Windows 365 Cloud PC and Azure Virtual Desktop are both virtual desktop services from Microsoft. However, the pricing models for these services are very different. Azure Virtual Desktop (AVD) is charged based on consumed Azure infrastructure, which allows optimization tools like Nerdio Manager for Enterprise to significantly reduce costs by closely matching the size of infrastructure to actual user demand in real-time. Windows 365, on the other hand, is a licensed service similar to other Microsoft 365 products like Office 365. This means that the cost of Cloud PC infrastructure is included in a monthly subscription regardless of actual usage.
Is the only option to purchase a Windows 365 Cloud PC license for every user who *may* need a virtual desktop and pay for it regardless of usage? Turns out that it’s possible to dramatically reduce Windows 365 license costs (up to 55%) given the unique way in which virtual desktops are used.
Nerdio software is used by thousands of organizations to manage close to two million Azure Virtual Desktop users. This gives us great perspective into the way virtual desktops are used in large production environments. By analyzing aggregated AVD usage data, we were able to identify usage patterns that can be optimized to reduce Windows 365 license costs.
Let’s start by defining some terminology:
- Authorized users – potential users of a virtual desktop. They are sometimes referred to as “Named” or “Assigned” users. Each of these users will typically be assigned a Cloud PC license or be given access to an AVD host pool.
- Active users – users who are actively using a virtual desktop during some period of time. For example, Monthly Active Users are ones who connect to a Cloud PC or AVD desktop at least once in a month. The number of active users is less than or equal to authorized users.
- Concurrent users – users who are connected to their virtual desktop at the same time. The number of concurrent users is always less than or equal to active users.
- Peak concurrency – the highest number of concurrent users during a period of time. For example, monthly peak concurrency would be the maximum number of users connected to the desktops at the same time during a month.
In our analysis, we found that in large virtual desktop environments the number of authorized users far exceeds active users and the number of monthly active users far exceeds the peak concurrency over the same period of time. Intuitively this makes sense. Not every user an administrator thinks will need a virtual desktop will actually use one and not everyone who uses a virtual desktop will do so at the same time.
Here are the findings normalized for a 1,000-user environment:
- Authorized users = 1,000 (100%)
- Average Active users = 600 (60% of total)
- Average Peak concurrency = 350 (35% of total)
Note that these numbers are very environment-specific and represent averages across the data set we analyzed. Your mileage may vary.
The “License-based” pricing model challenge
Given the above numbers, if you’re deploying an AVD environment the amount of infrastructure needed should never exceed the peak concurrency, or 350 users in our example (it will actually be even lower with dynamic auto-scaling). However, with a license-based, rather than consumption-based pricing model you will need to purchase 1,000 Cloud PC licenses and assign them to all authorized users even though only 600 users will actively use their desktop and only up to 350 of them will be ever logged in at the same time.
Can anything be done to avoid paying for and “wasting” licenses for users who are not taking advantage of their Cloud PCs? The answer is Yes and the specifics of how this works is the topic of this article.
Optimization Strategy #1: Automatic license assignment
The first step is to assign licenses only to those authorized users who actually log into their Cloud PC. Now this is easier said than done because Windows 365 is architected in such a way that a Cloud PC will only be provisioned for a user if a license is already assigned. No license means no Cloud PC and users don’t have admin access to go into Microsoft 365 admin center and assign themselves a license, nor would admins want them to do that.
Nerdio Manager for Enterprise version 3.4 introduced the concept of License Auto-assignment. Here is how it works:
- The administrator creates one or more security groups to contain authorized users. These users do not have licenses assigned to them.
- The administrator creates a security group to contain licensed users. These are users to whom a Cloud PC license will be assigned upon first login.
- The first time an authorized user logs into the Cloud PC, they navigate to an admin-provided URL. If the user is authorized, they will be added to the licensed group, a license will be assigned, and a Cloud PC will be provisioned. The user will automatically be redirected to the Windows 365 portal to log into their desktop.
The result is that only 600 licenses will be needed to support the 600 active users and those licenses will be assigned on-demand. This is a 40% savings and with a $50/user (2 vCPU, 8 GB, 256 GB) license it’s worth $20,000/month.
