Citrix licensing (and Microsoft) demystified? I need your help!

Licensing can be complicated, not only do we need to consider XenApp and/or XenDesktop licenses; we also have to deal with Microsoft licensing, if we like or not. Throughout this chapter I will focus on the different types of Citrix licenses available, how they get applied from a XenApp / XenDesktop perspective and what other types of (Microsoft) licenses we need to take into consideration, like RDS, VDA (and no, this is not the Citrix VDA), CDL etc.

The reason for this blogpost is threefold. First of all I want to sort of give you a sneak peak into my upcoming book: Inside Citrix – The FlexCast Management Architecture. Secondly, since licensing can be complex I would like to ask you for some help by not only giving this ‘chapter’ a read through but also to do some technical ‘fact checking’ at the same time helping me to improve the overall quality of Inside Citrix. What did I miss, explained wrong / incomplete etc.? Please let me know.

And finally, as you might be unfamiliar with some of the licensing facts involved, this chapter will potentially provide you with some useful information, insights and nice to knows.

Flexnet

Citrix relies on Flexera software to take care of licensing, FlexNet licensing software to be a bit more specific (also formerly known under the names FlexNet Publisher and FLEXlm). Here is a quote from their website:

FlexNet Licensing empowers application producers to combat software piracy and increase revenues by easily enabling new pricing, packaging and software licensing and activation models. It supports the full software-licensing spectrum, from strict enforcement to usage-based trust but verifies, and enables software protection, monetization and compliance of on-premises, SaaS, cloud, virtualized and embedded applications.

Citrix licensing technical overview

Before you will be able to upload any type of license you will first have to install and configure Citrix licensing, Citrix licensing consists out of the following components:

• License server – A system that allows licenses to be shared across the network.
• License files – The files that you need to license your product. These files are stored on the License Server.
• License Administration Console – The interface you use to manage your license files and your License Server.
• Web Services for Licensing – Enables Studio, Director, and the Licensing Administration PowerShell Snap-in to communicate with the License Server and manage users, allocate and install licenses, display License Server health, license usage, and other alert messages.
• Simple License Service – Enables allocation and installation of license files on a License Server using a web page interface.
• Product-side settings in your Citrix products that are associated with the License Server.

At least one license server needs to be present within a Citrix environment. Since the license server role is a relatively light one you may choose to co-host it on a machine, which performs other tasks as well. Or, and this is not an uncommon approach, the Citrix license server role can be shared with other license servers, like Microsoft licensing for example.

User, device and concurrent

Citrix licenses come in various forms and shapes, for example licenses can be user/device based or concurrent. A user license allows a single user access from an unlimited number of devices, while a device license allows an unlimited number of users access from a single device. Concurrent licenses live somewhere in between; they are not tied to a specific user or machine. Here it is important to note that the user/device license type is not about choosing between a user or device license, no, the license server will decide that for you. Don’t worry I’ll elaborate a bit more on this in a minute. Again, you either buy user/device licenses, or concurrent. Microsoft licenses will be discussed in more detail as we progress.

FMA fact: By default you can only use one type of license within your XenDesktop Site. You either purchase / upload user/device or concurrent, they cannot be mixed. If you require both, you must configure a separate license server to handle those licenses.

XenApp and XenDesktop license types

To start, the XenDesktop license model offers user/device as well as concurrent licenses. These are available as perpetual, which basically means you buy them once and then pay an annual fee on a per license basis. This does not include Subscription Advantage (SA) or Software Maintenance (SM), but we’ll get to those in just a bit. XenApp licenses, when purchased separate from XenDesktop are a bit different in that they are only available as concurrent licenses. These can be purchased as perpetual as well and do also not include SA / SM. Note that I said separate from XenDesktop because when you buy XenDesktop Enterprise or Platinum licenses this will include XenApp as well. Meaning that user/device licenses can be used with XenApp just as easy, in fact Citrix won’t even know the difference.

