# Windows Server 2025 External Connector vs CALs: Who Counts as External, the Break-Even Point, and What the October 2026 Prices Say

> External Connector vs CALs for Windows Server 2025: who is external, the 49-user break-even per server at October 2026 list prices, RDS, websites, Azure.

Canonical: https://o365hq.com/blog/windows-server-2025-external-connector-vs-cals-when-it-is-cheaper-and-who-counts-as-external
Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book

Published: 2026-10-18 · IT Partner

Every user or device that reaches a Windows Server needs a Windows Server CAL unless an External Connector on that server covers it, and external users are the people who are not your employees or regular contractors: customers, suppliers, partners. At Microsoft list price, October 2026 price list, a 2025 user CAL is $50 and the External Connector is $2,443 per server, so the connector is the lower figure from the forty-ninth external user per server. Below that, buy CALs; a public website nobody signs in to needs neither; Remote Desktop Services needs its own access licenses either way; and a server in Azure needs no Windows Server CALs at all.

## The rule, the prices and the break-even

Microsoft's Windows Server 2025 licensing guidance states the rule: each user or device that accesses a licensed server requires a Windows Server CAL, and an External Connector assigned to a physical server permits any number of external users to access every instance of Windows Server on it. On the October 2026 price list the connector is perpetual only.

At Microsoft list price, October 2026 price list, a [Windows Server 2025 user CAL](/software/windows-server-cal-2025) is $50 and the [Windows Server 2025 External Connector](/software/windows-server-2025-external-connector) is $2,443. Forty-eight user CALs come to $2,400 and forty-nine to $2,450, so the connector is the lower figure from forty-nine external users per server accessed. Each additional server the same people reach adds a connector, so the count becomes ninety-eight users for two servers and 147 for three.

| Situation | License at Microsoft list price, October 2026 price list | Why |
|---|---|---|
| Up to 48 external users on one server | One 2025 user CAL each, $50 | Below the break-even |
| 49 or more external users on one server | One External Connector, $2,443 | Any number of users per server |
| The same users on three servers | Three connectors, $7,329, from 147 users; user CALs below that | One connector per physical server; one user CAL covers every server |
| Partners on Remote Desktop Services | RDS CALs at $174 or an RDS External Connector at $17,468 per server, added to the base license | An additive license the Windows Server connector does not cover |
| An anonymous public website | No CAL and no connector | A web workload under the Product Terms |
| A server running in Azure | No Windows Server CAL; RDS CALs still apply | Access rights are in the per-minute charge |

## Who counts as external, and who does not

The Product Terms glossary, retrieved October 2026, defines the term: "External Users means users that are not (a) employees of Customer or its Affiliates, (b) contractors or agents that typically work for Customer or its Affiliates for more than 30 hours on average per week, or (c) contractors or agents that typically work onsite for Customer or its Affiliates on each working day." Microsoft announced that wording on 25 June 2024 and applies it to agreements signed on or after 1 October 2024; older agreements keep the earlier definition, which excluded only employees, onsite contractors and onsite agents. The test is the relationship, not the network the person connects from.

| Who | Status | License |
|---|---|---|
| Employees of your organization and its affiliates | Internal | Windows Server CAL, or CAL equivalency from a qualifying Microsoft 365 plan |
| Contractors or agents working for you more than 30 hours a week on average, or on site every working day | Internal | Windows Server CAL |
| An outsourcer's engineers who work for you one day a week | External | CAL or External Connector |
| Customers, suppliers, distributors, partners | External | CAL or External Connector |
| The public, reaching a website without signing in | Not counted | None for a web workload |

Two points catch people: affiliates' employees are internal, so a subsidiary's staff need CALs, not a connector; and a managed service provider's engineers are contractors, internal inside the hours or on-site test and external outside it.