Click below for a video overview and demo of optimization strategy #1:
Optimization Strategy #2: Unused License Reclamation
What happens if a user who once worked on a Cloud PC leaves the organization or changes their workflow in such a way that they no longer user their Cloud PC? The answer is nothing. The user’s Cloud PC will continue running, the license will continue to be assigned to the user, and you will continue paying for it even if no one is ever connecting to the Cloud PC.
This is where Unused License Reclamation feature of Nerdio Manager for Enterprise comes in. If users don’t connect to their desktop for 45, 60, 90 or any other number of days, the license will be unassigned, and the Cloud PC will go into a “Grace Period” for seven days. During this time the license can be restored, if needed, but if it’s not the Cloud PC will be automatically de-provisioned.
Here is how it works:
- The administrator enables the Unused License Reclamation feature on a Cloud PC provisioning policy in Nerdio Manager and specifies the number of days that a Cloud PC can be inactive before the license is reclaimed.
- Nerdio Manager monitors user login activity to the Cloud PC in the background and once the configured number of days passes without a login un-assigns the license from the user and notifies the administrator about this action.
- Cloud PC goes into Grace Period for seven days. If the user logs in during these seven days, the license is re-assigned and the clock resets. If the user does not log in, then the Cloud PC is de-provisioned.
The result is that unused licenses, even if they were used in the past, aren’t being wasted. Once an unused license is reclaimed, it can be assigned to a new user or cancelled to avoid paying the subscription fee.
Click below for a video overview and demo of optimization strategy #2:
Optimization Strategy #3: Inactive User License Parking
Cloud PCs come in many different sizes ranging from 1 vCPU with 2 GB of RAM for $20/month to 8 vCPU with 32 GB of RAM and 512 GB storage for $158/month. While the user is connected to their Cloud PC, the specs make a big difference in performance and capabilities and are well worth the cost. However, when the user is not connected and the Cloud PC isn’t being used, wouldn’t it be great if the user’s Cloud PC could be “parked” with a cheaper license and assigned the original license when the user logs back in?
Nerdio Manager’s Inactive User License Parking feature does just that. Once users disconnect from their Cloud PC, their license is swapped out with a less expensive license (e.g. 1 vCPU, 2 GB, 64 GB – $20) and once they log back in the original license is re-assigned. This way, the number of licenses needed equals the peak concurrency while the remaining licenses could be less expensive, “parking” licenses.
Here is how it works:
- The administrator creates an empty parking security group and assigns a set of parking licenses to it (e.g. 1 vCPU, 2 GB, 64 GB – $20).
- Nerdio Manager monitors users’ Cloud PC activity and non-active users are moved from licensed security group to parking security group. This unassigns their primary license and assigns the parking license. The primary license can now be used by another active user.
- When users become active again and connect back to their Cloud PC, Nerdio Manager moves the users from parking group to licensed group re-assigning the primary license.
The result is you need fewer primary (more expensive) licenses. In our example, if 600 users are active but peak concurrency is 350 then you only need 350 primary licenses. The remaining 250 are less expensive, parking licenses. If the primary license is 2 vCPU, 8 GB, 256 GB, $50/month and the parking license is 1 vCPU, 2 GB, 64 GB, $20/month then the resulting savings is 15% ($12,500/month), which is on top of the license auto-assignment savings of 40% for a total of 55% in savings or $27,500/month.
A few technical notes:
- Inactive User License Parking does not actually resize the user’s VM, it simply temporarily replaces the user’s license while the user is not connected.
- For license compliance reasons, it is not possible to un-assign the primary license and leave the user without any license while not connected. Therefore, a minimal parking license is required to stay compliant with licensing requirements.
- Changing a user’s Windows 365 license is excluded from short-term license reassignment restrictions that exist for other Microsoft 365 products.
Click below for a video overview and demo of optimization strategy #3:
Putting It All Together
In our example of 1,000 authorized users with a 2 vCPU, 8 GB, 256 GB Cloud PC, license savings are $27,500/month. These savings of 55% relative to an “unoptimized” scenarios are possible by leveraging License Auto-Assignment and Unused License Reclamation to ensure that you only pay for licenses that are utilized and by using Inactive User License Parking to save on the cost of expensive licenses