Licensing Non-Employees to Access Microsoft Products on Your Servers

Many businesses have teams of third-party vendors to assist with their business operations or to provide independent services – like software development or website design – that require access to company servers. For Microsoft products like Windows Server that require additive licensing (usually, Client Access Licenses, or CALs) to support all such client access, the question sometimes arises: How do we license our non-employees to access our servers?

First, there is no prohibition on assigning CALs to non-employees. However, when you are licensing your server software for access by third parties, CALs sometimes are an inappropriate choice due to Microsoft’s general prohibition on short-term reassignment of licenses. Microsoft’s licensing rules state that “you may not reassign licenses on a short-term basis (within 90 days of the last assignment),” and also:

 You may reassign a CAL…on a short-term basis, to cover a user’s absence or the unavailability of a device that is out of service.  Reassignment of these licenses for any other purpose or timeframe must be permanent.

With access by third parties who are not on the company’s premises, the company may be unable to validate that the CALs purchased for those users or their devices are not being reassigned on a short-term basis.

Under those circumstances, External Connectors (ECs) often are a better choice. An EC is a license assigned to a physical server “that permits access to the server software by External Users.” “External Users” are “users that are not either your or your Affiliates’ employees, or your or your affiliates’ onsite contractors or onsite agents.” In virtualized environments, ECs may be assigned to physical host machines to allow access to the VMs that are running on those machines (therefore, it is not necessary to assign an EC to each VM).

In cases where the number of third-party users is low and relatively static, with little turnover of individuals included within the group of such users, then the licensing rules do not prohibit the business from simply assigning CALs to those users or to their devices (if each user is going to be accessing the company’s servers from only a single device). In addition, CALs are required when the non-employees in question working are at the company’s premises (because the users cease being “External Users” under those circumstances).

Finally, it is critical to remember that the above guidance applies only to third parties who are providing services to the company. When that situation is reversed – when the company is providing services to the third parties, then CALs and ECs may still be appropriate options, but the company also needs to determine whether those use cases comprise “commercial hosting services” requiring licensing under SPLA or the Self-Hosted Applications benefit under Software Assurance.