Licensing Office in a Remote Desktop Environment – Updated

Update – January 19, 2015
After posting the last update a week ago, I spent more time rooting around the Microsoft Web site, and ended up in a relatively painful 45-minute chat session with a Microsoft “Licensing Specialist.” A large portion of that time was spent just trying to get said Licensing Specialist to understand the question I was asking. Ultimately, I had to give up on my attempt to get an answer as to why Microsoft still had a live link to a Volume License Brief that appeared to be out of date and that apparently contained information that was no longer valid…because the Licensing Specialist couldn’t get to the document in question. According to her, when she clicked on the link below, she received an error message stating that the document had been removed from the Microsoft Web site. As I write this update, the link to the 2009 Volume License Brief is still live, and I just verified that the document is still there. I will leave it to you to figure out why I can still get to it but she couldn’t. She offered to have a Microsoft manager call me the next day. It’s been a week now, and I have yet to receive that call. (It’s possible that the manager attempted to call me, but, if so, did not leave a voice mail message.)

In the absence of any other information at this point, my best advice is to assume that this Volume License Brief supersedes the information in the earlier one (even though the earlier one is still available on Microsoft’s Web site), and that, to be on the safe side, you should insure that, if you are accessing Office applications via RDS, the edition and version on your RDS server(s) match the licenses you have for your client devices.
…end January 19 update…

Update – January 12, 2015
A few days ago, Markus challenged my statement (see comment below) that it was permissible to access Office Standard via Remote Desktop Services if your client was licensed for Office Pro Plus, and that it was also permissible to access an older version (e.g., Office 2010 Pro Plus) via Remote Desktop Services if your client was licensed for a newer version (e.g., Office 2013 Pro Plus). I can state definitively that this was the case, as recently as November, 2009. This Microsoft Volume License Brief, originally published in 2007, and updated in November of 2009, contained the following graphic (click to enlarge):

OfficeAccessMatrix
This graphic clearly shows that it was permissible to access Office Standard from a client device licensed with Office Pro Plus, and that it was permissible to access an older version of Office from a client device licensed with a newer version. However, a later Volume License Brief suggests that this may have changed. I am attempting to get clarification from Microsoft, and will update this post again as I get more information.
…end Jan. 12 update…

Judging from the questions we continue to be asked, lots of people are confused about how to license the Microsoft Office Suite if you are accessing it via Microsoft’s Remote Desktop Services (a.k.a. Terminal Services) and/or Citrix XenApp. Hopefully, this will help clear up the confusion. We’ve also updated this post to include information about how to license the applications in a Cloud hosting environment.

First of all, it is important to keep in mind that desktop applications such as the Office Suite are licensed per device, not per user. According to the latest Microsoft “Product Use Rights” document dated April, 2014, a “Licensed Device” is “the single physical hardware system to which a license is assigned.”

That begs the question of what “assigned” means, and the answer – particularly for devices like thin clients, where you couldn’t install the application locally if you wanted to – is that you are on the honor system. You decide, in the privacy of your own conscience, which licenses you are assigning to which devices – with the caveat that, if you’re ever audited, you’d better be able to produce a license for every device people are using to run Office apps. You can reassign a license from one device to another, but not more often than every 90 days, unless it’s due to permanent hardware failure.

Once you’ve assigned each license you acquire to a device, you have the following rights (again quoting from the Product Use Rights document, with my commentary in italics):

  • You may install the software on the Licensed Device and a network Server.
  • Unless you license the software as an Enterprise Product or on a company-wide basis, you may also install the software on a single portable device. That would cover a user who, for example, had both a desktop PC and a notebook PC.
  • Each license permits only one user to access and use the software at a time. So, technically, it would be a license violation for someone else to run Office on your desktop PC while you’re in a hotel somewhere running it on your “portable device.”
  • Local use of the software running on the Licensed Device is permitted for any user. So it’s OK to let someone else use your desktop PC to run Office, as long as you’re not simultaneously running it on your “portable device.”
  • Local use of the software running on a portable device is permitted for the primary user of the Licensed Device. So, technically, it would be a license violation for you to let someone else run Office on your “portable device” under any circumstances.
  • Remote use of the software running on the Licensed Device is permitted for the primary user of that device from any device or for any other user from another Licensed Device. So if your Licensed Device is your desktop PC, it’s OK for you to use GoToMyPC or some similar remote access method to access and run that copy of Office, using whatever kind of client device you want – including, say, an iPad. However, any other user could not remotely access your desktop PC to run that copy of Office unless they were doing so from another Licensed Device.
  • And now the most important point relative to the subject at hand… Remote use of the software running on a network Server is permitted for any user from a Licensed Device. A Remote Desktop Server falls under the definition of a “network Server.” So any user who is accessing Office via Remote Desktop Services must be doing so from a Licensed Device.

