Microsoft Software Licensing Gotchas - How to Avoid and Optimize Your Existing Spend

July 06, 2016

Jason Christensen | ITAM Product Marketing Manager | Ivanti

It's no secret that software licensing models have become more complex and confusing over the years, especially with virtual, cloud, and hybrid environments. Join LANDESK One partner Anglepoint for this live one-hour webinar to learn the top insider Microsoft software licensing "gotchas" from "reformed" Big 4 software auditors and how to turn your confusion into optimization and cost savings. We'll then walk you through real-life examples so you too can start taking control of your Microsoft license estate immediately.


Introduction:Defining a “gotcha

Kris: Selinaand I represent Anglepoint, which is a specialist services firm. We specializein all areas of IT asset management, software asset management, and softwarelicense optimization. We hold a number of industry certifications and havecertifications and affiliations with a lot of the largest software publishersthat we're accredited through. We're very active within the software assetmanagement industry from a standards standpoint, and serve some of the world'slargest clients from a managed services standpoint. We are, from a Microsoft®standpoint, since it's relevant for this discussion today, gold certified inthe software asset management competency, as well as gold certified in Cloudproductivity. 

Just to kind of kick things off here—when we're talking about Microsoftlicensing “gotchas”—we've searched the Internet high and low looking forMicrosoft gotchas and here's sort of a collection of what comes up when yousearch for Microsoft licensing gotchas. A little bit of a warning here.Apparently there was an arcade game in the 70s called Gotcha, and another golfgame from, it looks like, the 60s or 70s. There's a Japanese arcade game,Gotcha Forest, apparently. And there are many political gotchas. A lot ofdifferent gotchas surface when you just do an Internet search for “gotcha.” 

But the gotchas we're going to be talking about are not necessarily the onesyou're going to find just simply searching around on the Web. They are ones werun into all the time and speak with customers about on a daily basis that arereal issues and problems for most organizations. There is a lot of nuance andcomplexity when it comes to Microsoft licensing, so we've tried to pulltogether the more common ones that we help customers with when helping themoptimize their spend with Microsoft, a strategic vendor for most organizations.


Common MSDNlicensing mistakes
To start things off, let's talk about some common licensing mistakes when itcomes to MSDN subscriptions. You know, there’s a gamut here, but generallyspeaking, sometimes organizations buy cheap but use expensive from an editionstandpoint. You want to make sure that you're right licensing your developersso that you're using the edition of the subscription they're actually going touse. Keep in mind there's been some developments in this area, some newproducts from Microsoft in recent years, such as MSDN Platforms, which givestesters a subscription for MSDN and the rights to do the testing they need todo on nonproduction systems, but it doesn't include the Visual Studiosubscription. This makes the Platforms subscription cheaper. If you can, takean objective look at your MSDN needs and then segment. For example, perhaps allyour developers want Enterprise edition, but you go through and identify whoactually needs Enterprise versus some of the other offerings that are availablethrough MSDN. That's one common thing we see.

Another is not buying enough subscriptions. One thing to keep in mind is thatin the MSDN benefits portal, there's no technical restriction on how manysubscriptions you can assign to users or developers. So some people think, “Well,if I subscribe to a certain amount, then within the MSDN benefits portal, itwill only allow me to assign or ascribe those to the same amount of users.” That'snot the case. You can actually assign or ascribe subscriptions to as manypeople as you want. There's no technical restriction, but there is, of course,a licensing requirement with each of those. So you definitely need to know whatyour entitlements are, talk to your benefits administrator so that you don't goover that mark unwittingly. That's one way customers get in trouble—using moreproducts than they purchased and failed to order. 

Another is with expired MSDN subscriptions. Someone who doesn't have an activeMSDN subscription can't necessarily use the latest version of the product. Theyonly have rights to the version of the products at the time their MSDNsubscription ends. That can get companies into trouble very quickly withexpired subscriptions. 

In addition to that, as we move across the gamut beyond expired MSDNsubscriptions, we have unlicensed outsourcing. Some customers use outsourceddevelopment agencies or partners and assume that those development partnersbring their own licenses to the job sites. Sometimes that's not spelled outnecessarily in the services contract, and so what can end up happening isneither party actually is licensing the software that the outsourced developersare using. You want to make sure that's clearly spelled out in the servicesagreement with an outsourced development agency if you are expecting them touse their own licenses. If you're not expecting them to use their own licenses,you want to make sure that you’re right licensing those contractors.

