Microsoft licensing for the Consumerization of IT

Volume Licensing brief Microsoft licensing for the Consumerization of IT Table of Contents This brief applies to all Microsoft Volume Licensing programs. Summary... 1 What s New in This Brief... 1 Introduction... 2 Maximum Flexibility Through Software Assurance... 2 Key Questions to Ask in Any Scenario... 3 Common Scenarios... 4 Scenario 1: Bringing a Tablet Device Not Running Windows to Work... 4 Scenario 2: Working Remotely... 5 Scenario 3: Bring Your Own PC... 7 Scenario 4: The Teleworker...10 Scenario 5: The Road Warrior...12 Additional Resources...13 Summary The purpose of this brief is to guide users on Microsoft Volume Licensing requirements for common scenarios related to their using various personal devices at work.. What s New in This Brief This brief replaces a previous version published in July 2013. It has been updated to reflect the release of Microsoft Windows 8.1. October 2013 1

Introduction Whether you refer to it as the Consumerization of IT (CoIT) or Bring Your Own Device (BYOD), one thing is certain: the proliferation of personal devices and user expectations that they can use their devices for work-related purposes presents new opportunities and new challenges. The anytime, anywhere access to information and people opens up new avenues for user collaboration and productivity. However, this has left many IT departments scrambling to accommodate user expectations and determine how they will support new technologies while maintaining control over their IT data and network. One challenge is ensuring that users and devices are properly licensed. Microsoft licensing is continually evolving to meet this challenge. The keys to determining proper licensing are to ask the right questions and understand the scenario and requirements. The following information will guide you on what questions to ask and some common scenarios to help you determine your licensing needs. Maximum Flexibility Through Software Assurance Software Assurance for Windows is the key that unlocks the full flexibility for running and accessing Windows desktop environments in a variety of ways across a variety of devices. For devices that are not licensed with or eligible for Software Assurance, the Windows Virtual Desktop Access (VDA) subscription license provides many of these same benefits. The following license rights are available by licensing the user s primary work device with Software Assurance for Windows and Windows VDA subscription: Rights Windows Virtual Desktop Access (VDA) Rights Description Get more flexibility for how you run and access Windows images locally and in the data center. Windows VDA Rights enable users to access virtual instances of Windows 8.1 (or prior operating system versions) in a variety of user scenarios, including: VDI in the data center: Windows Virtualization Rights allow access to up to four virtual instances of Windows running on a server from the licensed device. Local virtual machines (VMs)*: Run up to four virtual instances of Windows locally on the licensed device. Remote boot: Remotely access one physical instance of Windows running on a server from the licensed device. Dual boot*: Run up to two physical instances of Windows on the licensed device. Windows To Go Use Rights Travel light without sacrificing productivity using Windows To Go. Windows To Go is a fully manageable corporate desktop running Windows 8.1 Enterprise edition on a bootable USB stick. This use right allows Windows To Go to be run on any licensed device. Roaming Use Rights Enable work from home and on the road scenarios through Roaming Use Rights. Roaming Use Rights allow the primary user of any licensed device to access a virtual instance of Windows running in the data center (VDI) or Windows To Go from noncorporate devices such as personally owned or hotel business center PCs while away from the office. October 2013 2

