Lesson: Understanding and Implementing Session Host Licensing in Azure Virtual Desktop

Introduction: Why Licensing Matters in AVD

When you deploy Azure Virtual Desktop (AVD), you are essentially building a virtualized workspace that provides users with access to Windows desktops and applications. While the technical configuration of host pools, workspaces, and application groups is vital, the licensing component is the foundation upon which the entire architecture rests. Without the correct licensing, your organization may be non-compliant with Microsoft’s terms, or worse, you may face unexpected costs or technical restrictions that prevent users from accessing their resources.

Licensing in AVD is unique compared to traditional on-premises Virtual Desktop Infrastructure (VDI). In a traditional model, you might purchase perpetual licenses for Windows Server and Remote Desktop Services (RDS) CALs. In the cloud, the model shifts toward subscription-based entitlements that grant you the right to access the service. Understanding these nuances is critical because your choice of licensing dictates not only your monthly bill but also the specific features you can enable, such as multi-session Windows 10/11 or Windows Server-based sessions.

This lesson explores the intricacies of AVD licensing. We will break down the eligible licenses, explain how to apply them, discuss the technical implementation of license types within host pool configurations, and provide guidance on avoiding common compliance pitfalls. By the end of this module, you will have a clear roadmap for ensuring your AVD environment is licensed correctly, cost-effective, and ready for production.

The Core Licensing Entitlements

To use Azure Virtual Desktop, your users must be assigned an eligible license. This license grants the user the right to access the AVD service and the underlying Windows operating system. It is important to remember that AVD licensing is user-based, not device-based. This means that if a single user accesses their virtual desktop from a laptop, a tablet, and a home PC, they only need one license assigned to their identity.

Eligible Microsoft 365 and Windows Licenses

The following licenses provide the legal entitlement to access AVD:

• Microsoft 365 E3/E5: These are the most common licenses for enterprise environments. They include Windows 10/11 Enterprise E3/E5, which covers the AVD usage rights.
• Microsoft 365 Business Premium: Designed for small to medium-sized businesses, this license is an excellent entry point for AVD, as it includes the necessary Windows entitlements at a lower price point.
• Microsoft 365 F3: This license is intended for frontline workers. It allows access to AVD, though it is usually restricted to specific scenarios where full desktop functionality is not required.
• Windows 10/11 Enterprise E3/E5: If you are not using the full Microsoft 365 suite, you can use standalone Windows Enterprise licenses.
• Windows VDA (Virtual Desktop Access): This is intended for users who do not have a primary Windows device, often used in non-Windows endpoint scenarios.

Callout: User-Based vs. Device-Based Licensing A common point of confusion is the distinction between user-based and device-based licensing. In AVD, licensing is tied to the user identity (the Azure AD/Entra ID account). This means you do not license the virtual machines themselves for the operating system; you license the users who connect to them. This provides flexibility for mobile workforces, as the license follows the user regardless of the hardware they use to connect.

Implementing Licensing at the Host Pool Level

Once you have confirmed that your users possess the correct licenses, you must ensure that your host pools are configured to utilize these rights correctly. When you create a host pool, you are often given the option to specify the license type. This is particularly relevant when deploying Windows 10 or Windows 11 multi-session, as the operating system needs to know that it is running in an AVD context to enable specific features.

Configuring License Types in the Azure Portal

When creating a host pool via the Azure portal, you will encounter a tab labeled "Virtual Machines." Under the "Advanced" or "Settings" section, you will see a toggle or dropdown for "License Type." You generally have two choices:

1. Windows Client: Select this if you are using Windows 10 or Windows 11 Enterprise multi-session or single-session. This setting tells the virtual machine to look for the user's license entitlement.
2. Windows Server: Select this if you are deploying Windows Server 2016, 2019, or 2022. In this case, you are using your own RDS CALs or other server-side licensing agreements.

Automating with PowerShell

If you are deploying at scale, you will likely use infrastructure-as-code or PowerShell scripts. You can specify the license type during the creation of the host pool VMs to ensure consistency across your fleet.

# Example: Setting the license type during VM creation via PowerShell
$vmConfig = New-AzVMConfig -VMName "AVD-Host-01" -VMSize "Standard_DS3_v2"
Set-AzVMOperatingSystem -VM $vmConfig -Windows -ComputerName "AVD-Host-01" -LicenseType "Windows_Client"
# The LicenseType parameter ensures the VM consumes the AVD entitlement rather than requiring a separate Windows license.

Note: Choosing the "Windows_Client" license type for VMs running Windows 10 or 11 is mandatory for compliance. If you accidentally select "None" or use a standard Windows license, you may be missing out on the multi-session capabilities and the specific AVD optimizations provided by the platform.