Another area is with the misuse of the benefits themselves. This is where apartner, an MPN partner, is using MPN licensing to provide software developmentservices. As a Microsoft partner, there are partner licenses or partner grants,but those are not to be used for developing production systems. They are forvarious other activities—R&D, for example. But just be aware that there isa difference between the use rights when it comes to licenses that come byvirtue of being a Microsoft partner versus the nonproduction grants that comefrom an MSDN subscription. 

And then finally, incorrectly licensed for nonproduction. This is where a customeris using MSDN software without licensing all users reaching those environments.This can be a particularly vexing area to track and manage. You have to countall of the users that are accessing the software, either directly orindirectly, the same as you would production. And that has to take into accountany data multiplexers or user pooling as it may be, either from a software or ahardware standpoint. And so, again, there's some challenges around this area,depending on how a customer may or may not be managing its user environment. Ifthey're shared accounts, for example, from a development standpoint, tyingthose shared accounts back to who's actually using the software can be achallenge and can get customers into incorrectly licensed positions for nonproduction.Selina, anything else to add when it comes to MSDN?

Selina: Yes, let's just recap quickly, Kris, when you do need a subscriptionand when you do not. There's actually relatively few scenarios where a user whois accessing a nonproduction environment doesn’t need a subscription. So again,just to reiterate what Kris said, it is licensed on a per-user basis, so you'regoing to need to assign that license to the user. And they may use that toinstall and use the software at any number of devices to design, develop, test,or demonstrate their program. A license is required for any use of theMicrosoft software, so this is where a lot of customers get tripped up.Installing is actually considered a use of the software. 

Working without an MSDN subscription
Now, for those who do not need an MSDN subscription, there are, as I said,relatively few scenarios. One scenario would be if you're demonstrating usingterminal services. All of the Visual Studio subscriptions that you purchasewill include the use of a Windows server remote-desktop service for up to 200simultaneous anonymous users. They can use that to access an onlinedemonstration of your program without needing an MSDN subscription. Second isuser acceptance testing. At the end of your software development project, endusers can typically review your application and determine whether it meets thenecessary criteria for release. This is what is called UAT, and that does notrequire an MSDN subscription. Lastly, the feedback client for Team Foundation Serveris the third scenario where you would not need an MSDN subscription for any endusers who can download that free client for TFF. 

Three things tobe aware of when using Office 365
From here we're going to move on to another area of gotchas around Office 365.There are a couple of terms to be familiar with. If you've purchased Office 365but you're not actually using it and you haven't deployed it yet, these aregoing to be very important to you. The first one is Click to Run. This is the Microsofttechnology for how they actually deploy the Office 365 bit. The other one is SharedActivation, which is how Microsoft allows you to deploy Office 365 ProPlusthrough RDF so it can issue a token and be on a user-based licensing model, asOffice 365 is. 

What we've seen around this, and why this is a gotcha, is customers areadopting Office 365. The incentives that Microsoft has have actually changedand evolved along with that to move from being incented by the adoption of theproduct to the actual consumption of it. Where a customer, in the past, mighthave purchased Office 365 but continued to run their on-premise OfficeProfessional Plus, we're seeing Microsoft actually start to force their hand alittle bit with that migration. It might be in the form of an amendment, forexample, where they give you an actual time frame such as 90 days to finish themigration. Keep in mind that if that does come up, it’s because someone atMicrosoft that you're working with is being incentivized around the consumptionof Office 365. So, obviously, if you've bought it, they want you to start touse it. 

The ins andouts of license mobility
Our third gotcha is around license mobility. License mobility is one of thefundamental licensing rules of Microsoft. It basically means that if a customer can reassign alicense to another device or user, it can’t be done in less than 90 days.One of the fundamentalrules is that you cannot do that within that time frame
.Where we have a conflicthere is with the technologies that are available today. If you're using somethinglike VMware's Dynamic Resource Scheduling or Hyper-V's Live Migration, itessentially conflicts with that licensing rule because now a VM can migrate toyour different physical host more than once in that 90-day period for thingslike load balancing. The workaround Microsoft has adopted to this is to makelicense mobility a Software Assurance benefit. We've seen a lot of customerswho did not have active SA on their server application—SharePoint, Exchange,SQL server, for example—but they did have that virtualized. So the VM wasmoving dynamically from host to host without Software Assurance. Technically thatwould be violating that license mobility rule.