Windows Companion Subscription License (CSL) Windows RT Companion VDA Rights Enterprise Sideloading of Windows 8.1 Apps Enable bring your own device (BYOD) scenarios with flexibility for accessing and running corporate desktops using personally owned companion devices at work. The Windows CSL is an optional subscription add-on for any device licensed for Software Assurance for Windows or Windows VDA subscription. The Windows CSL grants the primary user of the licensed device rights to access a corporate desktop through a VDI or Windows To Go on up to four additional devices. Devices eligible for use with the CSL include any type of personally owned device as well as corporate owned non-x86 devices. Extend productivity to Windows RT tablets with Virtual Desktop Access. Windows RT Companion VDA Rights allow the primary user of a licensed device to access a corporate desktop through a VDI from a corporate-owned companion Windows RT 8.1 or Windows RT device with no additional Windows license required. Deploy custom Windows 8.1 apps directly to corporate devices without using the Windows Store. *Not available through Windows VDA subscription Receive the necessary use rights required to enable deployment of touch-centric Windows 8.1 apps directly to devices within an organization as opposed to being installed through the public Windows Store. Key Questions to Ask in Any Scenario When determining the licensing requirements for a given scenario, make sure you can answer these key questions about the user, the device, and the location. User Device Location Is the user covered by the Microsoft Core Client Access License (CAL) Suite or the Microsoft Enterprise CAL Suite on a per-user basis? Is the user the single primary user* of the device? Can the organization easily identify the primary user of the device? Is the device covered by the Core CAL Suite or Enterprise CAL Suite on a per-device basis? Is the device running a qualified Microsoft operating system? Is the device a qualified device or a qualified third-party device? Is the device accessing a virtual desktop infrastructure (VDI)? Is the device owned by the employee or the organization? Will the user access the software on the corporate premises (on-site)? Will the user access the software remotely from outside of the corporate premises (off-site)? * Primary user means the user who uses the device more than 50 percent of the time in any 90-day period. October 2013 3

Common Scenarios The following hypothetical scenarios are designed to illustrate the licensing requirements for five common CoIT scenarios. Scenario 1: Bringing a Tablet Device Not Running Windows to Work Situation The organization allows employees to buy tablet devices that are not capable of running Windows 8.1 Pro (for example, ARM devices) and bring them to work. The organization considers the device to be a secondary (companion) device to the user s primary device at work. Users are permitted to access email only on these devices via Outlook Web App (OWA). They do not use the Microsoft Outlook messaging and collaboration client. Corporate policy does not permit delivering a VDI to these devices. Key questions Are the users who bring their tablets to work covered under the Core CAL Suite or Enterprise CAL Suite? Yes. Every user is licensed for the Enterprise CAL Suite. How will the users access their email? Users will either use a third-party email application or they will access email via Outlook Web App. Required licenses The user or device must be licensed for the Windows Server CAL and Microsoft Exchange Server CAL or Exchange Online service. October 2013 4

Recommended approach In this scenario: Organizations do not need to buy additional Windows Server CALs or Exchange Server CALs because the users are licensed for the Enterprise CAL Suite on a per-user basis. Users do not need a Windows client license or Microsoft Office license in this scenario because the tablet does not run either the Windows operating system or Microsoft Office, and it does not access either of these technologies via VDI. Note: If the company did want to allow VDI access, they would require the following: To license the full Windows Enterprise desktop experience through VDI access: 1. License each tablet with a Windows VDA subscription license, or 2. License the user s primary work device with Software Assurance for Windows or Windows VDA subscription, and then license the primary work device with Windows CSL to cover VDI access from the companion tablet for the primary user. To license the tablets to access Microsoft Office through VDI: 1. License each tablet with Microsoft Office, OR 2. License each user for the Office 365 ProPlus subscription service. Scenario 2: Working Remotely Situation The user is working remotely with their own PC or a public terminal. The user is connecting to a Windows 8.1 Pro virtual machine (VM) using VDI technology via a web browser, such as the Windows Internet Explorer browser. Every user in the organization is licensed with the Enterprise CAL Suite. The Windows client and Microsoft Office Professional Plus licenses for the user s primary work device are covered by Software Assurance. The home device is a third-party device and not managed by the organization, so it is not a qualified device under the Microsoft Enterprise Agreement (EA). October 2013 5

