SQL Server CAL Licensing Requirement to be legit

We are running a document management system called FileDirector. The main server app is .NET 4.0 based and is hosted on IIS, and the client app (running on Windows workstations) connects to the FileDirector server via the HTTP protocol. FileDirector's document related and configuration data is all contained in an SQL Server instance running on the same server.

Now, before we fork out loads of money for SQL Server, I want to be sure I understand the licensing requirement. SQL Express is not going to be good enough for the job, as we're exceeding the 10GB ceiling by quite a lot (DB is about 30GB). I'm looking at licensing SQL Standard, but my question is about our obligations re Client Access Licenses. Am I correct in understanding that for every FileDirector client app that connects into the FileDirector Server (which has SQL Server on the back-end) I will need either a User or Machine CAL? So, for examples sake, if we have a total of 17 users of the FileDirector client (about what we have), I'll need to buy a license of SQL Standard, but then 17 User CALs (assuming I'm choosing the User licensing route)?

Or can we license just SQL Standard and a single Machine CAL for the FileDirector Server directly connecting into it (I already very highly doubt this, but just want people to confirm this would not be correctly licensed).

Many thanks in advance :-)
Who is Participating?
bluemercuryConnect With a Mentor Author Commented:
Thanks yo_bee.

So sorry - just seen your most recent comment. I don't recall that I got an email notifying me there was a new comment on this post.

Thanks for sharing that link in your last post - that pretty much outlines what I thought was the case.

In addition, I found it quite succinctly put in point 2 of this Microsoft discussion here. To quote the most helpful info on there, which sums up our position:

"for example, you have an application server which uses SQL Server for its database – users of the application (or the devices they use) will need a SQL CAL even though they may not access the SQL Server directly."

In addition, I did look again at the Core licensing model now that SQL 2017 is out, and unfortunately it is still the same rules that, even in a virtual instance of Windows, a minimum of 4 cores need to be licensed (even if there was only 1). In my situation, this makes the cost about double if going the Core route vs conventional with CALs. We'd have to grow substantially as a business to make it worthwhile, which is not going to happen any time soon!

Thanks for your help - I'll award points now. Many thanks! :-)
Lee W, MVPTechnology and Business Process AdvisorCommented:
Licensing is not by user account, but by human being or by end user device.  If you license 1 device and have people take turn using RDP to connect and use it, you are violating licensing because the end user device is whatever the end user is using to connect to the RDP host.

Likewise, you can't create a user account (for example, "sqluser") and then only get one user CAL while everyone logs in using the same account.

You also can't setup 5 machines and designate 5 people but then one one takes a vacation or a sick day, have someone else fill in - that someone else needs a CAL.  CALs are only transferable once every 90 days OR if a user leaves the company.  So you can designate a group of people but others cannot fill in UNLESS they have CALs assigned to them.

Plan this out (in most cases, user CALs make the most sense) based on how you need to work.  

Licensing Disclaimer
License information provided here is "best efforts".  The comments of the respondents are based on interpretation of the license agreements and their knowledge of the particular laws and regulations in their geographic location.  Laws in your location may invalidate certain aspects of the license and/or licenses can change.  "They told me on Experts-Exchange" will not be a valid excuse in an audit.  You need to contact the license granting authority to confirm any advice offered here.
yo_beeDirector of ITCommented:
There is a cost analysis that you need to do to find the break even point for per user vs Core Cal.  With 17 users only connecting I think you want the per user CAL vs Per Core CAL model.

I found this site that really helps illustrate the comparison between the 2 models  
Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

bluemercuryAuthor Commented:
You'll note in my post I've been very careful to not use the term 'user account'. I'm totally clear on what defines a User CAL and a Device CAL (sorry, I used term Machine CAL before - it's late and I'm tired.....). That is not my question here.

Let me try and summarise what I'm asking..... I want to know when a CAL (of any type) for SQL is fundementally legally required. Given the FileDirector application is the only thing that ever directly interfaces with the MS SQL DB, are CALs needed at all? I think the answer is yes - I suspect a CAL is needed for each instances of client connection to the FD system, as it's considered that the FD client is utilising SQL Server, if by a form of proxy through the FD Server.

So to be clear, my question is not about CALs themselves (I'm long time familiar with the logisitics internally of CALs and how they operate - including the 90 day ruling you've specified) but moreso when a CAL is required for an SQL Server to be correctly licensed and used. It's the difference between about £600 and £3,200, so I want to make sure I have it right.

Thanks :-)
bluemercuryAuthor Commented:
Hi yo_bee.

Thanks for that addition. Yes, I looked into the 'Core' option, and I think it was clear it wasn't cost effective owing to number of CPU Cores we have, and the minimum that MS set to get onto that license route. It was a few months back so I can't recall all details, but it was definitely a more expensive route.

I'll take a look at your link in the morning - 3:00am here in the UK, so logging off for a bit :-)

As expressed in my post to LeeW, I just want to know what the legal requirement for when to have SQL CALs and not, and whether CALs are needed in the scenario I've described. I'm pretty sure it's a yes, but want to know this before purchasing. I suspect the only instance in which CALs might NOT be required is if it's running as an SQL back-end DB to a public website.

Thanks :-)
yo_beeConnect With a Mentor Director of ITCommented:
File Director is an application that uses MS SQL. That is not the device that is being licensed.
The server has a Server license that allows you to install SQL Standard legally.  The CAL's are for the number of clients that will be touching the DB instacnces.  So if you have 17 user connecting at any give time you will need 17 cals. I do not think the devices will matter here.

bluemercuryAuthor Commented:
Marking my solution as best as that most succinctly describes our situation on the MS page linked and thereby provides an answer, but yo_bee's link gives a good indication too, and so have award all points to them. Thanks!
All Courses

From novice to tech pro — start learning today.