In other words, if you can walk up to a device and use it to access a Remote Desktop Server and run Office, you must have an Office license for that device. It doesn’t matter whether that device is a PC or laptop that has the Office bits installed on its local hard drive, or whether it is a thin client device that only knows how to connect to a XenApp server, you need to have “assigned” a license to that device.

It’s also important to note that all of the above came from the Product Use Rights document for Microsoft Volume Licenses. You do not, never have had, and probably never will have the right to access Office on an RDS or XenApp server from a device that has an OEM Office license installed on it. If your PC or laptop came from the manufacturer with Office pre-installed on it, then you have an OEM license, and you do not have “network storage and use” rights. There is an excellent blog post over on the Microsoft SMB Community Blog that explains this in detail. Yes, it’s an old post (from July, 2005). No, the policy hasn’t changed.

Things get a bit more complicated when you move to the Cloud. For example, if you are a VQOffice® customer, and you want to run Office apps on our cloud servers, we can, of course, bundle the Office licenses into your monthly fee under our Microsoft SPLA (“Service Provider License Agreement”). But what if you already own volume licenses for Office? According to the Product Use Rights document, we can use your licenses “provided all such Servers and other devices are and remain fully dedicated to your use.” Given the highly virtualized environments of nearly all Cloud hosting providers (including us), that’s going to drive the cost of the solution up significantly unless you have enough users to justify dedicating hardware in our data center just for your use. For most small businesses, it will be less expensive to pay us for the use of our SPLA licenses than to pay us for dedicated hardware so you can use your own licenses.

What about Office 365? Office 365 is governed by a completely different use rights document – the Online Services Use Rights document. If you read through that document, you will find that, under the E3 plan for example, each user has the rights to activate the Office software on up to five devices, which is a pretty good deal. You will also find the following statement: “Each user may also use one of the five activations on a network server with the Remote Desktop Services (RDS) role enabled…” At first blush, you might think that means you could use your Office 365 E3 licenses to cover running Office apps in our Cloud hosting environment – and you would be right, provided that you’re running on dedicated hardware. So, basically, the same rules apply to Office 365 licenses as apply to volume licenses. We’d be delighted if the rest of the world added their voices to ours to try to get that policy changed.

Disclaimer: I do not work for Microsoft, nor do I define their license terms, which are subject to change, particularly when new product versions are released. I have, however, worked with them for a very long time, and had lots of discussions about what is, or is not, legal under the terms of various license models. The foregoing is my own interpretation of information that is publicly available on the Microsoft Web site – and I have helpfully provided you with links to that information. I highly recommend that, if you have any questions, you download the relevant Product Use Rights document and read it for yourself.

40 replies
  1. Olivier
    Olivier says:

    Sid this is a great thread.

    Can you help me on how RDS verifies that external users are properly licensed ?

    We have a bunch of free lancers accessing our network through Citrix. We are migrating company users to O365 E3 and Citrix to RDS but need a solution for external users who need to access and edit documents on our network through their own machine. In a scenario where they would be appropriately licensed (e.g. through O365 ProPlus) so they have networking rights – how does RDS even know that they are licensed appropriately ?