Key questions Will the user ever bring their home PC to work? No. Corporate policy does not allow the user to bring their home PC to work. Is the remote user the single primary user of the licensed device at work? Yes. Every user has a PC at work where he/she is the primary user. Which applications will the user access from home? A key requirement for this project is that the user must be able to access the same applications from home that he/she uses at work, so ALL Microsoft applications need to be properly licensed. Which applications will users access from public terminals? Corporate security policies limit application access from public terminals. The only applications users are allowed to access from public terminals are Office Web Apps, a small set of internally developed web apps, and email. How will users access these applications from public terminals? Users will launch a browser and access an external-facing web portal. The portal will check the health of the machine before it is allowed to connect. Users will authenticate to this portal using their domain credentials before they are granted access. The portal will have links for every application the user is allowed to access remotely. The web portal that users access is running on Microsoft Forefront Unified Access Gateway 2010. Required licenses Remote access to a VM running Windows requires one of the following: o o The work device is covered by Software Assurance for Windows, which grants the primary user of the device Roaming Use Rights. The remote device is licensed with a Windows VDA subscription license. Remote access to Office Professional Plus requires one of the following: o o o The work device is covered by Software Assurance for Office Professional Plus, which grants the primary user of the device Roaming Use Rights. The remote device is licensed separately for Office Professional Plus. The user is licensed for Office 365 ProPlus subscription service Access to the VM from home using Remote Desktop Service (RDS) functionality (or other technology) requires an RDS CAL. Access to Exchange Server for email requires that the user or device is licensed with the Exchange CAL or Exchange Online service. Access via the web browser using Forefront Unified Access Gateway requires that the user or device is licensed with the Forefront Unified Access Gateway CAL. Management of the VM by Microsoft System Center Configuration Manager requires a System Center Client Management License (CML). October 2013 6

Recommended approach For this scenario: A separate VDA license is not needed to access the VM running Windows because the user s work device has Software Assurance for Windows and he/she is the primary user of that device, which includes Roaming Use Rights. An Office Professional Plus license is not needed for the remote PC because the user has Software Assurance for Office Professional Plus on the licensed device at work, which includes Roaming Use Rights. Exchange CALs, Windows Server CALs, or Forefront Unified Access Gateway CALs are not needed because the user is licensed for the Enterprise CAL Suite on a per-user basis. Microsoft System Center Client Management Licenses are not needed because the user is covered by the Enterprise CAL Suite, which includes the System Center Client Management Suite. An RDS CAL is required because the user is accessing the VM using RDS (or other technology). Scenario 3: Bring Your Own PC Situation The organization has decided not to buy employees PCs. Users choose their own device, buy it, and bring it to work. Users also use the device when working from home. Users require basic capabilities for Exchange Server, Microsoft SharePoint Server, and Microsoft Lync Server on their devices. The company wants a licensing approach that will work on any device a user chooses. Licensing simplicity is a key requirement. October 2013 7

Key questions Are the users who bring their own device to work covered under the EA? No. These devices are not currently licensed under the EA. What operating system is installed on these devices? A corporate standard operating system is not imposed. Possible options include Windows 8 or 8.1, Windows 8 Pro or Windows 8.1 Pro, Windows 7 Home Premium, Windows 7 Professional, Windows XP Home Edition, Windows XP Professional Edition, Mac OSX, ipad ios, Android, and possibly variants of Linux. How will the users access corporate applications? Users will access applications in one of the following three ways: 1. VDI. Users will set up a remote desktop connection from their personal device. They will connect to a Windows 8.1 Enterprise VM. The VM will need to access Office Professional Plus 2013 and any corporate applications they need. The corporate policy is to deploy a thin image. No applications will be installed in the VM. Applications will be streamed using App-V. 2. Windows To Go. Users will run a Windows 8.1 desktop image that includes the necessary applications from a USB stick using Windows To Go. 3. Local install. Users will install a Windows 8.1 Pro image that includes the necessary applications locally on their device. Note: this scenario requires a qualifying OS to enable. Required licenses Option 1: Remote Access: Remote access to a Windows VM requires the remote device to be licensed with a Windows VDA subscription license. Remote access to Office Professional Plus 2013 requires the remote device to be licensed for Office Professional Plus 2013 or the user to be licensed for Office 365 ProPlus. Remote access to Project 2013 requires the remote device to be licensed for Project 2013 or the user to be licensed for Project Pro for Office 365. Remote access to Visio 2013 requires the remote device to be licensed for Visio 2013 or the user to be licensed for Visio Pro for Office 365. Streaming applications to a VM via App-V requires the Microsoft Desktop Optimization Pack (MDOP). Access to Exchange Server for email requires that the user or device is licensed with an Exchange CAL or the user to be licensed for Exchange Online. Access to SharePoint Server requires that the user or device is licensed with a SharePoint CAL or the user to be licensed for SharePoint Online. Access to Lync Server requires that the user or device is licensed with a Lync CAL or the user to be licensed for Lync Online. October 2013 8

