their service provider has transitioned to compliant licence structures under the new rules. Second, organisations using Azure as a hosting environment for customer-facing RDS sessions need to ensure their own licence vehicle is appropriate for the delivery model.

Software Assurance Mandatory for Licence Mobility

Under the new rules, enterprises using Windows Server and RDS CALs on Azure Virtual Desktop (AVD) after October 1, 2025, must have those CALs covered by active Software Assurance for licence mobility rights. This requirement was previously in place but has been reinforced in the context of the broader October 2025 changes. CALs purchased without SA cannot be used to licence AVD sessions, and organisations with older CAL inventories lacking SA coverage face a compliance gap that requires remediation through SA activation or new licence acquisition.

Azure Virtual Desktop: The Modern Alternative

Azure Virtual Desktop (AVD) is Microsoft's first-party Virtual Desktop Infrastructure (VDI) service, built natively into Azure, and in many enterprise scenarios represents a superior licensing and operational path compared to manually deploying and licencing RDS on Windows Server VMs.

What AVD Includes in the Licence

For users with qualifying Microsoft 365 subscriptions — including Microsoft 365 E3, E5, Business Premium, and several other plans — access to Azure Virtual Desktop is included at no additional per-session licence cost. Qualifying M365 subscribers can deploy multi-session Windows 10 or Windows 11 desktops through AVD without purchasing separate RDS CALs for the Windows client OS sessions. This represents a significant licensing simplification and cost reduction for organisations already on M365.

The distinction between Windows Server session hosts and Windows 10 or Windows 11 multi-session hosts is critical in the AVD context. Traditional RDS deployments use Windows Server as the session host, requiring the dual CAL structure. AVD with Windows 10 or Windows 11 multi-session (a capability exclusive to Azure) eliminates the RDS CAL requirement for M365-entitled users, relying instead on the M365 licence entitlement.

When RDS Remains the Right Choice

Not every organisation should migrate immediately to AVD. Scenarios where RDS on Windows Server remains appropriate include legacy application compatibility requirements that mandate Windows Server session hosts, ISV applications that are not certified or supported on Windows client OS in multi-session mode, and organisations with very specific session-brokering or gateway requirements that AVD's managed infrastructure does not support. In these cases, a well-structured RDS deployment with correct CAL coverage remains the viable path.

Compliance Risks in Azure RDS Deployments

The combination of dual CAL requirements, Azure Hybrid Benefit eligibility rules, and the October 2025 SPLA changes creates a compliance landscape where enterprise organisations face meaningful audit exposure if their Azure RDS deployment was not structured with explicit licence design from the outset.

CAL Assignment Gaps: Organisations that deployed RDS on Azure without a formal user-to-CAL assignment process, or that have grown their user base without adding corresponding CALs, face undercoverage. Microsoft licence audits specifically look for the ratio between active RDS session users and assigned CALs.

Software Assurance Lapses: Organisations that allowed SA to lapse on Windows Server or RDS CAL licences without transitioning those licences lose Azure Hybrid Benefit eligibility and licence mobility rights. Remediation typically requires purchasing SA reinstatement or new licences at current prices.

SPLA Provider Compliance: Enterprises relying on managed service providers for Azure RDS delivery must validate that their provider is operating under a compliant licence vehicle post-October 2025. The compliance obligation flows to the end customer if the provider's licence structure is challenged.

Five Recommendations for Azure RDS Licence Compliance

1. Commission a Current-State RDS Licence Inventory: Before any remediation or optimisation, establish an accurate baseline of your deployed Windows Server session hosts, active RDS users, assigned CALs, and SA status across your entire Volume Licensing portfolio. This inventory is the prerequisite for all subsequent licence decisions.

2. Evaluate AVD for M365-Entitled Users: For any organisation with Microsoft 365 E3 or E5 users running RDS workloads, model the AVD migration path. Eliminating RDS CAL requirements for M365-entitled users through AVD multi-session Windows deployments is one of the clearest cost reduction opportunities in the Microsoft licensing portfolio.

3. Ensure Software Assurance Coverage on All RDS CALs: Active SA on RDS CALs is required for Azure licence mobility, version upgrade rights, and compliance with post-October 2025 licence mobility rules. Any CAL inventory without current SA must be assessed for remediation through SA activation or replacement acquisition before your next EA renewal.

4. Validate Service Provider Licence Structures: If your organisation uses managed services or hosting providers for any Azure RDS delivery, obtain written confirmation that your provider has transitioned to a compliant licence vehicle under the October 2025 SPLA changes. This confirmation should be documented as part of your supplier compliance programme.

5. Engage Independent Advisory Before EA Renewal: Azure RDS licence optimisation — consolidating CAL structures, applying Azure Hybrid Benefit, evaluating AVD migration — is most cost-effectively executed as part of an EA renewal. An independent advisor with Microsoft licensing expertise can model the total cost of each architecture option and negotiate optimal terms within your EA.