Licensing Models for AVD

Licensing Models for Azure Virtual Desktop (AVD)

Introduction: Why Licensing Matters in AVD Architecture

When you begin planning an Azure Virtual Desktop (AVD) infrastructure, the technical configuration of host pools and session hosts often takes center stage. However, the financial and compliance foundation of your deployment rests entirely on your licensing model. Choosing the correct license is not merely an administrative task; it is a fundamental architectural decision that dictates which features you can enable, how your users access their desktops, and, most importantly, the long-term cost-effectiveness of your cloud environment.

Azure Virtual Desktop is unique compared to traditional on-premises Virtual Desktop Infrastructure (VDI). In a traditional model, you purchase perpetual licenses for the OS and the virtualization software upfront. In the cloud, Microsoft utilizes a subscription-based model that ties your entitlement to use the Windows 10 or Windows 11 multi-session experience to specific Microsoft 365 or Windows E3/E5 subscriptions. If you miscalculate these requirements, you may find yourself in a compliance gap or paying significantly more for resources than you actually need.

Understanding the nuances of these licensing models allows you to design a solution that fits your organization's specific user personas—whether they are task workers needing simple remote access or power users requiring full-blown virtualized workstations. This lesson will walk you through the various licensing paths, the technical requirements for applying them, and the best practices for managing your entitlements to ensure your AVD deployment remains efficient and compliant.

The Core Licensing Entitlements

At its heart, AVD licensing is about the right to run the Windows desktop operating system in a virtualized, multi-session environment. Unlike standard Azure Virtual Machines (VMs) where you pay for the Windows license as part of the hourly compute rate, AVD offers a unique "bring your own license" (BYOL) benefit that removes the Windows OS cost from the VM hourly rate.

Qualifying Subscriptions

To qualify for the AVD usage rights, your users must be assigned one of the following licenses:

• Microsoft 365 E3/E5/A3/A5/F3/Business Premium: These are the most common licenses for enterprise users. They provide the necessary rights to access AVD resources.
• Windows 10/11 Enterprise E3/E5/A3/A5: These legacy or standalone Windows subscriptions also cover the requirement for desktop virtualization.
• Remote Desktop Services (RDS) Client Access Licenses (CALs): If you are running Windows Server instead of Windows 10/11 multi-session, you need RDS CALs with Software Assurance.

Callout: The Multi-Session Advantage The primary reason to use AVD over standard Azure VMs is the ability to use Windows 10/11 Enterprise Multi-Session. This allows multiple users to log into a single VM simultaneously, drastically reducing compute costs. To use this specific OS image, you must have one of the qualifying licenses mentioned above. You cannot simply pay for a standard Windows VM and expect to use the multi-session features.

Detailed Breakdown of Licensing Scenarios

To effectively plan your infrastructure, you must distinguish between the two primary ways you pay for AVD: the "User-Based" entitlement and the "Per-User" access pricing for external users.

1. Internal User Entitlement

For internal employees, the licensing is tied to the user identity. If you have an employee who needs access to a virtual desktop, and that employee already has a Microsoft 365 E3 license assigned to their user object in Azure Active Directory (now Microsoft Entra ID), they are already licensed for AVD. You do not pay an additional "per-user" fee to Microsoft for the AVD service itself; you only pay for the underlying Azure infrastructure (compute, storage, and networking).

2. External User Access

What happens when you need to provide access to contractors, vendors, or partners who do not have an internal Microsoft 365 license? Previously, this was a significant hurdle. Microsoft introduced a "per-user access pricing" model specifically for this scenario. This allows you to pay a flat monthly fee per user for the right to access AVD, bypassing the need to purchase a full M365 suite for a temporary contractor.

Warning: Licensing Scope Always verify the specific SKU. A common mistake is assuming that a "Microsoft 365 Business Basic" license includes AVD rights. It does not. Business Basic focuses on web-based apps and email but lacks the Windows Enterprise virtualization rights required for AVD. You must upgrade to "Business Premium" or higher for small-to-medium businesses.

Technical Implementation: Applying Licenses

From a technical standpoint, the "licensing" of an AVD host pool is not a toggle you flip in the Azure Portal. Instead, it is an implicit state determined by the operating system image you select and the user assignments you make.