## A customer portal, an extranet behind a load balancer, and partners on Remote Desktop

A customer portal on one web server. The customers are external users, the web server is the accessed server, and the choice is one connector against one user CAL per customer account: CALs up to 48 accounts, the connector from 49. The bill grows if the accounts live in Active Directory: the domain controllers answering those logins are accessed servers too, and Microsoft's guidance adds that a connector is also required for any external user for whom the software issues or manages identity information when CALs are not held. One connector per physical domain controller is a different sum from one on the web server, which is why portals for outsiders tend to keep their identities outside the domain, in the application or in Microsoft Entra External ID.

An extranet behind a load balancer. Three web servers behind a load balancer are three accessed servers: three connectors, $7,329 at list. The guidance counts connectors per physical server with any number of operating system environments, so three virtual web servers on one licensed Hyper-V host need one connector and three physical servers need three. The CAL route does not multiply, because a user CAL covers every licensed server you own: 100 partner users on three servers are $5,000 in CALs against $7,329 in connectors, and the connectors are the lower figure only from 147 users.

Partners on Remote Desktop Services. The Windows Server connector covers base access only. Remote Desktop Services is an additive license: every user or device reaching a session host needs an RDS CAL in addition to the base CAL, and for external users the guidance lists the RDS additive CAL or an RDS External Connector per physical server accessed. At Microsoft list price, October 2026 price list, a [Windows Server 2025 RDS user or device CAL](/software/windows-server-2025-remote-desktop-services) is $174 and the RDS External Connector is $17,468, so the RDS connector is the lower figure only from 101 external users per session host, and a 2025 host needs 2025 RDS CALs.

## Anonymous public websites and servers in Azure

An anonymous public website. The Product Terms leave web workloads out of the CAL and connector requirement. A web workload, also called an Internet web solution, is publicly available web pages, websites, web applications, web services or POP3 mail serving, and the definition states that access to the content and applications it serves is not limited to your or your affiliates' employees. The server may run the web server and its management or security agents, a database engine solely to support the solution, and DNS as long as that is not its sole function. A marketing site, a public catalog or an API anyone on the Internet can call therefore needs no CAL and no connector; in our reading, visitors who register on the site itself do not change that while the site stays publicly available. The exemption is about the workload, not the sign-in box: once the same server is also a file server, a domain controller or an application for named outsiders, the portal rules apply.

Servers in Azure. Microsoft's licensing FAQ answers directly: Windows Server CALs are not required for accessing Windows Server running in Azure, because the access rights are included in the per-minute charge for the virtual machines, and Microsoft's server virtualization guidance says the same for virtual machines under Azure Hybrid Benefit. A portal on an Azure virtual machine therefore needs neither CALs nor a connector for its users; the per-minute charge is Microsoft's and is billed to you. Remote Desktop Services keeps its rule in Azure: it still needs RDS access licenses, met with RDS user CALs under active Software Assurance through the extended rights or with RDS subscription licenses. Windows Server licensed by virtual machine outside Azure still needs CALs.

## User CALs, device CALs and the version rule

A user CAL covers one person on any number of devices; a device CAL covers one device used by any number of people; both mix with each other and with connectors. For external users the comparison is almost always against the user CAL, because customers and partners bring their own devices and you cannot count them; the $39 device CAL enters only for a kiosk or shared terminal you own, where the connector's break-even is sixty-three devices.

The version rule applies to connectors as it does to CALs: both permit access to the same version of the server software or earlier, so a 2022 External Connector does not reach a 2025 server, and a 2025 connector or CAL covers 2025, 2022 and 2019. A connector bought for a 2016 portal server needs replacing when that server becomes a 2025 server, unless active Software Assurance carries it forward. Our [domain controller refresh licensing article](/blog/licensing-a-domain-controller-refresh-windows-server-2025-cores-and-the-cal-version-rule) works through what the version rule does to an estate of 2016-era CALs, and [what changed in Windows Server 2025 licensing](/blog/windows-server-2025-licensing-what-changed) covers pay-as-you-go through Azure Arc, which waives the Windows Server CAL but not the RDS CAL.