UnderstandingVDA and SA
A fourth gotcha is what we call virtual desktop access, or VDA. The confusionhere is really the rights versus the actual subscription that Microsoft sells. ForVDA, each accessing device needs either a Windows Software Assurance license ora Windows VDA subscription to be able to access a virtual desktop. The actualvirtual desktops, or VMs themselves, are not what you license. And a thirdthing to point out is that you do have to license those devices even if you'renot using a Microsoft VDI technology to do so. 

We're going to go through a little quiz now. Kris, do you want to go ahead andwalk us through it?

Kris: Yes. So just to make sure that we're all clear on the point that Selinajust made about which devices require Software Assurance (SA) and which requireWindows VDA, let's go through and see who was listening. Since we're not all inthe same room, we'll have to go through these together one by one.From a PCdesktop standpoint, that would be SA. Third-party devices, those require VDA.Third-party devices are not covered by SA. Win TPC devices are covered by SA.Laptops, of course, SA as well, similar to PCs. And thin clients require VDA. WithVDA, it's important to recognize the difference between the software, VDI, andthe rights, VDA. Some people get those confused. When it comes to consumerdevices, VDA as well. VDA subscriptions are designed specifically for devicesthat do not qualify for SA. It is a separate subscription. It's a right thatyou're getting to use on those devices outside of what SA grants. 

Selina: A good way to think of this, too, is did Microsoft already recoup thecosts from an OEM purchase when you got that preinstalled? If not, they'regoing to recoup that cost through the VDA subscription. So if there's anyquestion there, think about whether it can run a local install of Windows. Didit come preinstalled with a Windows OEM copy? If the answer is no, then it'slikely that that does not qualify for the Software Assurance to give VDA rightsbut actually would qualify for the VDA subscription to get those same rights.

Upgradeand downgrade windows close quickly              
We're going to move to another area now that's a licensing gotcha aroundpartner grants. We did mention this earlier for the MSDN. If you are a partnerof Microsoft, you are entitled to different grants depending on your [inaudible 00:17:02
]. And it's important to note that ifyou're using those grants as part of your entitlement, there are no downgraderights. You cannot continue to use an older version any longer than 12 monthsonce Microsoft has released that product. You have 12 months to upgrade to thelatest and greatest. Microsoft provides these grants as a way for theirpartners to use the latest and greatest software. 

There are also some restrictive use rights, which you should just be aware of, suchas the MSDN. You can't use these for client-specific solutions because it wouldbe a direct revenue-generating type of activity. Be aware that there are somecaveats to using those grants. 

Kris: And to tie this back to what was mentioned earlier about Office 365 regardingthe no downgrade rights, Office 365 is being pushed very heavily by Microsoft.They're all-in with Office 365, as we know, so they're making it veryattractive to customers to true-up with Office 365 SKUs. If they have a gapwith Office ProPlus, they're providing incentives and making it make sense forcustomers, at least on the surface, to true-up with those Office 365 SKUs. Buta lot of customers don't realize that it's not a set and forget. They actuallyhave to migrate to Office 365, and there's a limited window of time they haveto do that migration. If they don't do anything, even though they trued-up withthose SKUs, they're going to be in the same compliance position and needing tobuy Office ProPlus again. So it can be attractive from a cost standpoint,especially with the discounts that Microsoft is offering, but just know thatlike MSDN, there are no downgrade rights or very limited downgrade rights whenit comes to Office 365. And there's a migration window that has to be compliedwith, as well.

Selina: Great. We also have some other noteworthy gotchas we're going to runthrough here. One of those is around downgrade rights, specifically for adesktop application such as Project or BPO. It's kind of counterintuitive. Ifyou buy the more expensive products, like a professional edition, then you actuallycannot run the standard edition and just cover that with the professionallicense. Technically, any installations of standard edition would not becovered by a purchase of professional edition. So you do want to maximize theinvestment that you've made there. The recourse, if you were to find that throughan audit or a CM engagement would be to then request a concession fromMicrosoft to remove the standard edition installs and replace them withprofessional if that's what you are entitled to. 