Step-by-Step: Validating Your Deployment

Follow these steps to ensure your infrastructure is technically aligned with your licensing:

1. Select the Image: When deploying your session hosts, navigate to the Azure Marketplace and choose a "Windows 10/11 Enterprise Multi-session" image.
2. Verify User Assignments: Ensure every user assigned to the AVD Application Group has a qualifying license assigned in the Microsoft 365 Admin Center.
3. Monitor via Entra ID: You can use the "Licenses" blade in the Entra ID portal to audit which users have the necessary E3/E5 entitlements.
4. Tagging for Cost Management: While not a "license," applying tags to your host pools (e.g., Department: Finance, Environment: Production) is essential to track the costs associated with specific licensed groups.

Code Example: Checking License Assignment via PowerShell

As an administrator, you may need to verify that your users are properly licensed before adding them to an AVD host pool. You can use the Microsoft Graph PowerShell SDK to audit user licenses.

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.Read.All", "Directory.Read.All"

# Define the target user
$userId = "user@yourdomain.com"

# Retrieve assigned licenses for the user
$user = Get-MgUser -UserId $userId -Property AssignedLicenses

# Check for specific Service Plans (e.g., Windows 10/11 Enterprise)
# Note: You would compare the SkuId against known Microsoft 365 SKU IDs
$user.AssignedLicenses | Select-Object SkuId

Explanation: This script connects to your tenant and pulls the AssignedLicenses property for a specific user. By checking the SkuId, you can confirm if the user possesses an E3, E5, or Business Premium license, ensuring they are eligible for AVD access before you grant them permissions in the AVD control plane.

Comparing Infrastructure Costs vs. Licensing Costs

It is vital to understand that your "AVD Bill" is split into two distinct categories:

Note: Do not confuse "AVD Licensing" with "Windows Virtual Desktop Access Pricing." The former refers to your existing M365 entitlements, while the latter refers to the specific per-user monthly billing for external users.

Best Practices for AVD Licensing Management

Planning your licensing is a cyclical process. As your workforce changes, your licensing requirements will shift. Below are industry-standard practices to maintain control.

1. Implement Dynamic Group Licensing

Instead of manually assigning licenses to every new hire, use Entra ID's Group-Based Licensing. Create a security group called "AVD Users" and assign the E3/E5 license to that group. When you add a user to the group, the license is automatically applied. This prevents the "forgotten user" scenario where a user is added to an AVD host pool but lacks the necessary license, leading to compliance issues.

2. Audit Regularly

Set up a monthly cadence to compare your AVD user list against your license assignment list. Use the Azure Resource Graph Explorer to pull a list of all users who have accessed the AVD workspace in the last 30 days and cross-reference this with your license usage reports.

3. Leverage Reserved Instances for Compute

While licensing is a fixed cost per user, the underlying compute cost is variable. Once you have confirmed your licensing model, purchase "Reserved Instances" for your session hosts. Since AVD session hosts are relatively static in their OS requirements, committing to a 1-year or 3-year term for compute can save you up to 65% compared to pay-as-you-go pricing.

Common Pitfalls and How to Avoid Them

Pitfall 1: The "Nested Licensing" Misconception

Many administrators believe that if the host machine is licensed, the users do not need individual licenses. This is incorrect. AVD is a user-based licensing model. Even if you have a perfectly configured host pool, if the user logging in does not have an assigned license in the tenant, they are technically in violation of the Terms of Service.

Pitfall 2: Ignoring License Expiration

If a user's subscription expires (e.g., a credit card failure on the M365 billing portal), their AVD access will not stop immediately, but they will be out of compliance. Ensure that your procurement department has automated alerts for subscription renewals.

Pitfall 3: Over-provisioning E5 Licenses

Organizations often assign E5 licenses to everyone by default. If your AVD users only need basic remote access, they may only require E3. Conduct a "license rightsizing" exercise to ensure you aren't paying for advanced security features (like Defender for Endpoint P2) that your virtual desktop users aren't actually utilizing.

Advanced Licensing: The "Per-User" Access Pricing Model

For organizations that rely heavily on external contractors, the per-user access pricing is a game-changer. This model allows you to register your AVD environment in the Azure portal for "Per-User Access."

How to Enable Per-User Access:

1. Navigate to the AVD workspace in the Azure portal.
2. Select the "Per-user access" configuration blade.
3. Add the users who are not internal employees.
4. Azure will automatically calculate the monthly bill for these specific users at the current market rate for AVD per-user access.

