# Does a Portal That Authenticates Against Active Directory Need External Connectors on the Domain Controllers? The Identity-Information Rule, Explained

> A portal that authenticates outsiders against Active Directory makes each domain controller host a licensed access point: connectors, CALs or Entra ID.

Canonical: https://o365hq.com/blog/does-a-portal-that-authenticates-against-active-directory-need-external-connectors-on-the-domain-controllers
Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book

Published: 2026-10-18 · Updated: 2026-10-19 · IT Partner

Yes, unless those users hold Windows Server CALs. Microsoft's Windows Server 2025 licensing guidance requires an External Connector for each physical server that external users access and also for any external user for whom the server software issues or manages identity information, in the absence of CALs. A domain controller that holds a customer's account and answers the portal's authentication request is issuing identity information for that customer, so every physical host running such a domain controller needs a connector, or the customers need user CALs. The same clause reaches the AD FS and Web Application Proxy servers that issue tokens and the application server the customer actually uses. The ways out are user CALs where the population is small, connectors on a deliberately small host count, identities created in Microsoft Entra External ID or as B2B guests so that no on-premises server issues identity information for them, or a public web workload nobody signs in to, which needs neither.

## The rule in one paragraph, and the decision table

Two sentences in Microsoft's Windows Server 2025 licensing guidance decide the question. The first is the general rule: each user or device that accesses a licensed server needs a Base CAL, or an External Connector is assigned to each physical server accessed by external users, covering any number of operating system environments on it. The second is the clause this article is about: a connector is also required for any external user for whom the server software issues or manages identity information, in the absence of CALs. A customer never opens a session on a domain controller, but the domain controller holds the account, validates the password and issues the Kerberos ticket or NTLM response the portal relies on, and the clause says that counts. At Microsoft list price, October 2026 price list, the [Windows Server 2025 External Connector](/software/windows-server-2025-external-connector) is $2,443 per physical server and a [2025 user CAL](/software/windows-server-cal-2025) is $50 per person for every server that person reaches.

| Portal design | Servers the rule reaches | License, Microsoft list price, October 2026 price list |
|---|---|---|
| Authenticates against Active Directory directly (Windows authentication or an LDAP bind) | The application server, plus each physical host running a domain controller that holds and authenticates the account | A $2,443 connector per physical host, or a $50 user CAL per external user covering all of them |
| Authenticates through AD FS and Web Application Proxy | The application server, each physical AD FS and proxy server, and the domain controllers behind them | The same choice with more servers in the count |
| Authenticates at Microsoft Entra ID with accounts created in Active Directory and synced | The application server, and the domain controllers that still manage the account | Connectors or CALs; the application server too unless it runs in Azure |
| Authenticates at Microsoft Entra External ID or as B2B guests created in Entra ID | The on-premises application server only; nothing if it runs in Azure | A connector or CALs for that server; Entra External ID billed by monthly active user, separately |
| Anonymous public website or catalog | None | No CAL and no connector: a web workload under the Product Terms |

## The identity-information clause and the three places it bites

The clause closes a gap. Without it, a portal owner could argue that the customer only touches the web server, that the web server is a licensed server, and that access by one licensed server to another needs no CAL, which the guidance does say. The identity-information sentence makes the person, not the hop, the unit of licensing: if Windows Server issues or manages identity information for an external user, that user needs a CAL or the server needs a connector, whatever path the request took.

The domain controllers. An account created in Active Directory for a customer or supplier replicates to every domain controller in the domain and is authenticated by whichever one the application finds through the locator or names in its LDAP settings. The strict reading counts every physical host carrying a writable domain controller for that domain; the narrower reading counts the hosts the portal's servers actually query, which site topology and the application's configuration can pin to two or three. Either way the unit is the physical host, not the virtual machine: a Hyper-V host running two domain controller guests and the portal's web guest needs one connector for all three.

The federation and proxy servers. AD FS issues security tokens carrying claims about the user, which is issuing identity information in the plainest sense, and the Web Application Proxy is the server the external browser reaches first. Each physical server in those tiers is in the count, with the domain controllers behind them.