Concurrent, user/devices licenses in a bit more detail

When making use of concurrent licenses, as soon as a user logs in a license will be assigned to that user for the duration of the session and as soon as the user logs off that same license will become available for use again. Be aware that there is no direct communication between license servers. If you configure multiple license servers they will not be aware of each other and multiple licenses could be checked out. Make sure to point all of your production machines to the same license server. With a concurrent license, a number of sessions to different products that are controlled by the license server will be available using just that single license allocated to the user. If, however, some services are made available from a server that taps into a different license server to gain access, the user will have consumed multiple licenses.

As mentioned, when using user/device licenses the license server will decide the type of license that will be applied. Let me explain. For example, when user 1 logs in for the first time, on PC 1 for example the license server will assign a user license to user 1. However, when user 1 logs off and user 2 logs on to PC 1 the license server will notice that multiple users are now logging on, onto PC 1. Because of this it will reassign the earlier user license, which was assigned to user 1 to PC 1 turning it into a device license. Now if user 1 logs onto PC 2 the license server will pick up that user 1 logs on to multiple machines and thus it will assign a user license to user 1. Unless multiple users previously used PC 2 as well, then it will continue to use a device license for PC 2 and user 1 will still be without an assigned license. This is controlled by the MAC address of the device, which the license server keeps track of.

The thing to note here is that once a user and/or device license is assigned to either a user or device it will stay assigned for a minimum of 90 days before it will be checked in again. This is in contrast to concurrent licenses, which will be checked out for the duration of the session and checked in again once the session is ended. Licenses can be revoked, when an employer leaves the company for example and still has a license in use (90 days). Citrix created a licensing management command-line utility named UDADMIN for this, which allows Administrator to manually revoke licenses. License usage data will be updated every 15 minutes by default while rebooting the license server will force an update as well. Bram Wolfs created a GUI around the ADADMIN tool, one of the added advantages using this tool is the ability to manually revoke one or multiple licenses at once, but of course it does more than ‘just’ that. You will find it here:

UDadmin GUI a free tool to manage XenDesktop UserDevice Licenses

How many licenses are needed

To give you an indication on how many licenses you might need you can use the following formula: A – C + B = # user\device licenses. A is the total number of users, B would be the total number of shared devices and finally C, the number of users that will exclusively be using those shared devices. Let’s say we have 800 users (A), 300 shared devices (B) and a total of 400 users who will only be using the shared devices (C), this makes 800 – 400 + 300 = 700 licenses. Using this formula you can also calculate at which point it makes more sense to purchase concurrent. These are about twice the price of a user\device license.

FMA fact: The process of assigning licenses to users and/or devices, either concurrent or not, is also referred to as the checking in and checking out of license tokens.

Each time a certain Citrix product (a XenApp server for example) starts it will open up a connection to the license server by checking out a so-called startup license. This startup license file enables Citrix products to maintain a continuous connection to the License Server. When users connect to a Citrix product, it draws licenses from the License Server. That is, the Citrix product requests to check out a license from the License Server on behalf of the user or client device. When the license is successfully checked out, the user can actually use the product.

FMA fact: Both XenDesktop and XenApp product licenses must be purchased with Subscription Advantage or Software Maintenance for a minimum of one year from delivery.

License programs

Citrix offers different licensing programs aimed at supporting any commercial enterprise, educational institution or government agency worldwide. If you would like to know more about these programs I would suggest to contact one of your Citrix sales representatives, as they should be able to help you. Just be aware that, at any time you may only have one active commercial licensing program and one active public sector licensing program. The below link will provide you with additional information as well:

www.citrix.com/buy/licensing/programs.html

Grace periods

If for whatever reason the Citrix license server cannot be contacted, the users and products are protected by a so-called grace period without any interruption or loss of functionality. To make this possible XenDesktop stores a replica of the licensing information from the License Server, including the number and type of licenses. As soon as the connection to the license server is lost it will enter its grace period and uses the licensing information stored locally. The maximum time allowed for a grace period is usually 30 days, although this might slightly differ per product.

Citrix infrastructural components and the license server exchange heartbeat messages every five minutes to indicate to each other that they are still up and running. When the heartbeat fails for whatever reason, the mentioned grace period will kick in using the locally cached license information as mentioned above.