This is significantly cheaper than buying an entire M365 suite for a contractor who only needs to access a specialized legacy application for three months. Remember, this option is only for external users; internal employees should always be licensed through their M365 subscriptions.

Strategic Planning: The Full Lifecycle

Planning your host pools requires you to look at the intersection of performance and cost. If you are building a host pool for a graphic design team, you will likely deploy high-end GPU-enabled VMs (e.g., NV-series). Because the compute cost for these VMs is high, the "licensing" portion of the bill remains the same, but the impact of a licensing error is higher.

If you accidentally deploy a non-compliant image or fail to license a user, you face not only compliance risks but also the potential for service disruption if Microsoft enforces entitlement checks during sign-in. Always treat the license assignment as a "blocking" step in your deployment checklist.

Step-by-Step: The Licensing Readiness Checklist

Before you push your host pool to production, verify the following:

1. User Identity: Are all prospective users synced from your local AD to Entra ID?
2. License SKU: Does every user have an active, assigned M365 E3/E5 or Business Premium license?
3. Group Membership: Are these users part of the Entra ID group that provides the license?
4. Access Permissions: Have you assigned the "Desktop Virtualization User" role to these users on the Application Group level?
5. Compliance Audit: Have you run a test user account (without a license) to confirm that the environment correctly denies access?

Callout: The "Denial of Access" Test Always perform a negative test. Create a test user account, assign it to an AVD Application Group, but do not assign it an M365 license. Attempt to log in via the AVD client. If the system allows access, you may have misconfigured your identity provider or your tenant settings. A properly configured system will prevent the user from establishing a session if the entitlement is missing.

Integrating Licensing with Azure Policy

To scale your licensing management, use Azure Policy. You can create a policy that prevents the creation of AVD host pools unless specific tags are present, or a policy that alerts you if a VM is deployed with an image that doesn't match your organization's approved list. While Azure Policy cannot "check" if a user has a license, it can ensure that your infrastructure is deployed in a way that makes auditing easier.

For example, you can enforce a policy that requires all session hosts to be associated with a specific "Cost Center" tag. This allows your finance team to easily pull a report of all AVD-related compute costs and compare them against your M365 license counts. This creates a "single pane of glass" view of your virtualization spend.

Example: Azure Policy Definition (Snippet)

{
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        {
          "field": "tags['Environment']",
          "exists": "false"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

Explanation: This policy denies the creation of any VM that lacks an "Environment" tag. By enforcing this, you ensure that every session host you deploy is categorized, making it significantly easier to reconcile your infrastructure costs with your licensing entitlements.

Summary and Key Takeaways

Planning your AVD licensing is as critical as configuring your network latency or image optimization. By understanding the relationship between your Microsoft 365 entitlements and the AVD service, you can create a robust, cost-effective, and compliant environment.

Key Takeaways:

• Entitlement is Mandatory: You cannot use AVD (specifically the multi-session OS) without an underlying M365 E3/E5/Business Premium license or Windows Enterprise E3/E5 subscription.
• Internal vs. External: Use M365 licenses for internal employees and the "Per-User Access" pricing model for external contractors to keep costs optimized.
• Automation is Key: Use Group-Based Licensing in Entra ID to ensure that as users move through your organization, their licenses move with them automatically.
• Audit Regularly: Use PowerShell or the Azure Portal to audit user license assignments against actual AVD usage to avoid compliance gaps.
• Don't Ignore the Compute: Licensing is only one half of the bill. Use Reserved Instances for your session host compute to maximize the savings achieved by using the BYOL (Bring Your Own License) model.
• Test for Compliance: Always perform a negative test. Ensure that users without valid licenses are blocked from your environment to confirm your identity and access management (IAM) controls are working correctly.
• Right-Size Your Licenses: Don't default to E5 if your users only need E3 features. Regularly review your license tiers to ensure you aren't paying for unused features.

By following these principles, you will transition from simply "deploying AVD" to "managing a lifecycle," ensuring that your virtual desktop infrastructure provides maximum value to your organization while remaining strictly within the bounds of your software agreements. This strategic approach to licensing is the hallmark of a mature cloud architecture and will serve your organization well as you scale your remote work capabilities.