We often get questions about the differences between User CALs and Device CALs, and which is more appropriate. What exactly do those terms mean and which type should you buy?
When Microsoft says “CAL,” they’re not talking about California, calories, or calibers. They are talking about a “Client Access License.” When one of their server products is licensed using the Server+CAL model, then you have to buy a server license to install the software on the server and you have to buy CALs for the people or machines that will access that server. A “User CAL” licenses the person so they have permission to access the server. They can access it from as many different endpoints as they want since the CAL is tied to the person, not the device. On the other hand, a “Device CAL” licenses the endpoint device so that the device itself has permission to access the server. Then, anyone using that device would be able to access the server. The people using that device do not need a User CAL.
On their website, Microsoft provides the following images to illustrate the differences between User CALs and Device CALs:
The Server+CAL model is a way for Microsoft to scale the pricing of its solutions. If you are a small business, then you pay a relatively small price tag since you only have to buy a few CALs. If you are large business, then you pay a much larger price tag since you will need to buy more CALs.
So which type should you buy? User or Device? The answer depends on whether you have more employees or more devices. If you have less employees than devices, go with User CALs since that will be the cheaper route. If you have less devices than users, go with Device CALs.
For most businesses, the User CAL option is the cheaper way to go since typically they have employees who are accessing the servers over numerous devices. Think of an employee who, in the course of a typical week, accesses their email on their desktop, their laptop, their tablet, and their smartphone. You either need to buy four Device CALs to cover those four devices or you need to buy a single User CAL to cover that user. Even though User CALs are more expensive, buying one CAL will be much cheaper than buying four.
The only time the Device CAL model makes sense is when you have a large number of employees using a limited number of computers. Some examples of this would be a kiosk in the mall with part-time employees coming and going all week, a maintenance crew who uses a community computer to clock in and out, or a company that operates 24/7 with a day crew and night crew using the same PCs.
What if you can’t tell which option would be better? If you’re sitting on the fence and you have about the same number of users and devices, my recommendation would be to go with User CALs since that’s the direction the world is moving.
Alternatively, you can mix User CALs and Devices CALs in the same environment. It’s not recommended because it’s hard to keep track of who is using a User CAL and who is using a Device CAL, but it is permitted. So if you have one group of employees who each use multiple devices and you have another group of employees who share a limited number of devices, you can buy User CALs for some of your employees and Device CALs for the others. You are just going to have to work hard to keep track of how those CALs are distributed because you’ll have to justify things to Microsoft if you ever get audited.