Supplemental

As of version 7.6 Citrix has introduced a supplemental grace period. It will allow your users to connect to XenDesktop and/or XenApp for example, but other products as well, while all licenses are in use. The default supplemental grace period is 15 days and during this period there is no limit on connections. Just be aware that after this period expires the ‘normal’ connection limits will be enforced and new connections will no longer be accepted. A quote from Citrix on this:

Supplemental grace periods are granted per product and edition and per Subscription Advantage Eligibility date (per product) and only for Retail licenses. For example, if you have two clients requesting XenDesktop Enterprise Concurrent, with different Subscription Advantage Eligibility dates, two supplemental grace periods are granted.

Note that the old licensing model involved granting a certain percentage (approximately 10%) of overdrafts above the current license count. This has been changed in the current version of XenDesktop/XenApp and now goes by a grace period instead of an unlimited time for overdrafts.

FMA fact: As soon as a Citrix product enters a grace period one or several event messages (Windows event viewer) might appear. Here you can also see the remaining time left within the grace period.

While we focus on XenDesktop and/or XenApp for now, be aware that there are more Citrix products out there, such as paid-for versions of XenServer for example, which also require a license of some sort. Also, with XD & XA the licenses reside on the license server, as we’ve just discussed, but with a NetScaler for example the license file will need to be uploaded to the actual device itself.

Getting your licenses

Getting your hands on your Citrix licenses is a simple three-step process. If you are a new Citrix customer you will first need to register for a license program (also see ‘License Programs’ a few paragraphs back) before you will be able to purchase any licenses. In all other cases, if you want to renew or update your licenses it will be a matter of activating (your order confirmation e-mail contains instructions for activating licenses).

Then allocate (when asked, enter the license you wish to allocate. Select the specific number of users you wish to deploy and generate your license file). And finally download (save your license file and copy it to your license server using the License Management Console. The server will then read and initiate the license file).

You might also want to visit: https://www.citrix.com/buy/licensing/management.html for some more detailed information regarding Citrix licensing. Here you will also find information with regards to edition updates, and as always contact your Citrix representative when in doubt.

FMA fact: You can also visit the Citrix Trial Center where you can get limited trial licenses to try out certain products. However, do note that some licenses will only be available for registered Citrix partners.

Editions

Both XenDesktop as well as XenApp are available in different editions. Depending on the edition you purchase more or less specific features and functionalities will become available for you to use and configure. XenDesktop is available in VDI, Enterprise and Platinum, while XenApp is available in Advanced, Enterprise and Platinum. As highlighted earlier, XenDesktop Enterprise and Platinum also includes most of the XenApp functionalities. Visit Citrix.com for more detailed information about the differences between the platform editions mentioned above.

Subscription Advantage, Software Maintenance

As mentioned each edition of XenDesktop / XenApp must be purchased with at least one year of Subscription Advantage and/or Software Maintenance. Subscription Advantage entitles you to, among other benefits, product updates, including major and minor releases during your membership period.

After your initial one-year membership period expires, you may choose to renew your Subscription Advantage membership. A Subscription Advantage membership and its associated license is distinct from your license to run the product. All licenses for retail products are permanent. If you do not renew your Subscription Advantage membership, your Citrix products do not stop working; however, you are not entitled to any software updates after it expires.

Citrix Software Maintenance combines world-class 24×7 unlimited technical support (worldwide) with product version updates to keep your Citrix environment running optimally (meaning it also includes Subscription Advantage). You will be able to log an unlimited amount of incidents and get access to a specific set op support tools and other knowledge resources. As an added bonus this also includes a discount for Citrix Synergy tickets. Citrix now has a total of six support centres around the world offering true ‘follow the sun’ support in eight different languages!