    Thanks

    Reply
  2. kevin
    kevin says:

    PLEASE HELP…

    i have a customer with a 2008 r2 terminal server. 3 client pc’s, 3 client laptops. we use the TS for about 7 sage products, they rdp into it. they do all their office stuff on their pc’s (email docs etc)

    we have office 2007 small business (non volume) licenses on the desktops/laptops. i have to upgrade the office licenses because the hosted exchange provider is upgrading their Exchange and it no longer supports Outlook 2007.

    i would like to be able to use the new office licenses on the TS as well. i am really confused as to whether they need an office license for each pc/laptop AND a license for each user account on the TS, or whether, because they only access the TS from their pcs/laptops, if they can get away with having 6 office liceses, with a version on the pc/laptop and a version on their TS account.

    secondary question:
    to add to the confusion, there is an offshore company that have two logins for the TS. we dont want to have to buy office licenses for them on the TS. assuming everything is hunky dory in the first question above, how can i prevent the offshore logins from using office on the TS?

    thanks in advance

    Reply
  3. Kevin Maire
    Kevin Maire says:

    What about external users (customers) connecting to our Citrix XenServer and we’re using the External Connector to license the RDS portion. Is the only way to license my customers to use Office on the XenServer to use SPLA from the hosting company (which does offer this), or can I buy my own Open licenses with SA for each External user?

    Reply
    • Sid Herron
      Sid Herron says:

      Wow, that’s a tough one, Kevin. I think you may have to talk to Microsoft about that. I’m not sure that there is a way to license people who are not part of your organization unless you go the service provider route.

      Reply
    • Rene van Roon
      Rene van Roon says:

      Hello Kevin, If the -Xen- server runs on shared server hardware (not dedicated) you need to use SPLA licenses for Office. You cant use your own Office licenses, with or without SA.
      The SA benefit ‘license mobility’ enabling running YOUR licenses in a service provider environment only exists for Sharepoint, System center, sql, CRM, Exchange, Lync and RDS.
      Since this year MS enabled the use of Office 365 ProPlus liceses on a Service Provider environment (instead of SPLA).

      Reply
      • Sid Herron
        Sid Herron says:

        Thanks for your input, Rene. One thing that wasn’t entirely clear from Kevin’s question (and which I should have asked) is who owns that infrastructure – are the servers and software owned by Kevin’s organization, or are they owned by the hosting company he referenced? Also, to clarify, yes, Microsoft has enabled the use of Office 365 Pro Plus licenses on a Service Provider’s infrastructure, but only for certain service providers. In the U.S., only service providers who are “Tier 1” members of the Microsoft Cloud Solution Provider program have the ability to do this. That means they are large enough to be dealing directly with Microsoft on the resale of O365 licenses (as opposed to working with a distributor), and have met a minimum license volume requirement. My hope is this is just a first step, and that Microsoft will eventually open this up to all Service Providers who are also Cloud Solution Providers.

        Reply
  4. Tony
    Tony says:

    Sid – great summary – Thanks
    Just like to confirm my interpretation
    We have a mixture of OEM (2007,2010,2013) , Retail (7,10,13), and Office 365 subscriptions
    Every preson/computer has a Lic version under one of these and we would like to add Office to our RDS housed in a data center on a VM on a shared farm…(ie very occatiosnly it makes sense to run on the RDS rather than local…)
    I am proposing we add Office 2010 or 2013 to the RDS and PREVENT users who have OEM or 2007 versions from accessing Office on the RDS – if they need it we will upgrade them to Office 365 and allow them access

    Will this keep us in compliance – or have i missed the point along the way – or other wise dreaming…

    Reply
  5. Chris Neal
    Chris Neal says:

    Sid, thanks for the clarity on this complex issue. If I have and RDS server accessed by users that have mixed licenses for Office, some with VLK editions on their device and others licensed through Office 365, would/could/should I install both the VLK office edition AND the Office 365 edition on the EDS server to be in compliance? Is installing both editions on the EDS server even possible? Thanks, Chris

    Reply
    • Sid Herron
      Sid Herron says:

      Good question, Chris,
      To my understanding, it doesn’t matter what media you use to install the Office apps on your RDS server. You could have the VLK edition installed on your RDS server, and your Office 365 subscribers would still be legally entitled to access those applications via RDS as one of their 5 permitted instances. And given the way the O365 app installation works, it will probably be a lot easier to install the VLK edition on your RDS server.
      -Sid

      Reply
  6. Christophe
    Christophe says:

    Hello,
    I am a little bit confused, maybe due to english language… I am working on a projet to build a remote Ap environment. I would publish Excel on it.
    My destop users need to have Excel both on their desktop to create Excel Files, and on the Remote Ap server to run M Report on a remote SQL DataBAse.
    – is it enough to have ONE Office Licence per desktop or should I have one t=for the desktop and one for the Remote Ap (saying this is the same release) ?
    – if I decide to work with Office 365, same question : ONE or TWO licences needed ? Or Mabe one Office Licence and One CAL for Remote Ap ?