Understanding Windows Server vs. Windows Client Licensing

A major decision in AVD implementation is choosing between Windows Client (10/11) and Windows Server. Each has distinct licensing implications that can impact your budget and user experience.

Windows 10/11 Enterprise Multi-Session

This is the "flagship" operating system for AVD. It allows multiple users to log into a single virtual machine simultaneously, which significantly reduces the cost per user. Because it is a client OS, it is highly compatible with applications that might struggle with server-based environments.

• Licensing Requirement: Users must have an M365 E3/E5/Business Premium license.
• Best for: General office productivity, standard application sets, and scenarios where user experience parity with local PCs is important.

Windows Server (2016/2019/2022)

Using Windows Server for AVD is a traditional approach. It relies on the RDS CAL (Remote Desktop Services Client Access License) model.

• Licensing Requirement: Users need both an RDS CAL and the base Windows Server access rights.
• Best for: Legacy applications that require specific server-side features, or organizations that have already invested heavily in RDS CALs and want to leverage them in a cloud environment.

Callout: The RDS CAL Comparison Many organizations ask if they can use their existing RDS CALs for AVD. If you use Windows Server in AVD, you must use RDS CALs. However, if you use Windows 10/11 Multi-session, you do not need RDS CALs; the M365/Windows license covers the remote access rights. For most new AVD deployments, switching to Windows 10/11 Multi-session is more cost-effective because it eliminates the need for separate RDS CAL management.

Best Practices for License Management

Managing licensing at scale requires a structured approach. If you manage an environment with hundreds or thousands of users, manual tracking is not feasible.

1. Centralized License Assignment

Always assign licenses through Azure Active Directory (Entra ID) groups rather than individual users. This ensures that when a new employee joins the organization and is added to the "AVD-Users" group, they automatically inherit the necessary licenses.

2. Regular Audits

Use the "License" blade in the Microsoft 365 Admin Center to audit your usage. Look for "unassigned" licenses that are being paid for but not used, or users who are accessing AVD resources without the appropriate license attached to their account.

3. Separation of Environments

Maintain separate host pools for different license tiers if necessary. For example, if you have a group of users on M365 F3 and another on M365 E5, ensure that your application groups are mapped to the correct pools to avoid user confusion and potential access issues.

4. Leverage Azure Hybrid Benefit

If you are using Windows Server in your AVD environment, you can use the Azure Hybrid Benefit to save costs on the virtual machine compute charges. This allows you to bring your on-premises Windows Server licenses to Azure, significantly reducing the hourly cost of the VM.

Warning: Never attempt to "double-dip" by using a single license for multiple users. Microsoft's auditing tools are sophisticated; using a single account for multiple concurrent users not only violates the EULA but can also cause technical issues with user profiles (FSLogix) and data corruption.

Common Pitfalls and How to Avoid Them

Even experienced administrators occasionally stumble when it comes to AVD licensing. Below are the most frequent mistakes observed in enterprise deployments.

Mistake 1: Forgetting the License Type Flag

As mentioned earlier, failing to set the LicenseType parameter to Windows_Client during VM creation can lead to the VM being billed incorrectly. You may be charged for a full Windows license instead of the AVD-entitled version. If you discover this after deployment, you can usually update the license type via PowerShell without redeploying the VM.

Mistake 2: Licensing for "Generic" Accounts

Some organizations create generic accounts (e.g., [email protected]) to allow multiple people to share a single login. This is a licensing violation. Every user who accesses the AVD environment must have their own unique identity and an associated license.

Mistake 3: Ignoring RDS CALs for Server-Based Host Pools

If you decide to stick with Windows Server, you must ensure that your RDS CALs are properly tracked. If you deploy a massive host pool on Windows Server 2022 and your audit shows you lack sufficient CALs for all active users, you will be out of compliance. Always verify your CAL counts before scaling up your server-based host pools.

Mistake 4: Assuming "Free" Access for Guests

Sometimes vendors or contractors need access to your AVD environment. You cannot simply let them in without a license. You must either provide them with a guest account that is licensed correctly or ensure they have their own M365 licenses that satisfy the AVD requirements.

Quick Reference Table: Licensing Scenarios

Step-by-Step: Verifying License Compliance

To ensure your environment is compliant, follow this checklist periodically:

1. Identify Active Users: Export a list of all users assigned to your AVD Application Groups.
2. Cross-Reference Licenses: In the Microsoft 365 Admin Center, verify that every user on that list has at least one of the eligible licenses (E3, E5, Business Premium, etc.).
3. Check Host Pool Configuration: For each host pool, run the following PowerShell command to verify the license type:

   Get-AzVM -ResourceGroupName "MyRG" -Name "MyAVDHost" | Select-Object LicenseType
   

4. Review RDS CALs (If Applicable): If you are using Windows Server, check your volume licensing portal to ensure you have enough CALs for the maximum number of concurrent users.
5. Document and Report: Keep a record of your findings. If you are ever audited by Microsoft, having this documentation ready will save significant time and stress.