## The arithmetic at October 2026 list prices

Three scenarios priced with 2025 user CALs at $50 against External Connectors at $2,443 per server, Microsoft list price, October 2026 price list, plus a fourth row where the per-server multiplication works the other way.

| Scenario | Route A: 2025 user CALs | Route B: External Connectors | Lower at list |
|---|---|---|---|
| 25 external users on one server | 25 at $50: $1,250 | One: $2,443 | User CALs |
| 400 external users on one server | 400 at $50: $20,000 | One: $2,443 | Connector |
| 400 external users on three servers | 400 at $50: $20,000 (one CAL per user covers every server) | Three: $7,329 | Connectors |
| 100 external users on three servers | 100 at $50: $5,000 | Three: $7,329 | User CALs |

The connector is perpetual only, so a subscription comparison is CALs on a term against a connector bought once: 400 users on one-year user CALs at $14 are $5,600 a year and pass the connector inside the first year; 25 users are $350 a year and take seven years to reach it. Remote Desktop Services adds an RDS line without changing the base route: 400 partners on one session host are $69,600 in RDS user CALs at $174, or $17,468 for one RDS External Connector.

## What it costs on our side

| What | Price | Time |
|---|---|---|
| [Client Access License Calculator](/tools/cal-calculator): user against device CALs, Microsoft 365 equivalency, the connector route against the CAL route per server | Self-service on this site | Minutes |
| [Windows Server 2025 Licensing Calculator](/tools/windows-server-calculator): cores and edition for the servers behind the portal | Self-service on this site | Minutes |
| [Windows Server and SQL Server Licensing and True-Up Advisory](/services/windows-server-sql-server-licensing-true-up-advisory): who is external under your agreement, which servers they reach, the position and the order to place | $1,950 per project | 1 week |
| Quote button on the [External Connector](/software/windows-server-2025-external-connector) and [Windows Server CAL](/software/windows-server-cal-2025) software pages | Microsoft list price shown; written quote | On request |

A hardware manufacturer with six sites on three continents is pricing a supplier portal alongside its Windows Server 2025 domain controller refresh: the suppliers' staff are external users, and the first question is whether their accounts live in Active Directory, because if they do, every physical domain controller that authenticates them is an accessed server too. Both routes are priced before the CAL refresh order goes in, a connector on the portal server plus one per domain controller those logins touch against a 2025 user CAL per supplier account, and the lower figure at list goes on the order.

The advisory is for the estate where the answer depends on reading an agreement: which definition of external users it carries, whether existing CALs or connectors have Software Assurance, and how many physical servers the outsiders actually touch.

## Frequently asked questions

### Do customers or partners who use our portal need Windows Server CALs?

Yes, a Windows Server CAL each or an External Connector on each physical server the portal runs on; at Microsoft list price, October 2026 price list, CALs cost less up to 48 external users per server and the $2,443 connector from 49. A portal that authenticates them against Active Directory makes the domain controllers accessed servers as well.

### What is the External Connector and when is it cheaper than CALs?

A perpetual license assigned to one physical server that lets any number of external users access the Windows Server instances on it. It costs less at list from 49 external users per server against $50 user CALs and from 63 against $39 device CALs; it never covers employees, affiliates' staff or regular contractors.

### Does a web application behind a load balancer need CALs?

A publicly available website or web application is a web workload and needs no CALs or connectors. One for named customers or partners needs a CAL per user or a connector per physical server behind the load balancer: three servers, three connectors.

### Do we need CALs for servers in Azure?

No Windows Server CALs: Microsoft's licensing FAQ says the access rights are included in the per-minute charge for the virtual machines, and the same holds under Azure Hybrid Benefit. RDS CALs are still required for Remote Desktop Services, as RDS user CALs with active Software Assurance or RDS subscription licenses.

### Does the External Connector cover Remote Desktop Services or our own employees?

Neither. Employees and regular contractors need Windows Server CALs whatever connectors you hold, and Remote Desktop Services is an additive license: external users on a session host need RDS CALs at $174 or an RDS External Connector at $17,468 per server at Microsoft list price, October 2026 price list.

