Yes, the straightforward answer is that in almost every real-world scenario, you will need to deploy them. Windows Server 2025 does require CALs (Client Access Licenses) alongside the server license. Both have a distinctive purpose: the server license allows you to run your OS, and CALs are the legal authority for users to connect to the OS.
If you're accessing core services like Active Directory, file sharing, print services, or internal line-of-business applications, you require CALs, full stop. The only environments that don't need them are a small set of specific exceptions covered below.
This trips people up because Windows Server doesn't technically enforce CAL ownership the way a product key enforces activation. Nothing stops you from connecting 200 users to a server with zero CALs purchased. But that gap isn't a loophole; it's exactly what Microsoft audits are designed to catch, and non-compliance findings can be expensive. Treat CALs as a compliance requirement, not an optional add-on.
User CAL vs. Device CAL
Microsoft gives you two ways to license access, and picking the right one is really just a math problem based on your ratio of people to devices.
User CAL - It licenses a person, not a machine. In simpler terms, once a person has access to user CAL, they can connect to whatever number of devices they want, for instance, an office desktop, laptop, phone, home PC, tablet. One CAL, unlimited devices, tied to that individual.
Device CAL - This license is specifically made for a machine, not a person. Once a device has a Device CAL, anyone can use that device to access the server. This is the model for shared or shift-based equipment, think a warehouse scanner terminal, a shared reception PC, or a factory floor kiosk that rotates through multiple employees per day.
The rule of thumb: if your users have more devices than people (laptop + phone + home PC per employee), User CALs are usually cheaper. If you have more devices than people accessing them (multiple shifts sharing one workstation), Device CALs win. Microsoft explicitly allows mixing both models in the same environment; you don't have to standardize on one, though tracking a mixed environment does add some administrative overhead.
Two details that matter and get missed constantly:
-
CALs are network-wide, not per-server. If a user needs to touch five different Windows Servers, they still only need one User CAL, not five. CAL requirements scale with your headcount/device count, not your server count.
-
CAL version has to match or exceed the server version. This is Microsoft's "downgrade rights" principle; a Windows Server 2025 CAL will happily cover an older server running 2022, 2019, or 2016. But a 2022 CAL will not cover a 2025 server. If you're upgrading your server fleet, budget for a CAL upgrade at the same time, or you'll create a compliance gap without realizing it.
RDS CALs Are a Separate License - Don't Assume They're Included
This is the single most common licensing mistake we see: assuming a standard User or Device CAL covers Remote Desktop Services. It doesn't.
A standard Windows Server CAL only covers baseline access, file services, print services, AD authentication, and internal applications running natively. The moment someone is logging into a full remote desktop session or launching a published RemoteApp through RDS, that's an entirely separate license: an RDS CAL (also sold as User or Device variants).
So a typical remote-access deployment actually needs two license layers stacked on top of each other:
-
A Windows Server CAL (base access)
-
An RDS CAL (remote session/app access)
Because RDS deployments are frequently put up rapidly to facilitate remote work and the licensing phase is often overlooked, skipping the RDS CAL is the quickest way to become out of compliance. Budget for RDS CALs as a separate line item from the beginning if your company uses Remote Desktop Services for remote workers, contractors, or published apps.
Common Exceptions
CALs aren't required in every scenario. The main carve-outs:
-
Microsoft 365 E3 and E5 subscribers. These licenses already include Windows Server CAL rights for users covered under them, for any server OS version. If your workforce is fully licensed under M365 E3/E5, you may not need to buy traditional Windows Server CALs separately for those specific user accounts, though it's worth confirming this against your specific agreement, since rights can vary by contract vintage.
-
External Connector License. If external, non-employee users (customers, vendors, contract partners) need access, licensing them individually with User CALs usually isn't practical or cost-effective. An External Connector License covers unlimited external access to a specific server instead.
-
Anonymous/public-facing web content. Public website visitors hitting an IIS site generally don't require CALs, since that's not the kind of authenticated internal access CALs are designed to cover.
Real-World Examples: SMB vs. Enterprise
Small business example: One physical Windows Server 2025 Standard system is used by, let’s say, a 15-person accounting firm for Active Directory, printing, and file storage. There are no shared laptops; each employee has their own laptop. This is a textbook User CAL scenario: 15 User CALs, done. If two employees also need to remote into their desktops from home, add 2 RDS User CALs on top.
Enterprise example: With 250 office workers using personal laptops and 150 warehouse workers using 40 handheld scanner terminals across three shifts, a 400-person logistics company uses a virtualized cluster to operate Windows Server 2025 Datacenter. This is a mixed-CAL environment: 40 Device CALs for the shared scanners (less expensive than licensing 150 individual users), 250 User CALs for office workers, and RDS CALs for the portion of employees that work remotely from home. They also have 20 external contractors who need occasional access; instead of 20 more User CALs, an External Connector License covers that group more economically.