Advanced Licensing Topics: Windows VDA

For users who do not have a primary device running a qualifying Windows operating system (for example, a user who exclusively uses a Linux thin client or a Chromebook), the Windows VDA license is the appropriate choice. This license is specifically designed for virtualized scenarios where the endpoint does not carry its own Windows license.

When implementing VDA, the setup is largely the same as with M365 licenses, but you must ensure that your procurement department has purchased the VDA subscription through your Enterprise Agreement or Cloud Solution Provider (CSP). The technical implementation does not change—the user's identity is simply assigned the VDA entitlement in the same way an E3 license would be assigned.

Deep Dive: The Role of FSLogix in Licensing

While FSLogix is a profile management tool rather than a licensing entity, it is intrinsically linked to the AVD experience. FSLogix is included for free with your AVD-eligible licenses. Many administrators forget that they are entitled to this powerful tool. By using FSLogix, you provide a consistent user experience that makes the "Multi-session" capability of Windows 10/11 viable. Without FSLogix, user profiles would be difficult to manage across a multi-session host pool, effectively forcing you into a single-session-only model, which would increase your licensing and compute costs significantly.

Tip: Always enable FSLogix on your host pools. It is part of your licensing entitlement and is essential for the performance and reliability of multi-session environments.

Common Questions (FAQ)

Q: Can I use a personal Microsoft account (outlook.com) for AVD? A: No. AVD requires a business or enterprise identity managed through Microsoft Entra ID (formerly Azure AD).

Q: Does my AVD license cover the cost of the virtual machine? A: No. The license covers the right to access the Windows OS and the service. You still pay separately for the underlying Azure compute (VMs), storage (Managed Disks), and networking (Data Egress) costs.

Q: What happens if a user's license expires? A: The user will lose the ability to log into their virtual desktop. It is best practice to set up automated alerts in the Microsoft 365 Admin Center to notify administrators when licenses are about to expire or when you are running low on available seats.

Q: Is there a trial license for AVD? A: You can sign up for a trial of Microsoft 365, which includes AVD rights, but there is no "AVD-only" trial license. You must trial the M365 suite to test the AVD functionality.

Best Practices for Scaling and Cost Management

As your AVD environment grows, licensing management becomes a significant operational task. Here are a few advanced tips for managing costs while maintaining compliance:

• Implement Auto-scaling: Use AVD auto-scaling to turn off VMs when they are not in use. While this primarily saves on compute costs, it also ensures that you aren't leaving "idle" sessions open that could trigger licensing or performance issues.
• Group-Based Licensing: As mentioned, use Entra ID group-based licensing. This is the only way to effectively manage thousands of users. If you try to manage licenses per user, you will inevitably have "license creep," where users retain licenses they no longer need.
• Review Usage Reports: Periodically review the AVD usage reports in the Azure portal. If you see a host pool that is consistently underutilized, consider consolidating users onto fewer VMs. This doesn't change your per-user license count, but it simplifies your infrastructure management.
• Stay Updated on Changes: Microsoft occasionally updates its licensing terms. Subscribe to the official Azure Virtual Desktop blog or the Microsoft 365 roadmap to stay informed about changes that might affect your entitlements.

Key Takeaways

1. Identity is Everything: AVD licensing is tied to the user identity, not the device or the virtual machine. Always ensure your users have the correct entitlements assigned to their Entra ID accounts.
2. Prefer Windows 10/11 Multi-Session: For most modern deployments, Windows 10/11 Multi-session is the most cost-effective and feature-rich choice, as it eliminates the need for legacy RDS CALs.
3. Use the Correct License Flag: When deploying VMs via scripts or the portal, always set the LicenseType to Windows_Client to ensure you are utilizing your AVD entitlements correctly and avoiding unnecessary costs.
4. Audit Regularly: Use group-based licensing and regular audits to ensure that your organization remains compliant and that you are not paying for unused licenses.
5. Leverage Included Tools: Remember that your licensing entitlement includes tools like FSLogix, which are critical for providing a performant multi-session experience.
6. Understand the Distinction: Know when to use Windows Server (and when RDS CALs are required) versus Windows Client (where M365 entitlements suffice).
7. Plan for Growth: Use automation and group-based assignments to ensure that your licensing strategy can scale with your organization without requiring manual intervention for every new user.

By following these principles, you will build an AVD environment that is not only technically sound but also fully compliant and optimized for your organization's budget. Licensing is often the most overlooked part of the infrastructure, but by mastering it, you provide a stable and secure foundation for your users' digital workspace.