## Count these before you buy

- External users per server: at list, CALs up to 48, a connector from 49.
- Physical servers those users reach, domain controllers included if the portal authenticates against Active Directory: one connector each, or one user CAL per person for all of them.
- Where the external identities live: the domain, the application, or Microsoft Entra External ID.
- Remote Desktop Services: RDS CALs or an RDS External Connector in addition to the base license.
- Public web workloads: nothing. Servers in Azure: no Windows Server CALs; RDS CALs still apply.
- Versions: a 2025 server needs 2025 CALs or connectors unless active Software Assurance carries the existing ones forward.

## Sources

- Microsoft Product Terms, Glossary (microsoft.com/licensing/terms/product/Glossary/all), retrieved October 2026: the definitions of External Users, External Connector License, CAL, Web Workload (Internet Web Solutions), Server and Licensed Server
- Microsoft Product Terms, "Windows Server Standard, Datacenter, and Essentials" (microsoft.com/licensing/terms/productoffering/WindowsServerStandardDatacenterEssentials), retrieved October 2026: External User Access Requirements, "CALs or External Connector"; the Windows Server 2025 External Connector and Windows Server 2025 Remote Desktop Services External Connector listed as Additional Products
- Microsoft licensing news, "Update to the definition of External Users", published 25 June 2024 (microsoft.com/licensing/news/update-to-external-users-2024), retrieved October 2026: the wording applied to agreements signed on or after 1 October 2024
- Microsoft, "Windows Server 2025 Licensing Guidance" (microsoft.com/licensing/guidance/Windows-Server-2025), retrieved October 2026: a Base CAL for each user or device; an External Connector for each physical server accessed, any number of OSEs; the connector also required for external users for whom the software issues or manages identity information; CALs and ECs not required for access by another licensed server, for web workloads, or in a physical OSE used solely to host virtual OSEs; the RDS additive CAL or EC; CALs and ECs reach the same or earlier versions
- Microsoft Licensing FAQs, "Microsoft Azure: Virtual Machines" (microsoft.com/licensing/faqs), retrieved October 2026: Windows Server CALs not required for Windows Server running in Azure; RDS CAL extended rights with Software Assurance
- Microsoft, "Server products in virtual environments licensing guidance" (microsoft.com/licensing/guidance/Server_Virtualization), retrieved October 2026: no Windows Server base CALs under Azure Hybrid Benefit; Windows Server licensed by VM outside Azure still requires CALs
- Microsoft, "Desktop Application Software for use with Windows Server Remote Desktop Services" licensing guidance (microsoft.com/licensing/guidance/Desktop-Application-Windows-Server-RDS), retrieved October 2026: base access included in the per-minute charge; additive features such as RDS require access licenses
- Microsoft NCE Software price list (US), October 2026, Commercial segment: every price quoted

## Key takeaways

- Every user or device that accesses a Windows Server needs a CAL unless an External Connector on that physical server covers it; the connector covers any number of external users and every OSE on the server.
- External users are people who are not employees of you or your affiliates and not contractors working over 30 hours a week or on site every working day (Product Terms wording for agreements signed from 1 October 2024).
- At Microsoft list price, October 2026 price list, the $2,443 connector costs less than $50 user CALs from 49 external users per server: 98 for two servers, 147 for three.
- Public web workloads need no CAL or connector; Windows Server in Azure needs no Windows Server CAL; Remote Desktop Services always needs RDS CALs or an RDS External Connector.
- A portal that authenticates outsiders against Active Directory makes the domain controllers accessed servers too: keep external identities out of the domain or price the extra connectors.

---

**Count the outsiders, then the servers they reach.** Where the answer depends on which definition of external users your agreement carries and which servers the logins really touch, [Windows Server and SQL Server Licensing and True-Up Advisory](/services/windows-server-sql-server-licensing-true-up-advisory) establishes the position and the order to place, $1,950 per project in one week, quoted in writing before it starts. For the count itself, the [Client Access License Calculator](/tools/cal-calculator) shows the CAL route and the connector route side by side at Microsoft's list price, and the [Windows Server 2025 External Connector](/software/windows-server-2025-external-connector) page carries the October 2026 list price and a quote button.