Next to their ‘standard’ product lifecycle support policy, which consists out of Mainstream Maintenance, Extended Maintenance and End of life, Citrix also introduced two new forms of product maintenance not too long ago; Long Term Service Releases (LTSR) and Current Releases (CR). To start with LTSR, and I will quote Citrix on this, the benefits include:

• Extended Lifecycle: For each Long Term Service Release, the clock restarts, giving you 5 years of mainstream support and 5 years of extended support (separate contract required).
• Predictable Maintenance: On a regular schedule, Citrix will release cumulative updates for each Long Term Service Release. These updates will typically contain just the fixes for that release void of new features to simplify on-going maintenance.
• Reduced IT Costs: By opting to implement a Long Term Service Release, you will have access to the highest quality releases with the most predictable maintenance schedule to streamline your management efforts, which can lower your total cost of ownership.

While the benefits of the Current Release software maintenance offers:

• Rapid innovation: The IT world changes quickly and Current Releases will provide access to the latest security, productivity and collaboration features to help keep your workforce competitive.
• Address new business challenges: Current releases will extend the flexibility of the XenApp and XenDesktop architecture to address more use cases, giving you more value out of your current investment.
• Faster delivery of enhancements: Citrix welcomes your enhancement requests to further improve our app and desktop delivery technology, and the faster release cycles of Current Releases will help expedite your enhancement request.

While the CR might seem new, it really isn’t. CR is basically the way it has always been before the LTSR got introduced. For a more detailed overview on both also see this blog post.

FMA fact: Citrix also offers Appliance Maintenance, which provides technical support to diagnose and resolve issues encountered with appliance hardware with the latest upgrades for the software elements of hardware products. Malfunctioning appliances are also replaced under this agreement to minimize customer downtime. Note that all licenses within a program must be either on call-in support or not – they cannot be mixed! If one desires different support levels, different licensing subscriptions must be used to separate these, as well as separate license servers!

Monitoring license usage

Now that we have covered some of Citrix’s basics with regards to licensing, let’s have a brief look at how we can view and monitor our licenses using Citrix Studio.

On the Licensing node in Studio you have a direct overview on the types of licenses you are using and how many license are actually being used at any given time. It will tell you the license model; per user, device or concurrent for example, which port number is used for communicating with the license server, general Site information, an expiration date, if Subscription Advantage is supported and more.

What about Microsoft?

Of course we cannot run Citrix without Microsoft, I am not telling you anything new here. Using Microsoft software also means it will need to be licensed from a Microsoft perspective, unfortunately this is often where the confusion starts. Let’s see if I can help you understand what is needed from a licensing perspective when Citrix and Microsoft products are used together. I will start by explaining some of the different types of Microsoft licenses involved when dealing with VDI and/or RDSH based deployments.

Microsoft VDA licenses and Software Assurance

VDA stands for Virtual Desktop Access. Each Windows and non-Windows device that will access a Windows Desktop Operating System (OS) based virtual machine (which applies to VDI only) needs to be licensed with a Microsoft VDA license. If you your corporate Windows PC’s are licensed as part of Microsoft’s Software Assurance program or Windows Intune, these VDA licenses will automatically be included. This entitles you to use a Windows based PC as a VDI endpoint (to access a Windows Desktop OS based VM) without having to purchase separate VDA licenses, which is always optional as well. Especially for smaller companies who cannot afford the SA program. There is, however one exception, if you are using non-Windows thin clients for example, you will still need to purchase separate VDA licenses for those machines. And by the way, a VDA license goes for a $100 per year, per device. But wait there’s more.

When a user has a corporate VDA licensed device (at the office), he or she is also entitled to use his or her home PC to access a corporate Windows Desktop OS based VM as part of that same VDA license. However, if the user would bring that same personally owned, non-corporate device into the office, then a separate VDA license will again be needed. To use a Microsoft quote on this one:

Roaming rights are only applicable while roaming outside of the corporate domain, hence any device accessing a Windows virtual desktop within the corporate domain needs to be licensed with either Windows Client SA or Windows VDA.

Makes sense?

FMA fact: If you are not accessing a Windows desktop OS VM on a server, but from a physical PC for example, you do not need Windows VDA license. This also means that VDA licenses do not apply to Citrix XenApp.

CDL licenses

Next to the VDA license Microsoft also introduced a so-called CDL license, which stand for Companion Desktop License. It comes at an additional charge and is not included as part of the Microsoft SA program. This allows a user to access a Windows Desktop OS based VM (on the corporate network) from up to four different devices, including iOS and Android tablets etc. (BYOD). For this to (legally) work the earlier discussed VDA license will somehow need to be taken care of as well.