Option 2: Windows To Go Use of Windows To Go requires the device to be licensed with a Windows VDA subscription license. Running Office Professional Plus 2013 requires the device to be licensed for Office Professional Plus 2013 or the user to be licensed for Office 365 ProPlus. Running Project 2013 requires the remote device to be licensed for Project 2013. Running Visio 2013 requires the remote device to be licensed for Visio 2013. Access to Exchange Server for email requires that the user or device is licensed with an Exchange CAL or the user to be licensed for Exchange Online. Access to SharePoint Server requires that the user or device is licensed with a SharePoint CAL or the user to be licensed for SharePoint Online. Access to Lync Server requires that the user or device is licensed with a Lync CAL or the user to be licensed for Lync Online. Option 3: Local Install If the device has a qualifying operating system license (as defined in the Microsoft Volume Licensing Product List), the device must be covered under the organization s EA via True-up. If the device does not have a qualifying operating system, local install is not an option. Running Office Professional Plus 2013 requires the device to be licensed for Office Professional Plus 2013 or the user to be licensed for Office 365 ProPlus. Running Project 2013 requires the remote device to be licensed for Project 2013 or the user to be licensed for Project Pro for Office 365. Running Visio 2013 requires the remote device to be licensed for Visio 2013 or the user to be licensed for Visio Pro for Office 365. Access to Exchange Server for email requires that the user or device is licensed with an Exchange CAL or the user to be licensed for Exchange Online. Access to SharePoint Server requires that the user or device is licensed with a SharePoint CAL or the user to be licensed for SharePoint Online. Access to Lync Server requires that the user or device is licensed with a Lync CAL or the user to be licensed for Lync Online. October 2013 9

Recommended approach License the user s device with a Windows VDA subscription license. This is a valid approach regardless of the operating system on the user s chosen device and permits accessing a Windows 8.1 image remotely or via Windows To Go. Attach MDOP subscription to each device which allows for virtualization of applications and an RDS CAL which provides the required access using RDS (or other technology). License each device for Office Professional Plus 2013 or license each user for Office 365 ProPlus. License Visio 2013 and Project 2013 for the devices where the employee requires those applications. License each user with the Core CAL Suite. This will cover the required CALs for Exchange Server, SharePoint Server, and Lync Server. This will also allow the users to access Exchange Server and SharePoint Server via another device like a mobile phone. If the user will not need to access Exchange Server and SharePoint Server from any other device, they could instead license the device with the Core CAL Suite. Alternatively users may be licensed for Office 365 Enterprise E1, E3, E4 plans or Office 365 Midsize Business plan which include rights for Exchange Online, SharePoint Online and Lync Online services as well as rights to access on-premises servers. Scenario 4: The Teleworker Situation As part of a telework initiative, users split their time between working in the office and working from home. All users are issued corporate notebooks and are required to use them for business purposes. Users will store data locally on their devices. Corporate security requires a solution to secure this data in case a user s device is lost or stolen. This constitutes management of the device, which requires that the device be covered by the EA. October 2013 10

