You can use Windows 11 to deploy secure, centrally managed virtual desktops for your team on a scale. If you're planning to virtualize Windows 11, there are several ways to deploy and license virtual machines (VMs). This guide explains how to properly license Windows 11 when running on VMs.

Key Notes:

• This guide is specifically for Microsoft Commercial Licensing customers. It covers Volume Licensing programs, CSP, and the Microsoft Customer Agreement.
• If your Windows 11 license comes only from your OEM device, it typically doesn’t include virtualization rights (with some exceptions). Check your OEM license agreement for details.
• This guide focuses exclusively on Windows 11 virtualization. It doesn’t cover virtualized Windows Server sessions or the licenses required to access those sessions, such as Windows Server CALs or RDS CALs.

Generally, and with limitations found below, you must have one of the following licenses to run and access a virtual machine running Windows 11:

• Windows 11 Enterprise E3/E5
• Windows 11 Education A3/A5
• Windows 11 Education Student Use Benefit
• Windows 11 Enterprise per device with Software Assurance
• Windows VDA E3/E5
• Windows VDA per device
• Microsoft 365 F3/E3/E5
• Microsoft 365 A3/A5
• Microsoft 365 Business Premium

User licenses allow licensed users to access Windows 11 VMs from any device. Device licenses allow any user of the device to access Windows 11 VMs from the licensed device. 

The way you can virtualize Windows 11 depends on your license, your licensing program, and the virtualization method you choose. Different licenses and licensing programs grant specific virtualization entitlements. The sections below outline which licenses and Commercial Licensing programs provide these virtualization entitlements. Windows 11 can be virtualized using three primary methods:

• Windows 365
• Azure infrastructure or Azure Virtual Desktop
• Desktops virtualized on-premises or outsourcers’ servers

Windows 365 is a software-as-a-service (SaaS) solution that brings a personalized Windows experience directly from the Microsoft Cloud to your Windows 365 Cloud PC. You can access your Cloud PC from any device, but each Cloud PC must be assigned to a specific user.

Windows 365 is available in three editions:

• Windows 365 Business is designed for smaller companies that want ready-to-use Cloud PCs with simple management tools. It doesn’t require any additional Microsoft licenses.
• Windows 365 Enterprise, on the other hand, is ideal for larger companies that need unlimited Cloud PC seats. It lets you create Cloud PCs using custom device images, offers advanced management options, and fully integrates with Microsoft Intune. To use Windows 365 Enterprise, you’ll need to assign an eligible Microsoft license to each user.
• Windows 365 Government (U.S. only) provides the same benefit and capabilities as Windows 365 Enterprise.

Windows Hybrid Benefit helps you save on Windows 365 Business if you already use Windows 11 Pro or Windows 10 Pro on a device. The savings depend on your Windows 365 Cloud PC configuration and region.

To access and use Windows 365 Enterprise with Windows 11, each user needs licenses for:

• Windows 10/11 Enterprise or Education,
• Intune, and
• Microsoft Entra ID P1 or P2

In addition to being available independently, all these licenses are also included in Microsoft 365 F3/E3/G3/E5/G5/A3/A5/Business Premium/Student Use Benefit.

You can run Windows 11 in virtual machines either on Azure infrastructure or through Azure Virtual Desktop. Azure Virtual Desktop is a secure service designed for remote desktops and app virtualization, built to run on Azure. It’s the only cloud virtual desktop infrastructure (VDI) solution that supports Windows 11 multi-session, giving you an exclusive cost optimization advantage.

With Azure Virtual Desktop, you can quickly deploy and scale Windows 11 desktops and apps in minutes while maintaining full control over configuration and management. Plus, you benefit from Azure’s built-in security.

Here’s what you need to know about licensing:

• To access Windows 11 through Azure Virtual Desktop, you must have an eligible user license. Per-device licenses aren’t eligible.
• Eligible user licenses obtained through all Commercial Licensing programs include entitlement to virtualize on Azure Virtual Desktop.
• Some RDS CAL licenses with Software Assurance also provide access to Windows Server sessions on Azure Virtual Desktop.

You can run Windows 11 virtual machines on your own on-premises server or on a server that is managed by an Authorized Outsourcer. The right to run your software on Authorized Outsourcers’ servers is conveyed through product-specific virtualization rights and the Flexible Virtualization Benefit. Each eligible Windows 11 licensed user is entitled to access up to four virtual machines. For more information, refer to the Flexible Virtualization Benefit licensing guidance. However, if the outsourcer is not deemed an Authorized Outsourcer (see definition below), only Windows VDA E3/E5 licenses confer virtualization entitlements. Eligible licensed users or devices may access up to four virtual machines. Authorized Outsourcers are third parties Microsoft allows you to use to host and manage virtualized instances of your software on servers in their data centers (shared or dedicated). Authorized Outsourcers are all third-party hosts that are not designated as “Listed Providers” in the document found here: https://aka.ms/ListedProviders.

The following examples illustrate how you can license Windows 11 virtual machines in different environments.

Remote Access Description:

A company’s employees need access to both Windows 11 virtual machines and Windows Server sessions to perform their daily tasks. These sessions may include accessing specific applications or full desktops hosted on Windows Server. This mixed environment provides flexibility, allowing employees to use the appropriate system for their specific workload.

Licensing Solutions:

The company ensures that users or devices have:

1. An Eligible Windows 11 License: This license is required to access Windows 11 virtual machines.
2. Windows Server Access Licenses: This includes both a Windows Server CAL (Client Access License) and an RDS CAL (Remote Desktop Services CAL), which are needed to access Windows Server sessions.
3. Windows 11 Desktops on Windows Server: If Windows 11 desktops are hosted on Windows Server, the same Windows Server CALs and RDS CALs are required.

A company allows its employees to bring their own devices (BYOD) to work. Employees use personal devices to access their work environment, which includes Windows 11 virtual machines. These personal devices often run operating systems like Windows 11 Home or macOS, which do not qualify as eligible operating systems (QoS) for virtual machine access.

Solution:

The company equips these BYOD users with one of the following:

1. Windows VDA License: This license allows employees to access Windows 11 virtual machines from non-qualifying personal devices.
2. Qualifying Microsoft 365 License: Certain Microsoft 365 plans also include the rights to access Windows 11 virtual machines.

Challenge: Since contractors and vendors are external users, their devices typically do not come with eligible licenses to access Windows 11 virtual machines. To ensure compliance and provide secure access, proper licensing must be assigned to these external users.

Licensing solution:

To address this, you assign each contractor or vendor one of the following:

1. Windows VDA License: This provides contractors with the necessary licensing to access Windows 11 virtual machines from their devices.
2. Qualifying Microsoft 365 License: Certain Microsoft 365 plans also include virtualization rights, making them a suitable option for contractor access.

Note: Available for licenses aqcuited through the Open License, Select/Select Plus, Microsoft Products and Services Agreement, Open Value, Enterprise Agreement, or Enrollment for Education Solutions licensing programs.