Another area is around upgrade advantage. This is the predecessor to SoftwareAssurance, and it does not include the base license. What we've seen in manysituations is that even though a customer may have paid for Software Assurancefor almost a decade or longer, Microsoft, if they cannot see that the baselicense ever existed, will not grant an entitlement without the proper proof ofthat base license.So it's a good thing to look for if you are ever given yourMicrosoft license statement to review. Do you have upgrade advantage in yourhistory, and can you prove that base? It also speaks to the fact that you needto keep those records forever. There's really no time period that Microsoftwon't go back and expect you to be able to prove that ownership.

Kris: This is an issue that typically would surface during an audit or a licensingreview. This isn't necessarily something that's going to be readily apparent.You have to know what you're looking for in the Microsoft licensing statementto see quantities that don't quite match up. But it’s definitely a liabilitythat you want to manage and make sure you're monitoring appropriately, so youdon’t to have the surprises that many customers find themselves with in anaudit scenario. 

Whena CAL is required
Selina: Great. Another noteworthy gotcha—this one's a little bit older—it'snothing that's new, but we do actually still see it come up in severalengagements that we've worked on. It’s around multiplexing, which is when acustomer uses hardware or software to pool connections or reroute information. They'rereducing the number of devices or users that can directly access or use a product.This does not negate the need for a SQL CAL, and a lot of times we see thatcome up when it comes to SQL licensing. Customers think that because a user canonly access say a front-end application and not the database that's on the backend directly, a CAL is not required, when in fact it is.

AreAzure credits necessary?
The last two gotchas are some of the newer ones that we're starting to see. Thefirst is around Azure credits. I've talked a little bit before about how wehave to keep in mind how Microsoft is incentivized. This is where theircommitments are lying around the adoption and the consumption of Azure as withOffice 365. We are seeing them start to push customers who have an on-premiseshortage to resolve or remediate that issue with the purchase of Azure credits.So if someone suggests that to you from Microsoft, think hard about whether youreally are ready to use that, or if they're just trying to make a separateissue go away through the use of Azure. 

Licensing changes for Windows Server 2016

Lastly,one that's going to be an expected gotcha later this year is around WindowsServer 2016 because Microsoft will be changing the licensing metric from aprocessor-based to a core-based model. And that's expected to be released thisfall, so we expect that to lead to some surprises in the type of scenario whereyou might have an audit or a SAM engagement.

So, I think that will take us into any questions. Jason, if you want to let usknow what we've been asked.

Jason: Perfect. Thanks Selina and Kris. We did have a couple questions comethrough.The first one: Talking about subscriptions and stuff, are they based ona per person or a concurrent user?

Kris: Yes, I think this was asked in reference to when we were talking aboutMSDN subscriptions. Subscriptions are on a per subscriber basis, so it's a peruser.

Jason: Okay. We have another question from Dennis: "We have loaner laptopsthat require Microsoft Office, like Word, Power Point, Excel. What is the mostcost-efficient way to activate and share them?"

Kris: Microsoft Office has traditionally been licensed on a per device basis,but with Office 365, it's gone to a user basis. That user is able to use it onup to five devices. That's definitely where the industry is going as a wholeand where Microsoft is going. So if you're on Office 365, this is a benefit youhave. Those loaner laptops wouldn't need to be licensed, just the users usingthem, from an Office 365 standpoint, that is.

Jason: Okay, thanks, Kris. We also have like a follow-up question to that askingthe most cost-efficient way to allow the person using the loaner laptop to signin as themselves, or does it require a generic loaner account?

Kris: Yes, again, Office 365, for some organizations, tends to be the most cost-efficientway, especially those organizations that have multiple devices per user, asmany do.

Jason: Okay. A question from Eric asking about SAs: “If one has SA, can theymove the server seats?”

Kris: I'm trying to think what this was in reference to.

Jason: “Or do they need an amendment?” he's asking.

Kris: I'm trying to think of what's in reference to the server seats.

Jason: Eric, if you want to follow up in the Q&A section with thatquestion, and give us a little bit more detail, that'd be great. Let's see. WithVDA rights, having Windows SA roaming rights doesn't cover access from anydevice? Is that right?

Selina: Can you repeat that one more time, Jason?

Jason: With VDA rights, having Windows SA roaming rights doesn't cover accessfrom any device, right?