Key questions Will the user ever bring their home PC to work? No. Corporate policy does not allow the user to bring their home PC to work. (See note below if corporate policy does allow this.) Is the home user the single primary user of the licensed device? Yes. Every user has a PC at work where he/she is the primary user. Are the corporate notebooks covered under the EA? Every corporate issued device is covered with an Enterprise Desktop license, including MDOP. (The Enterprise Desktop includes Windows Professional Upgrade, Office Professional Plus, and Core CAL Suite or Enterprise CAL Suite.) What operating system is installed on these devices? All corporate notebooks come preinstalled with Windows 8.1 Pro. The IT department takes all corporate-issued devices and images them with Windows 8.1 Enterprise. How will the users access corporate applications? Because users are highly mobile, all corporate applications will be locally installed or deployed via App-V with caching enabled. This includes Office Professional Plus 2013. How will the users access resources on the corporate network? Virtual private network (VPN) software from a third party is installed on every corporate issued notebook. Required licenses Each device must be licensed for Windows 8.1 Pro and the required CALs or the user to be licensed for Office 365 online services. Each device must be licensed for Office Professional Plus 2013 or each user must be licensed for Office 365 ProPlus. Delivery of virtual applications by App-V requires MDOP. Windows SA is required on each notebook for Enterprise edition rights and is a requirement for MDOP. Note: If corporate policy does allow employees to bring in their home PCs to work (which are in addition to their corporate issued PCs), then the corporation should buy Companion Subscription Licenses (CSLs) for each corporate issued PC. This will allow the primary user of each corporate issued PC to bring in their home PCs and receive VDA and/or Windows To Go rights on those additional companion PCs. Additional licenses or other applications or server access, if required, still need to be purchased for companion devices. Recommended approach No additional licenses for Windows 8.1 Enterprise, Office Professional Plus 2013, or CALs are needed because they are already licensed through the Enterprise Desktop. MDOP and App-V cover delivering virtual applications. October 2013 11

Scenario 5: The Road Warrior Situation Users are highly mobile and travel 80 percent of the time to visit customers or other locations and work from home the remainder of the time. Users provide their own desktop PC or notebook. When travelling, users bring their personally owned notebook or use hotel kiosks or business center terminals. Users do not want to overwrite the image on their personal PC or notebook with a corporate image. Corporate security requires that company data remains segregated from operating system environments on personal and public devices, Running Windows 8.1 Enterprise from a USB stick via Windows To Go is the preferred solution. Key questions Is the user the single primary user of the licensed device? Yes. Every user has a PC at work where he/she is the primary user. How will the users access corporate applications? Because users are highly mobile, all corporate applications will be included in the Windows 8.1 Enterprise desktop image on the USB stick. This includes Office Professional Plus 2013. How will the users access resources on the corporate network? Direct Access, a feature of Windows 8.1 Enterprise, allows each user to connect to the corporate network securely. It is included in the Windows 8.1 Enterprise desktop image on the USB stick. Are the users covered under the Core CAL Suite or Enterprise CAL Suite? Yes, users are covered for the Enterprise CAL Suite through the company s Enterprise Agreement. Required licenses To run the Windows 8.1 Enterprise image via Windows To Go, each personally owned desktop PC or notebook must be licensed for Windows 8.1 Pro with Software Assurance or Windows VDA subscription. This allows the primary user to also run Window To Go off premises on a third-party device, such as a hotel kiosk or business center terminal. To run Office Professional Plus 2013, each personally owned desktop PC or notebook must be licensed for Office Professional Plus 2013 or each user must be licensed for Office 365 ProPlus To access corporate servers, each user or device needs the necessary CALs or the user to be licensed for Office 365 online services October 2013 12

Recommended approach License the user s device with a Windows VDA subscription license. This is a valid approach regardless of the operating system on the user s personal device and permits accessing a Windows 8.1 image remotely or via Windows To Go. License each device for Office Professional Plus 2013 or license each user for Office 365 ProPlus. Because each user is licensed for the Enterprise CAL Suite, no additional CALs are needed, Additional Resources For more information, please refer to the following Microsoft Volume Licensing briefs: Licensing Windows 8.1 for Use in Virtual Environments Licensing the Core CAL Suite and Enterprise CAL Suite Licensing Windows Server 2012 Remote Desktop Services and Terminal Services Licensing Microsoft Desktop Application Software for Use with Windows Server Remote Desktop Services Licensing Microsoft Office Software in Volume Licensing Licensing Microsoft Office Professional Plus for Office 365 in Volume Licensing 2013 Microsoft Corporation. All rights reserved. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT. This information is provided to help guide your authorized use of products you license; it is not your agreement. Your use of products licensed under your volume license agreement is governed by the terms and conditions of that agreement. In the case of any conflict between this information and your agreement, the terms and conditions of your agreement control. Prices for licenses acquired through Microsoft resellers are determined by the reseller. October 2013 13