The application server. The server that serves the portal is an accessed server in its own right, one connector per physical server behind the load balancer or a user CAL per customer. Our [External Connector against CALs decision article](/blog/windows-server-2025-external-connector-vs-cals-when-it-is-cheaper-and-who-counts-as-external) works through the break-even per server; this article is about the servers the customer never sees.

## Who is external under the current definition

The Product Terms glossary, retrieved October 2026, defines External Users as users who are not employees of the customer or its affiliates, not contractors or agents who typically work for the customer or its affiliates for more than 30 hours on average per week, and not contractors or agents who typically work on site for the customer or its affiliates on each working day. Microsoft announced that wording on 25 June 2024 and applies it to agreements signed on or after 1 October 2024; an older agreement keeps the earlier definition, which excluded only employees and on-site contractors and agents, until it is renewed.

For a portal the consequence is clear-cut. Customers, suppliers, dealers and partners are external, and so are their staff. Employees of a subsidiary are internal, so a group-wide portal for affiliate staff is a CAL question. A managed service provider's engineers are internal when they pass the 30-hour or on-site test and external when they do not. The test is the relationship, never the network: a supplier on a site-to-site VPN is as external as one arriving from the Internet. The tests are also why the question lands on the domain controllers at all: an employee's domain account is already covered by a CAL or a Microsoft 365 plan for every server in the estate, and an external account on the same domain has nothing behind it.

## Four ways out

User CALs where the count is small. A 2025 user CAL covers one person on every licensed server you own, domain controllers and federation servers included, so for a few dozen partner accounts the arithmetic is a $50 CAL per person against a $2,443 connector per physical host at Microsoft list price, October 2026 price list; a one-year user CAL at $14 fits a partner whose access ends with a project. A 2025 domain controller needs 2025 CALs or a 2025 connector.

Connectors on a deliberately small host count. Where hundreds of customers sign in, the connector is the lower figure per server, and the work is to keep the host count small: the web tier on one or two hosts, the domain controllers the application names on hosts that already carry a connector, the proxy on the federation server's host.

Identity in Microsoft Entra ID instead of Active Directory. An identity created in Microsoft Entra External ID, or invited as a B2B guest in the workforce tenant, exists only in Entra ID: no domain controller holds the account, no federation server issues the token, and no on-premises server issues or manages identity information for that person. Microsoft Learn's Entra External ID pricing overview, dated June 2026, states that billing is by monthly active users, with a tier at no charge from Microsoft whose size the pricing page carries; that charge is Microsoft's, billed to you, separate from any Windows Server CAL. The condition is that the application accepts an OpenID Connect or SAML token from Entra ID directly: a portal published through Entra application proxy with Kerberos constrained delegation hands the sign-in back to a domain controller, and accounts created in Active Directory and synced through Entra Connect are still managed there, so neither escapes the clause. Our guides to [retiring AD FS with staged rollout](/blog/ad-fs-to-entra-id-migration-staged-rollout) and [retiring on-premises Active Directory for Entra ID and Intune](/blog/retiring-on-premises-active-directory-going-cloud-only-with-entra-id-and-intune) cover the two transitions.

A public web workload. Publicly available websites, web applications and web services whose content is not limited to your or your affiliates' employees need no CAL and no connector under the Product Terms; a catalog qualifies, an application for named outsiders with accounts does not. A portal on an Azure virtual machine needs no Windows Server CAL for its own users, because Microsoft's licensing FAQ puts the access rights in the per-minute charge, but on-premises domain controllers it authenticates against over a VPN are still issuing identity information for them.

## A supplier portal, priced three ways: a plan in progress

A hardware manufacturer with six sites on three continents is replacing about ten Windows Server 2016 domain controllers with Windows Server 2025 before 12 January 2027, and a supplier portal is being priced in the same quarter. The suppliers' staff hold accounts in the one domain, created by the service desk alongside employee accounts, and the portal's application server validates their passwords with an LDAP bind to two domain controllers named in its configuration. The agreement was renewed after 1 October 2024 and carries the current definition, so the suppliers' staff are external users.