    Please advise !
    Thanks,
    Christophe

    Reply
    • Sid Herron
      Sid Herron says:

      Hello, Christophe,
      Thanks for your comment. The answer is that it depends on what licenses you own. Volume licenses include “network access” rights, OEM licenses (the ones that you get bundled with a new PC) do not. So if you own a volume license for Excel (or for the full Office suite) that license would cover running Excel on the client desktop and on the Remote Desktop Server.

      Regarding Office 365, all of the business plans include the rights for each user to install the Office apps on up to five PCs or Macs. One of those five installation instances can be used to cover running the apps via Remote Desktop Services…provided it’s your Remote Desktop Server. Unfortunately, it doesn’t cover running the apps on a service provider’s infrastructure.

      Service Providers (like ManageOps) are required to report and pay for Office Licenses under the Service Provider License Agreement regardless of what Office licenses our customer owns, unless the customer is large enough that we can cost-justify putting the customer on dedicated hardware in our data center. And given the realities of data center economics, that is generally not going to be cost effective for any organization with fewer than 200 users or so.

      Reply
  7. Epco
    Epco says:

    Hi Sid,

    Thanks for this great article. However I do have still a question.

    In the MS document it is stated with the examples that a call center has 50 desktops. Does MS already mean the RDS desktop on the RDS server or a physical desktop.

    Because my situation is as follows:
    So if I have 4 different user sessions (I created 4 user accounts) using Excel on 1 physical RDS server and on 1 physical desktop. How many Excel licenses do I need.
    One for the physical desktop (because it’s device based) and one on the RDS Server.

    This situation is to split the 4 excel threads on the RDS server, because the sheets loaded are very big.

    They are presented on a six monitor physical desktop.

    Looking forward to your reply.

    Reply
    • Sid Herron
      Sid Herron says:

      Volume licensing terms for the Office Suite require you to have a license for every device that will be used to run the application(s), regardless of whether the application is installed locally on that device or accessed over a network (e.g., accessed via RDS). So you would not need to purchase an Excel license for the RDS server itself, but you would need an Excel license for every client device that your RDS users would be using to run Excel via RDS. If those four users are sharing a single client PC, you would only need one Excel license.

      Reply
  8. MarcK4096
    MarcK4096 says:

    I asked our licensing specialist about this a while back. She said that the Product Use Rights (PUR) never allowed an Office Professional Plus user to access remotely (or downgrade to) a Standard edition and she thought that the licensing brief was just wrong. The PUR is the authoritative document representing the legal agreement between you and Microsoft.

    This particular licensing brief probably came about by someone trying to do the unthinkable and apply common sense to Microsoft licensing. Once the error was discovered, it was removed from future revisions.

    I keep hoping that things will change. After all, an Enterprise to Standard downgrade was permissible in the Windows Server PUR. So, sometimes common sense does prevail.

    Reply
    • Sid Herron
      Sid Herron says:

      Thanks for the comment. Yes, there are several places where Microsoft licensing doesn’t seem to align with common sense. For example, under the PUR, it’s perfectly OK to exercise your “downgrade rights” to run, say, Office 2007 on your laptop if you own a volume license for Office 2013. So why would it not be OK to remotely access a copy of Office 2007? It doesn’t seem to me that there’s any practical difference there, but apparently there is, at least in someone’s mind. I’ve found over the years that if you ask three different people at Microsoft a licensing question, you’re likely to get at least three different answers. At this point I’m not as concerned about whether the answer makes sense as I am about simply making sure that we’re all clear on what the answer is…and, if possible, alerting someone at Microsoft that there is a live link on their Web site that appears to link to misleading and obsolete information. (If it was my Web site, I’d want to know that so I could fix it…)

      Reply
      • MarcK4096
        MarcK4096 says:

        If you have Office 2013, you can remotely access Office 2007. What you cannot do is remotely access Standard edition if you have Professional edition locally.

