Exchange Server 2013, which shipped to Software Assurance (SA) customers in Oct. 2012 and to new customers in Dec. 2012, maintains the product's existing licensing model but makes significant changes to pricing and use rights. Exchange 2013 is the latest version of Microsoft's software for on-premises e-mail systems with integrated calendar, contact, and task management. The licensing changes will increase licensing costs for some organizations, particularly those enabling access to Exchange by mobile devices or using virtualization to deploy their Exchange server infrastructure.

Same Licensing Model

Like earlier versions, Exchange 2013 follows a server-Client Access License (CAL) licensing model: each server running Exchange components, called an instance, generally requires a server license, and each client accessing Exchange 2013 requires an Exchange 2013 CAL or pair of CALs.

Exchange Server 2013 server software is offered in the same two editions as before, Standard and Enterprise. For smaller organizations, Standard edition is sufficient, while large organizations will likely run a mix of Standard and Enterprise editions, with Enterprise deployed on servers that host large numbers of mailboxes. Prices for server licenses haven't changed, and, as with prior versions, each license provides the right for a particular device to run a single instance of the software on the physical hardware or within a virtual machine (VM). (For license pricing, see the illustration "Exchange License Prices and SA Grants".)

Consistent with Exchange 2007 and 2010, accessing the full Exchange 2013 feature set requires two CALs: a Standard CAL (SCAL) and an Enterprise CAL (ECAL). The SCAL, always required, licenses Exchange's essential features such as e-mail, calendar, contacts, tasks, browser-based access, and basic mobile device support. The ECAL, which is optional and additive to the SCAL, licenses the remainder. (For a summary of the SCAL and ECAL features, see the illustration "Features Licensed by Exchange Server 2013 CALs".)

The primary desktop client application for Exchange 2013 is Outlook, generally acquired in conjunction with the Office suite, which requires an additional license. Outlook Web App (OWA), the Web-based client for Exchange, as well as non-Microsoft client-side e-mail software, does not require additional Microsoft licensing.

Server-Side Licensing Changes

With Exchange 2013, the quantity and type of server-side licenses customers will need are affected by changes to license reassignment rules, improvements made to the Exchange 2013 system architecture, and dependency on newer versions of Windows Server. Customers who virtualize their Exchange Server deployment will likely need to maintain SA coverage, and architectural changes could impact the number of server licenses required for both Exchange and Windows Server.

Frequent Reassignment Now Requires SA

Many organizations run instances of Exchange in VMs using VMware, Hyper-V, or other virtualization technologies, and these systems are typically configured to allow VMs to move frequently between physical servers—often without operator intervention—for load balancing, high-availability, and other purposes. When a VM running Exchange moves to a different physical server, the Exchange server license is reassigned to the destination server.

Exchange 2007 and 2010 server licenses allow such reassignment as often as necessary within a "server farm," which is defined by Microsoft as up to two data centers that are in time zones no more than four hours apart. (The four-hour rule prevents "follow-the-sun" licensing, in which licenses are transferred to follow the workday.) To obtain equivalent reassignment rights for Exchange 2013, an organization must buy the server licenses with SA and maintain coverage, which costs 25% of the underlying license price per year. (SA is an add-on to perpetual licenses that offers version-upgrade rights and other benefits.) In the absence of SA coverage, an Exchange Server 2013 license allows reassignment between physical servers at most once every 90 days.

The way licensing rules are currently written, customers who renew SA on existing Exchange Server licenses may be at a disadvantage at some point in the future if they continue to use Exchange 2010 or earlier versions in virtualization scenarios. In general, when SA is renewed on a license, the license officially becomes the latest available version, meaning the customer is now subject to the usage rules for that latest version, even if they run an earlier version under downgrade rights. (Version downgrade rights entitle the owner of a product license to install and run an earlier version and equivalent edition of the same product in its place.) This becomes especially relevant when use rights become stricter, as is the case for Exchange 2013. For example, if SA coverage for a previously purchased Exchange 2010 server license is scheduled to expire in Apr. 2013 but is renewed, that license becomes an Exchange 2013 license and is subject to Exchange 2013 use rights, meaning the right to frequent license reassignment is now predicated on maintaining SA coverage. As a consequence, existing virtualized installations of Exchange 2010 could fall out of compliance with the reassignment rule if SA coverage were allowed to expire in Apr. 2016 (assuming SA coverage periods of three years). On the other hand, Exchange 2010 (or earlier) licenses purchased without SA coverage are not affected: they keep their original use rights, including the more liberal reassignment provisions.

Architecture and OS Changes Could Impact Licensing

To scale system capacity and to provide fault tolerance, Exchange installations are typically spread across multiple physical servers or VMs, each performing one or more specialized technical roles. Architectural improvements in Exchange 2013 consolidated the types of server roles down to two, client access and mailbox, with an optional third role, an edge transport server, running Exchange 2010 or 2007 software since that role is not available with Exchange 2013. Consequently, an Exchange 2013 installation may require fewer servers than were required for a previous version. Since SA customers get a one-to-one license grant, those deploying Exchange 2013 could find themselves with some surplus server licenses, while new customers could see modest server-side licensing savings compared to implementing prior versions.