The first task is the server count. The application server is a virtual machine on a Hyper-V host at the headquarters site, and the two domain controllers it binds to are virtual machines on two other hosts at the same site, so the narrow reading is three physical hosts; the strict reading adds every host at every site that carries a writable domain controller, which the refresh plan already lists because two per site is the rule being applied. The second task is the account count, which the service desk produces from the organizational unit the supplier accounts live in.

Three routes are then priced before the 2025 CAL refresh order goes in, because the 2016-era CALs without Software Assurance have to be replaced anyway. Route A is a 2025 user CAL per supplier account. Route B is a connector on the application host and on each domain controller host under the reading the agreement supports. Route C moves the supplier accounts to B2B guests, changes the portal to accept Entra ID tokens, and leaves the new domain controllers managing employees only, so no connector question attaches to the refresh. The quote carries one line for the chosen route at Microsoft list price, October 2026 price list, the other two for the record, and the application change in Route C scoped as its own piece of work.

## What it costs on our side

| What | Price | Time |
|---|---|---|
| [Client Access License Calculator](/tools/cal-calculator): user CALs against connectors per physical server, Microsoft 365 equivalency for employees | Self-service on this site | Minutes |
| [Windows Server and SQL Server Licensing and True-Up Advisory](/services/windows-server-sql-server-licensing-true-up-advisory): which definition of external users your agreement carries, which hosts issue identity information for them, the position and the order to place | $1,950 per project | 1 week |
| [AD FS to Microsoft Entra ID Migration and Decommissioning](/services/ad-fs-to-microsoft-entra-id-migration): the federation and proxy servers out of the sign-in path | $4,950 per project | 4 weeks |
| [On-premises Active Directory to Microsoft Entra ID Transition](/services/on-prem-active-directory-to-microsoft-entra-id-transition): identities created and managed in Entra ID, external accounts moved to B2B guests or Entra External ID | $4,950 per project | 3 weeks |
| Quote button on the [External Connector](/software/windows-server-2025-external-connector) and [Windows Server CAL](/software/windows-server-cal-2025) software pages | Microsoft list price shown; written quote | On request |

The connectors and CALs at list, and the Entra External ID monthly active user meter where identities move there, are Microsoft's charges and are billed to you. The advisory is the first step when the answer depends on reading the agreement: the strict and narrow readings of the domain controller count differ by several connectors, and the agreement's definition of external users decides who is in the count at all.

## Frequently asked questions

### Our customer portal authenticates users against Active Directory; do the domain controllers need External Connectors?

Yes, unless the customers hold Windows Server CALs. The Windows Server 2025 licensing guidance requires a connector for any external user for whom the server software issues or manages identity information, and a domain controller that holds and authenticates the account does both: one connector per physical host running such a domain controller, $2,443 at Microsoft list price, October 2026 price list, or a $50 user CAL per customer.

### What does "issues or manages identity information" mean?

Holding an account, validating a credential and producing a ticket, token or claim for a person. Domain controllers manage the account and issue Kerberos and NTLM responses; AD FS issues tokens; both count even though the external user never opens a session on them.

### Does moving authentication to Entra ID (B2B or External ID) remove the requirement?

For the domain controllers and federation servers, yes, when the identity is created in Entra ID and the application accepts Entra ID tokens directly, because no on-premises server then issues or manages identity information for that person. Accounts created in Active Directory and synced are still managed by the domain controllers, and an application that falls back to Kerberos through Entra application proxy reaches them again.

### What about an LDAP-bound application or a RADIUS gateway for partners?

Both reach the clause. An application that validates a partner's password with an LDAP bind has the domain controller authenticate the account, and a Network Policy Server acting as a RADIUS gateway for partner VPN or Wi-Fi is itself an accessed Windows Server that passes the credential to a domain controller. Count the application or NPS host and the domain controller hosts, then choose CALs or connectors.

### If the portal runs in Azure, do we still need connectors on the on-premises domain controllers?

The portal's own virtual machine needs no Windows Server CAL, because the access rights are in the per-minute charge, but on-premises domain controllers that authenticate its users across a VPN are still issuing identity information for external users. Moving those identities to Entra ID is what removes the on-premises servers from the count.