        Reply
        • Sid Herron
          Sid Herron says:

          If you can provide a Microsoft reference that supports that statement, I would be delighted to post it. All of my research has come up empty, and the most current document I’ve been able to find appears to state the opposite: the PDF that I linked earlier in this comment thread specifically states that the “suite/edition, components, language, and version” have to match.

          Reply
          • MarcK4096
            MarcK4096 says:

            AFAIK it’s a combination of network use rights and downgrade rights. If you have downgrade rights, you are licensed for the installed version as well as earlier versions. Remote access rights require a license match of edition, components, language and version. With downgrade rights, you have this match.

            Remember that nothing needs to be installed on the system for you assign a license to it. If you have an iPad using Excel on your RDS, then you assign an Office license to that iPad even though you don’t install anything.

            This is my understanding. I don’t have the time to ferret out exact Microsoft documentation for it. We asked our licensing specialist and this was her explanation.

          • Sid Herron
            Sid Herron says:

            That certainly would make sense to me – it’s what I would logically expect the policy to be, and I know it was the policy in the past, as evidenced by the older Volume License Brief that I linked earlier. Unfortunately, I can’t confirm with anyone from Microsoft today that it’s still the policy, and unless/until I have some kind of official statement from Microsoft, I have to take the most recent PDF Volume License Brief at face value and assume that it means what it says…and what it says is that the “suite/edition, components, language, and version” have to match. Personally, I wouldn’t lose any sleep over the issue of remotely accessing Office 2007 from a device that’s licensed for Office 2013, because I seriously doubt that anyone from Microsoft would make an issue of it. But that’s not the same thing as saying that I’m sure it’s permitted under the current license terms. And Lord knows it wouldn’t be the first time that Microsoft’s license terms have defied logic…

  9. Wondering
    Wondering says:

    Hi!
    Do you know if i can acces an office 2007 suite remotelly installed in a terminal server from a laptoo wich has a copy of office 2013? I have read than the versions have to match.

    Thanks in advance.

    Reply
    • Sid Herron
      Sid Herron says:

      Good question. Within the constraints outlined in the post, yes. Both the copy of Office 2007 on the Terminal Server and the copy of Office 2013 on the laptop must be volume licenses. However, if the copy on the terminal server was Office 2013, you would not have the right to access it from a laptop that was licensed for Office 2007 – so think of it as being similar to the backward-compatibility rights that come with pretty much all Microsoft volume licenses. (Technically, that also means that if you had an Office 2013 license for the laptop, but you had chosen to exercise your downgrade rights and install Office 2007 on it, you would still have the rights to remotely access Office 2013 on a Terminal Server – because what counts is the license you own, not the version of the software that’s actually installed.)

      Also, you do not have the rights to remotely access a copy of Office Pro Plus from a laptop that’s licensed for Office Standard – but you could legally access a copy of Office Standard remotely from a laptop that’s licensed for Office Pro Plus.

      Reply
      • Markus
        Markus says:

        Hi,

        where did you take the information that it is legal to access Office Std. on TS if the client is licensed with Office Pro from? (last chapter in your post).
        I was not able to find this information in the PUR or anywhere else.

        br
        Markus

        Reply
        • Sid Herron
          Sid Herron says:

          Markus,

          That’s an excellent question, and it prompted me to do some research. I know that used to be the case, but it appears that things may have changed. According to the Microsoft Volume License brief entitled Licensing Windows Server 2012 R2 Remote Desktop Services and Microsoft Desktop Applications for Use with RDS, “Use of Microsoft desktop applications in a Remote Desktop Services environment requires that the suite/edition, components, language, and version of the license acquired for the desktops from which the desktop application is remotely accessed matches that of the copy of the application being accessed.” So it sounds like it is no longer permissible to access Office Standard via RDS if the client is licensed with Office Pro. I will reach out to some of my contacts at Microsoft and try to get confirmation, and edit this post accordingly.

