Microsoft has made many changes in the last several years relating to Windows Server Licensing –specifically as it relates to external user access. First, what is an external user? Look to the Microsoft Product Terms document for the definition: “External Users means users that are not either Customer’s or its Affiliates’ employees, or its affiliates’ onsite contractors or onsite agents.”
Microsoft has historically addressed external user access to its server products via “External Connectors.” An External Connector license is an additional license assigned to a server that permits access to that specific server. A good example is the Windows Server External Connector license – this product is required if any external users will access or consume any services provided by a particular Windows Server.
As we work with clients here at NPI to optimize licensing and cost across their Microsoft estate, we find that many of them need help understanding how the “consume any services” part of the explanation above applies in their unique environment. They may think that because their external users are not accessing file shares on a specific server that an External Connector license is not required. But what about VPN services? Or if an External User accesses applications like Epic or SAP running on a Windows Server? By Microsoft’s definition, those servers would also require an External Connector license.
So, what are the cost implications for Windows Server licensing? The License & Software Assurance cost for a typical Windows Server (2 processors, 16 cores) under the Enterprise Agreement program at Level B pricing is approximately $400 annually. The cost of the External Connector license for that same server? An additional $900 a year!
Little thought is often given to external users when budgeting across the entire Microsoft estate – and this can expose customers to compliance and cost risks. External Connector licenses are required for Windows Server products like Windows Server Remote Desktop Services and Windows Server AD Rights Management Services, as well as other products like Microsoft Identity Manager. In some cases, those customers with a small number of external users may find it less expensive to simply purchase CALs for external users (note that Microsoft’s 90-day rule on license reassignment would apply).
We should note that Microsoft’s policy on External Connector licensing is still evolving. Microsoft Exchange and Microsoft SharePoint previously required External Connector licenses. But since the 2013 versions, Microsoft has included standard CAL access rights with those servers and basic external use is permitted with these server products today. Our advice to customers is to gain a firm understanding of which server products require External Connectors given their unique Microsoft footprint, usage requirements and technical environment. Furthermore, know your options and model out the cost implications of various scenarios. As mentioned above, an External Connector license can sometimes be more expensive compared to CAL licensing options.
Contact NPI to learn how we can help you with your Windows Server Licensing.