## Count these before you buy

- Where the external accounts are created: Active Directory, AD FS claims, or Microsoft Entra ID.
- Physical hosts that issue or manage identity information for them: domain controllers under the reading your agreement supports, federation and proxy servers, and the application host.
- External users under your agreement's definition, with the 30-hour and on-site tests.
- User CALs for a small population, connectors for a large one; a 2025 server needs 2025 CALs or connectors.
- Whether the portal is a public web workload, which needs neither, or an application for named outsiders, which does.

## Sources

- Microsoft, "Windows Server 2025 Licensing Guidance" (microsoft.com/licensing/guidance/Windows-Server-2025), retrieved October 2026: a Base CAL for each user or device; an External Connector for each physical server accessed by external users, any number of OSEs; the connector also required for any external user for whom the software issues or manages identity information, in the absence of CALs; CALs and ECs not required for access by another licensed server or for web workloads; CALs and ECs reach the same or earlier versions
- Microsoft Product Terms, Glossary (microsoft.com/licensing/terms/product/Glossary/all), retrieved October 2026: the definitions of External Users, External Connector License, CAL, Web Workload (Internet Web Solutions), Server and Licensed Server
- Microsoft Product Terms, "Windows Server Standard, Datacenter, and Essentials" (microsoft.com/licensing/terms/productoffering/WindowsServerStandardDatacenterEssentials), retrieved October 2026: External User Access Requirements, "CALs or External Connector"; the Windows Server 2025 External Connector listed as an Additional Product
- Microsoft licensing news, "Update to the definition of External Users", published 25 June 2024 (microsoft.com/licensing/news/update-to-external-users-2024), retrieved October 2026: the wording applied to agreements signed on or after 1 October 2024
- Microsoft Licensing FAQs, "Microsoft Azure: Virtual Machines" (microsoft.com/licensing/faqs), retrieved October 2026: Windows Server CALs not required for Windows Server running in Azure
- Microsoft, "Server products in virtual environments licensing guidance" (microsoft.com/licensing/guidance/Server_Virtualization), retrieved October 2026: no Windows Server base CALs under Azure Hybrid Benefit; Windows Server licensed by VM outside Azure still requires CALs
- Microsoft Learn, "Microsoft Entra External ID pricing and billing overview" (entra/external-id/external-identities-pricing), page dated 22 June 2026, retrieved October 2026: billing by monthly active users for B2B guests in workforce tenants and all users in external tenants; a no-charge tier; premium add-ons billed separately; current prices kept on Microsoft's External ID pricing page
- Microsoft NCE Software price list (US), October 2026, Commercial segment: every price quoted

## Key takeaways

- Windows Server 2025 guidance requires an External Connector for any external user for whom the server software issues or manages identity information, in the absence of CALs: a domain controller holding a customer's account is inside that rule even though the customer never signs in to it.
- The clause reaches three tiers: the domain controllers, the AD FS and Web Application Proxy servers that issue tokens, and the application server; the unit is the physical host, and one connector covers every instance on it.
- External users are the people who are not employees of you or your affiliates and not contractors passing the 30-hour or on-site tests, under the Product Terms wording for agreements signed from 1 October 2024.
- At Microsoft list price, October 2026 price list, a $50 user CAL covers one person on every server and a $2,443 connector covers any number of external users on one physical host.
- Identities created in Microsoft Entra External ID or as B2B guests, with the application accepting Entra ID tokens directly, take the domain controllers and federation servers out of the count; accounts created in Active Directory and synced do not.

---

**Count the hosts that issue identity information for outsiders, then decide where those identities should live.** Where the answer turns on which definition of external users your agreement carries and which domain controllers the portal really reaches, [Windows Server and SQL Server Licensing and True-Up Advisory](/services/windows-server-sql-server-licensing-true-up-advisory) establishes the position and the order to place, $1,950 per project in one week, quoted in writing before it starts. For the arithmetic itself, the [Client Access License Calculator](/tools/cal-calculator) shows the user CAL route and the connector route side by side at Microsoft's list price.