          -Sid

          Reply
  10. serveurs dell
    serveurs dell says:

    You actually make it seem really easy together
    with your presentation however I find this topic to be really one thing which I think I might by no
    means understand. It seems too complex and very huge for me.
    I’m having a look ahead for your subsequent publish, I’ll attempt
    to get the cling of it!

    Reply
  11. Ted Mittelstaedt
    Ted Mittelstaedt says:

    “…Sadly, Microsoft have a monopoly,
    The sooner that monopoly is broken, the better…
    I’m not sure how that’s even relevant, Karl….”

    I agree 100%. The only people who consider MS Office a requirement are the same people asking administrators to load it on their Terminal Server. They need to put their money where their mouth is. Either MS Office is a requirement and you pay through the nose for it or it’s not a requirement and you don’t pay anything at all for Open Office.

    As a consultant I always tell customers that they have an alternative – Open Office – that is compatible with their MS Office document formats, when they get sticker shock after I explain the costs of licensing Office on Terminal Server. Sometimes they even go for it because the main reason they wanted Office on the Terminal Server was for quickly viewing Word documents or spreadsheets where they do their main creation elsewhere.

    I have probably denied Microsoft tens of thousands of dollars of Office revenue over the years by getting customers to use Open Office in place of MS Office on their Terminal Servers.

    It is Microsoft that is hurting itself the most by it’s Office licensing. You are only choosing to be hurt by their pricing and constant upgrades.

    Reply
      • Sid Herron
        Sid Herron says:

        Perhaps I don’t understand your question. If you’re connecting to a SQL server as a client (via an ODBC connector or otherwise), you need a SQL CAL, but that’s a separate issue from Office licensing.

        Reply
      • Josh
        Josh says:

        There is actually an MSAccess runtime that allows you to do this, and does not require licensing.

        You do need the license for the users who will use MSAccess to create.

        Reply
  12. Dave S
    Dave S says:

    Do these rules apply only if the software is purchased with SA? I think it’s necessary to clarify that the “roaming use” rights described above only come into play if you purchase Software Assurance along with the license.

    Reply
    • Sid Herron
      Sid Herron says:

      Good question, Dave. What I discussed in the post above are “remote” use rights, which do not require SA. “Roaming” use rights are a bit different, and are a benefit of SA. Roaming use rights have to do with something called a “Qualifying Third Party Device” (“QTP” hereafter to save keystrokes), which is defined in the Product Use Rights document (“PUR”) as “a device that is not controlled, directly or indirectly, by you or your affiliates (e.g., a third party’s public kiosk).” Other QTPs, in my opinion, would include a PC in a hotel business center, or at an Internet cafe, or at a FedEx/Kinkos location. These rights, which are described way back on page 67 in Appendix 2 of the the PUR, allow the primary user of a licensed device to:

      • Remotely access the software running on your servers from a QTP – this would cover RDP/Citrix access scenarios.
      • Run the software in a virtual OSE instance on a QTP. So you could legally load a VM image that contained the Office apps onto a QTP and boot/run it that way.
      • Install and use the software on a USB drive on a QTP. So you could use something like VMware’s ThinApp to roll up a portable Office package on a USB drive that you could plug into a QTP and run Office that way.

      Thanks for the feedback!

      Reply
  13. GeorgeD
    GeorgeD says:

    Home Use and Portable Use rights in Volume Licensing give you the right to install Office on a home PC or laptop. This second copy does not have Network Use Rights, however, so whilst it can be used to licence the device to run Office locally, it can’t be used to run Office via RDS/Citrix. if you want to deploy via the network, you have to have a Volume Licence for that device, not using the Portable Use or Home Use Rights of a different device.

    Reply
    • Moose Administrator
      Moose Administrator says:

      I’m not sure how that’s even relevant, Karl. If you have an office suite you’d prefer to use instead of Microsoft Office, you’re free to do so. Some may even run on XenApp. But Microsoft Office is the de facto standard – so if you’re going to deploy it via Remote Desktop Services, it’s your responsibility to do it in a way that complies with Microsoft’s Product Use Rights for the Office Suite. That has nothing to do with whether Microsoft is, or is not, somehow a monopoly. It has everything to do with being legally licensed for the software you run.

      Reply

Leave a Reply

Want to join the discussion?
Feel free to contribute!

Leave a Reply to Rene van Roon Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.