Selina: No, it's actually separate. Roaming rights are separate. They are alsoa Software Assurance benefit, but they're separate from the VDA rights that youget with SA. And they would be more relative to an application, if you werewanting to access Office, for example, but not relative to the Windows desktop.

Jason: Gotcha. So kind of going back to Eric's question. He was talking about movingservers. His question was: “If one has SA, can they move the server seats or dothey need an amendment?”

Kris: I was going to say when we were talking about seats, usually a seat refersto a subscription of a user, like a Programma CN. But go ahead, Selina.

Selina: If you have Software Assurance, you'll be able to get those licensemobility rights, and that allows you to move those servers around as frequentlyas needed. You can set a technology, like Dynamic Resource Scheduling, to dothat for you so it's not a manual process without violating any of those termsof the agreements. 

Jason: Okay, he's asking now...oh, I'm sorry, Kris. Go ahead.

Kris: Again, it depends on if the question is around subscriptions or if it'saround the on-premise licensing for server products. 

Jason: Okay, and we can follow up with Eric more on that after the presentation,as well. He's also asking what happens if he wants to stay with Office 2010?

Kris: Well, you'd be licensed for it. Just recognize that that licensing won'tcome from Office 365. So if you're truing up using Office 365 SKUs, knowingthat you may be going that route anyways down the road, and Microsoft is tryingto make it very attractive from a price point standpoint, you don't have thedowngrade rights with Office 365 to still be using Office 2010. You would needto license that outside of Office 365.

Jason: Okay.

Kris: You can get the downgrade rights from on-premise office licensing, butthat's separate from Office 365.

Jason: All right, great. So, Kevin: “I'm not sure if you guys would know theanswer to this question, but SQL licensing for LANDESK, does an organizationneed a SQL CAL for each managed device or only those users accessing ManagementSuite?” I think that's more a question for our side of things, and we canfollow up with that question later, unless you have some insight into thatKris.

Kris: Yeah, just generally speaking from a value-added solution standpoint, SQLcomes bundled with many, many different value-added solutions. You want to payattention to the agreements that you have with those value-added solutions tosee who's on the hook for the licensing. Sometimes SQL Server comes bundledwith an application, and with that is the license for it. In some cases, youhave to license the SQL Server. Even though the bits may come from the value-addedsolution provider, you're on the hook to provide the licensing for it. In othercases, you have to provide the bits and the licensing. So you definitely wantto pay attention to that. Just because it came from a bundled application,don't make the assumption that the licensing is included. It can be, but oftenit's not. 

From a CAL standpoint, Microsoft has since replaced, or is trying to replace,the CAL licensing model with the per-core licensing model. So this would onlyhave to do with older SQL Server licenses. That CAL licensing model exists intwo flavors: the server user CAL and the server device CAL, so it depends onhow you're licensing that SQL environment. You may find, however, that it maybe more cost effective to license it on a per-core basis rather than the CALmodel. If you're licensing SQL CALs by user, then yes. Any user that isaccessing the application that the database supports, in this case LANDESK,would need a user CAL. If you're licensing it on a device CAL basis, then anydevice that is accessing the application that the SQL Server is supportingwould need a device CAL. 

So, again, this is where the multiplexing rules come into play. When it comesto databases, don't think about direct connections to the database or justusers or devices that are connecting directly to the SQL Studio, the SQLManagement Studio. You have to look at it on the front end of the application.So look at the web server, what have you, the actual application layer and whatusers or devices are accessing the application that the database supports.

Jason: Okay. Thanks. Dennis also asked another question: “How do you manage 365accounts for users that worked for the company less than one month at a time onthe same PC desktop?”

Kris: With your Office 365 accounts, it's up to you as the Office 365 accountadministrator to assign those subscriptions, to revoke them, to provision them asneeded by the organization. So it requires some dedicated managementunderstanding—what users are coming into the environment, coming out of theenvironment—to assign those subscriptions appropriately.

Jason: Okay, and kind of a follow-up question on that one: “So can your Office365 project licenses on terminal servers? And if not, what is the license toallow users to access it on terminal and their desktop?”

Selina: It does allow the use of access through remote desktop services orterminal services, but you do have to deploy it the correct way, which is withthe shared activation mode so that it can issue [inaudible 00:34:51
] users to essentially enforce thecorrect licensing model. If you're looking at publishing an app through RDS orTS, just know that you have to install it correctly on that server using sharedactivation.