Software Assurance, a bit more detail

Software Assurance and VDA licenses can be user or device based. With device based being the more restrictive of the two. For example, with a device based SA or VDA license you are restricted to the earlier mentioned roaming rights, and additional CDLs might be needed to enable access to your VDI environment from multiple devices, iOS and Android tablets included. With a per user SA or VDA license subscription these limitations do not apply. Windows can be locally installed on any device running Windows 7/8/8.1/10 Pro or Enterprise or Windows tablet up to 10.1 inches in diagonal screen size. And your users will have access to your VDI environment from all of their devices, no additional CDLs needed. Also, while with per device SA or VDA licenses you are restricted to non-corporate devices while away from the office to access your VDI, as explained previously, with per user SA or VDA licenses you will have access externally as well as internal from any device without needing to purchase any additional VDA licenses.

RDS licenses

When Microsoft RDS, Remote Desktop Services technology is used to delivery applications and or virtual Desktops (VDI and/or RDSH based) to your users these will also need to be licensed accordingly. From a XenApp perspective this is nothing new, for most of you anyway. XenApp runs on top of Microsoft RDS technology (former Terminal Services) and thus needs to be licensed with RDS CALs (per user or device) as well. While this does not apply to XenDesktop Virtual Desktop Infrastructures, RDS technology can also be used to offer Windows Desktop OS based VMs using Windows Server 2012 / 2016 for example. In this case both VDA and RDS licenses will be needed. But that’s beyond the scope of this chapter / article.

FMA fact: Microsoft RDS licenses are needed in combination with Citrix XenApp, not XenDesktop. And Microsoft VDA licenses are needed in combination with Citrix XenDesktop, not XenApp.

Windows server and desktop OS licensing

Besides the above licensing requirements your base Server and/or Desktop operating systems will also need to be licensed. Besides a server license, which allows you to install a Windows Server Operating System on a single machine for example, you will also need to purchase server client access licenses on a per user basis. This gives a single the user the right to make use of the server services, like file sharing, printing etc. These types of licenses are often covered by one Microsoft Volume Licensing programs, which are of course different from the ‘boxed’ retail licenses. Do note that different programs are available primarily depending on the size of your organization. Desktop Operating System licenses work in sort of the same way with regards to Volume licensing. However, Desktop OS licenses do not need any additional client access licenses as with the server variant. Some of the Volume License solutions (can) also include the earlier mentioned Software Assurance (again, per user or per device, make sure to understand the differences between the two) program offering additional benefits, as with their latest Windows 10 offering for example. However, as per Microsoft: For devices or users that do not qualify for Windows Software Assurance, you can license Windows VDA for access to the benefits of Windows Software Assurance.

Application virtualization

Amongst other things, the Microsoft Desktop Optimization Pack, or MDOP offers us various virtualization technologies including Microsoft App-V, which is often used in combination with both Citrix XenApp as well as XenDesktop. Unfortunately it doesn’t come for free; it is available as a separate subscription to Microsoft Software Assurance customers. If you would like to combine App-V streaming technology with VDI virtual desktop then you would need an MDOP license for each client device accessing the VM. If it’s streaming to XenApp (RDSH) servers that you are interested in then no additional license will be needed (this will already be covered by your RDS CAL). As a side note, when using XenApp to only stream packed applications down to a virtual or physical desktop, no RDS CAL licenses will be needed since no actual resources will be utilized on the RDSH server.

Service Providers

For Service Providers and independent software vendors Microsoft has the Services Provider License Agreement program (SPLA). This is what Microsoft has to say about it: With the SPLA, service providers and ISVs can license eligible Microsoft products on a monthly basis, during a three-year agreement term, to host software services and applications for their customers. The SPLA supports a variety of hosting scenarios to help you provide highly customized and robust solutions to a wide set of customers.

