Work-from-home: Remote Desktop Access licensing in SPLA
You are a provider selling remote desktop access to servers on which your end clients run desktop applications like Microsoft Office. And you want to know how to calculate the licences correctly and avoid being hit by an enormous audit bill.
Good news: it's really not rocket science. Read this article carefully, follow our guidance, and you'll have deserved peace of mind.
Disclaimer: We are not Microsoft. Always check the Microsoft Service Provider Use Rights for the official terms and conditions.
TL/DR: RDS licensing summary (we know you are busy)
Count all authorised users. Never use Citrix activity reports or any other tools measuring user activity. You must report all users who can access hosted servers via remote desktop.
"All users" means all authorised persons. Do not count technical accounts. One person needs one SAL.
Recount them every month.
If you publish Microsoft Office Standard, Microsoft Office Professional Plus, Microsoft Visio and Microsoft Project, the rule is exactly the same: count all users who can access them.
Administrators not using RDS but connecting using Remote Desktop Administration mode do not require SALs.
End clients may use RDS CALs with Software Assurance instead of RDS SALs.
End clients may bring their own Microsoft desktop application licences with Software Assurance or subscriptions, but good luck managing their compliance.
Citrix software uses RDS, so the rules are precisely the same.
That should cover 99% of your questions. Now let's dive deeper.
What is Remote Desktop Access licensing in SPLA?
Remote Desktop Access licensing is required when a provider hosts a graphical user interface (GUI) or "desktop experience" using Microsoft Windows Server.
The technology is called "Remote Desktop Services" or RDS, and the licenses are called RDS Subscriber Access Licenses or RDS SALs.
Citrix solutions – XenApp, XenDesktop and their modern incarnations – wrap around Windows Server RDS. Therefore, the licensing requirements for RDS SALs are the same. Using Citrix does not provide any license optimisation benefits. No, concurrency does not matter.
If you provide remote desktop experience using VDI services – direct access to Windows 11 – Windows Server RDS is not used, so RDS SALs are not required.
How to calculate required RDS User SALs?
Establish all users and security groups authorised to access Remote Desktop Services and Citrix services.
Iterate through security groups until you have counted all their member users.
Deduct disabled users.
Deduct service accounts. Pro tip: do not add service accounts to RDS or Citrix groups. Having them as members of such groups is rarely justified and may even be a red flag for an auditor.
One person requires one SAL regardless of the number of servers they access.
The rules for RDS Device SALs are the same, but we have never seen RDS Device SALs used in practice. One of the reasons is it is impossible to calculate authorised devices. There are no reliable tools or technologies.
"Authorised" – not "active" – users or devices
Here is a quote from Service Provider Use Rights:
Customer must acquire a SAL for each user or device authorised by Customer to access the server software regardless of actual access.
If a user had not accessed a server during a calendar month but could, they need a SAL. Inactivity is not a reason for a discount.
Do not rely on Citrix reports and alike
A common mistake is to report RDS SALs based on the user activity calculated by Citrix. Do not do that. User or device activity does not matter. See above.
How to calculate Microsoft Office application licences in SPLA?
RDS access is rarely provided without some Microsoft Office applications. They require User SALs similar to RDS User SALs.
Microsoft 365 apps, Visio Online and Project Online, don't require SPLA licences. Access to them still requires RDS SALs.
The following products require respective SALs through SPLA:
Office LTSC Professional Plus 2021 and previous versions of Office Professional Plus,
Office LTSC Standard 2021 and previous versions of Office Standard,
Office Multi Language Pack – the last version is 2013,
Project 2021 Standard and previous versions,
Project 2021 Professional and previous versions,
Visio LTSC Standard 2021 and previous versions of Visio Standard,
Visio LTSC Professional 2021 and previous versions of Visio Professional.
Again, the licensing rules are similar to RDS User SALs. You must count all authorised persons.
However, there is an additional requirement. The rule in SPUR is quite challenging to understand:
Customer must acquire a SAL for each concurrent connection to a Server running the software (including by the same user from multiple devices).
Here is what it means. Suppose a user connects to the server and runs an Office application simultaneously from their desktop and laptop. In that case, they require two SALs.
May end clients bring their own licences (BYOL)?
Yes, they may.
Their RDS CALs must be subscription licences or licenses with active Software Assurance.
The same applies to Office applications. They also must be subscription licences or licenses with active Software Assurance. However, we advise against it unless you have explicit written confirmation from the end client that they take full responsibility for compliance. The problem with BYOL Office application licenses is they are per device. There are no reliable tools and technologies for counting authorised devices.
Common mistakes
Reporting concurrent or active users,
Forgetting to report RDS SALs when reporting Office application SALs.
Ask a SPLA licensing expert
When you have unanswered questions about SPLA licenses and service provider compliance management, there is no reason to guess, infer or hesitate. Our consultants have many years of experience managing SPLA for our clients. And as we don't sell licences, license sales do not affect our advice.
Use the form below to tell us about your challenges, and a senior member of our team will get in touch with you ASAP.