Jason: Great. Thanks Selina. We had a couple other questions come in a littlebit earlier, so let me go through a couple of these: “Can the licenses grantedfrom partner grants be used in the production of environments?” Selina or Kris,can you take us through that?

Selina: I can answer that one. The answer is yes, it can be used in a productionenvironment. There's one exception, and I think I mentioned this earlier, ifit's a direct revenue-generating purpose, such as hosting a customer's app or developinga custom solution for a specific client, then that would not be allowed.

Jason: Okay, great. Another one we had was: “Do admins that just configure andmake patch updates require a subscription?”

Selina: An MSDN subscription? I believe that's what you’re referring to. Theanswer would be yes. Even an admin who is just configuring and making updates. It'srequired for any use of the software.

Kris: The only caveat to that, which we covered earlier, was that you don'tneed an MSDN subscription if you're demonstrating and you're using terminalservices. You don't need MSDN for UAT, the actual UAT testers and feedbackclient for team foundation services. Very limited caveats to that, butgenerally speaking, yes, anyone who's using the software needs to be licensed.

Jason: Okay, great. Switching gears a little bit: “Microsoft, how do theyhandle test staging in Q&A?” Could you walk us through that a little bit?

Kris: Before we get to that, let me just add one detail to my prior statement.When I said anyone who's using the software needs to be licensed for it, use isdefined as accessing the software, so just accessing the software requires,generally speaking, to be licensed.

Jason: So going back to Microsoft, how do they handle the test staging inQ&A?

Kris: Microsoft, generally speaking, really only has two models for the mostpart, production and nonproduction. Every organization defines test a littlebit differently and staging and so forth. So this is why when we talk aboutMSDN licensing, we're really talking about nonproduction licensing. It'sprobably most useful to view the world in terms of what is production. And whenyou're trying to track and manage this, to identify what is test or dev as you,the end-user organization, might define it. From a Microsoft licensingstandpoint, first identify what is production. It's usually a little bit easierto identify what is production. And everything that is not production, then, isin the nonproduction bucket. 

I find a good rule of thumb or litmus test for defining production is to turnthe machine off. If you turn the machine off, what happens? Do end users getimpacted? Now obviously you’re not going to turn the machine off, but as athought experiment, if you were to turn the machine off, what would happen? Whogets impacted? If there are customers or end users who are impacted, that's agood indication that it's production.

Jason: Okay.

Jason: Another question we had come in: “What are the licensing requirementsfor users who are working from home PCs or working remotely accessing softwarelike Office?”

Kris: It really depends on what software we're talking about. There are home-userights that come into play with SA for on-premise Office licenses. As we talkedabout with Office 365 subscriptions, a subscriber is a user and that user isauthorized to use Office on up to five devices. 

Jason: Okay. So what about the BYOD that are brought on premise?

Kris: BYOD devices still need to be licensed. Again, Office 365 is a goodsolution to this since it changes the licensing model away from a per-devicebasis, per-instance basis, to a subscriber basis. So that subscriber to Office365 can have it on up to five devices—however many they want to bring fromhome.

Jason: Great. Okay. We have one more question that came in: “Can the existingWindows licensing someone purchases with the machine provide rights for VDA?”

Selina: I'll take that one. The existing Windows license would be either OEM ora retail full-package product, and those do not provide the VDA rights. You canonly get the VDA rights with either the SA or the VDA subscription. The reasonfor that is because OEM ties a license to [inaudible 00:41:24
] backed hardware, and there are veryrestricted rules with a retail license as well. So that's not really designedfor the VDI scenarios.

Jason: All right. Well, thanks Selina and Kris. We appreciate it. If any of youhave other questions, please feel free to reach out to either Selina or Kris.Their email addresses are on the contact screen right now. Also, just kind of areminder that this recorded webinar will be available to all attendees. We'llbe sending out an email with the recording in it. You can also access it in thenext day or two on Feel free to check it out. Weappreciate your attendance. 

Kris and Selina, thank you again for the great presentation, and have a greatday.

Kris: Yeah, thanks, Jason. Thanks, everyone.

Selina: Thanks, everyone.


Ialso couldn’t understand what was said here.