And while the above is very true and helpful, when it comes to VDI it is also very, very restrictive. Unfortunately there is no SPLA agreement for multi-tenant / cloud environments when VDI is thrown into the mix. Well, there is, but you will have to use dedicated hardware on a per user basis. This includes everything from your servers to the underlying storage platform and all that is in between. Even when virtualization is applied, the physical hosts that your VMs run on need to be dedicated per customer (also referred to as a tenant). This is the reason why true DaaS, meaning a desktop based Windows Operating System from the cloud is not possible. Technically it is, but the ‘dedicated hardware per customer’ statement doesn’t make for an interesting business case, at all. Of course DaaS is still a relatively popular approach, but with XenApp, or RDSH at its base. Although in some cases a server OS (Windows Server 2008 R2 mostly) is used in a one to one relationship, a niche use-case though.

To summarise

XenDesktop

XenApp

Wrap up

Thank you for reading, and please do let me know what you think. Any help is greatly appreciated. I’m not looking for any textual and/or grammar faults or anything, I’m more interested in (technical) fact checking, but of course other remarks and/or ideas that you might have are welcome as well. I still have a couple of ideas (and doubts) myself but I am wondering what you guys might come up with.

Key takeaways

• Citrix licensing relies on the Flexera software, as do many other product vendors.
• The license server is a relatively light role and can easily be shared with other roles on a single virtual of physical server.
• XenDesktop and XenApp licenses come in different forms. There are per user, per device and concurrent licenses available.
• A user license gives a single user the right to start sessions on an unlimited numbers of devices. The license is bound to the user and is device independent.
• A device license works the other way around. A session can be started from a single device, but it does not matter by whom. It is user independent.
• If a user/device license is issued, it is applied to a license token for both a XenDesktop and a XenApp license token, even if you only connect to just one or the other. They are always issued in pairs.
• Concurrent licenses are not bound to a user or device; you can use them for both. However, these are more expensive to purchase, about twice as much.
• If the license server becomes unavailable for some reason it will make use of a build grace period of 30 days. Everything will continue to function as before. This basically means you will have 30 days to get the license server up and running again. No (real) need for HA.
• While products like XenDesktop and XenApp are both licensed through a central license server, a product like NetScaler for example will need its license installed directly on the device itself.
• Citrix offers various forms of support and maintenance. Subscription Advantage allows you to upgrade to the latest versions, feature Packs and so one. Software Maintenance on the other hand offers you 24x7x265 support. When purchasing either XenDesktop and/or XenApp you will need to also purchase at least one year of Subscription Advantage and/or Software Maintenance.
• Software Maintenance includes Subscription Advantage rights. That’s one of the reasons why it will be more expensive.
• Recently Citrix released the Current Release (CR) and Long Term Service Release (LTSR) product support options. For each Long Term Service Release, the clock restarts, giving you 5 years of mainstream support and 5 years of extended support, plus more. Current Releases will provide access to the latest security, productivity and collaboration features to help keep your workforce competitive, plus extra’s. Note that Software Maintenance will be mandatory for the LTSR and (at least) Subscription Advantage will be required with the CR support option. However, a separate support contract will then need to be purchased as well.
• The ‘new’ CR release isn’t really new; it is basically the way is has always been before they introduced the LTSR option.
• When Citrix and Microsoft are combined, and they always are, different license models need to be taken into consideration.
• Make sure you understand the different Microsoft SA, VDA (per device / user), CDL, RDS etc. license models. Since licensing can be (very) tricky I would definitely advice talking to one of your Citrix / Microsoft representative when in doubt. It’s not to be taken lightly, and there often is a lot money involved.

Bas van Kaam

Field CTO EMEA by day, author by night @ Nerdio

Father of three, EMEA Field CTO @ Nerdio, Author of the book Van de Basis tot aan Meester in de Cloud, Co-author of the book Project Byte-Sized and Yuthor of the book: Inside Citrix – The FlexCast Management Architecture, over 500 blog posts and multiple (ultimate) cheat sheets/e-books. Public speaker, sport enthusiast­­­­­­­­: above-average runner, 3 x burpee-mile finisher and a former semiprofessional snooker player. IT community participant and initiator of the AVD User group Community world wide.