Exchange 2013 requires Windows Server 2008 R2 or 2012, and unlike Exchange 2010, does not run on Windows Server 2008. Windows Server 2012's editions, Standard and Datacenter, are identical technically and only differentiated for licensing reasons, so Exchange 2013 mailbox servers can use the Standard edition of the OS. With Windows Server 2008 R2, in contrast, mailbox servers will commonly require the Enterprise or Datacenter OS editions for the clustering capability necessary to support Exchange's high-availability features. Windows Server 2012 Standard licenses, which include the right to downgrade to older versions of Enterprise edition, can be used by customers who want to deploy Exchange 2013 mailbox servers on Windows Server 2008 R2 Enterprise. Exchange clients will require CALs for the underlying Windows Server version: if Exchange is deployed on Windows Server 2012, clients require 2012 CALs; if Exchange is deployed on Windows Server 2008 R2, clients require Windows Server 2008 or 2012 CALs. (The 2008 R2 version of Windows Server does not have its own CALs and is instead licensed with 2008 CALs.)

Client-Side Licensing Changes

While the Exchange 2013 SCAL and ECAL deliver new compliance, collaboration, and security features, changes to CAL pricing and Outlook version requirements are likely to raise the cost of providing mailboxes for employees. However, for the subset of organizations interested in providing mailboxes for nonemployees, licensing costs have been reduced dramatically.

Per-User CAL Price Rises

As with earlier versions, Exchange 2013 SCAL and ECAL licenses can be purchased on a per-user or per-device basis. Previously, User CALs and Device CALs cost the same, but for Exchange 2013, User CAL prices were raised 15%, while Device CAL prices were kept the same. This 15% premium for User CALs aligns with Microsoft's new policy, rolled out in Dec. 2012, affecting nearly all major server products except SQL Server. Customers with existing Exchange User CALs covered by SA will see their annual SA fees increase 15% if they renew SA at the end of their current coverage period.

The User CAL price change will affect most Exchange customers, because most are licensing employees who access mail and other Exchange information from multiple devices, including PCs, tablets, and smartphones, and User CALs will still be the most cost-effective for those customers. Device CALs will remain useful in more limited cases; for example, when licensing shared terminals for shift workers.

Standard CAL Gains Rights and New Features

In Exchange 2013, the SCAL licenses some features that are new or that previously required the ECAL.

Malware and spam filtering. Exchange 2013 includes built-in malware and spam filtering to remove viruses, spyware, and unwanted messages from mail in transit. Its use is covered by the SCAL license purchased with or without SA. Microsoft previously offered a separate on-premises antimalware product for Exchange, called Forefront Protection for Exchange Server, which was sold stand-alone and was also included with SA on the Exchange 2010 ECAL. Forefront Protection for Exchange has been discontinued for new customers. The built-in filtering capabilities of Exchange Server 2013 differ somewhat compared to Forefront Protection for Exchange; for example, Forefront Protection for Exchange used multiple scanning engines to increase the chance of catching new malware early, while Exchange 2013's built-in system uses only a single engine. (The same engine is used in several other Microsoft products, including Windows and System Center Endpoint Protection.)

Customers who have active SA on the Exchange ECAL will remain entitled to use Exchange Online Protection, a Microsoft-hosted service that filters e-mail going into or out of organizations. (It was previously known as Forefront Online Protection for Exchange, Forefront Online Security for Exchange, and Exchange Hosted Filtering.) A subscription to Exchange Online Protection can also be purchased stand-alone. Organizations might use Exchange Online Protection together with Exchange 2013's built-in filtering, because Exchange Online Protection offers additional benefits: among other things, it filters incoming messages before they even reach the organization to cut down on network traffic, it uses multiple malware scanning engines (as did the discontinued Forefront Protection for Exchange), and its spam recognition rules are updated more frequently.

In-Place eDiscovery (enhanced Multi-Mailbox Search). In Exchange 2013, the SCAL grants rights to use In-Place eDiscovery, which extends a feature called Multi-Mailbox Search in Exchange 2010. In-Place eDiscovery allows authorized personnel to perform organization-wide searches for e-mail, calendar, task, and contact items, including items stored in users' Personal Archives (renamed In-Place Archives in Exchange 2013). As its new name implies, In-Place eDiscovery will often be used to locate potential evidence during the discovery phase of litigation. A similar change also affects Exchange 2010: Multi-Mailbox Search was added to the Exchange 2010 SCAL effective Oct. 2012; before then, it required the ECAL.

Site mailboxes. The Exchange 2013 SCAL includes rights to use site mailboxes, a new feature in Exchange 2013 and SharePoint Server 2013. A site mailbox is an Exchange mailbox associated with a SharePoint Server site. A site mailbox is accessible to users of the SharePoint site from either SharePoint's browser interface or an Outlook 2013 client connected to Exchange. Site mailbox users can take advantage of versioning, check-in/check-out, and other SharePoint document management features from within Outlook. Site mailboxes are similar to shared mailboxes already available in Exchange, but the SharePoint integration features will make them more useful for groups working on projects that involve editing and reviewing shared documents.

Data Loss Prevention Added to Enterprise CAL

One new Exchange 2013 feature is exclusive to the ECAL: Data Loss Prevention. Data Loss Prevention analyzes message contents for sensitive information, such as personally identifiable information, and allows administrators to configure policies to filter messages or monitor the results. Policies are configured using provided templates or custom templates created for specific business needs. Policy Tips (similar to the MailTips feature that debuted in Exchange 2010) can be set to prompt Outlook 2013 users that sensitive data has been detected in a message before it is sent.

The Data Loss Prevention feature will help organizations prevent accidental disclosure of information. This will be useful for organizations subject to specific privacy or disclosure regulations, but also for organizations that need to prevent accidental leaks of trade secrets or similar sensitive information. Past versions of Exchange include features to help stop accidental disclosure, notably custom Transport Rules; Data Loss Prevention adds templates for recognizing particular types of sensitive information (such as payment card numbers), user alerts via Outlook Policy Tips, and other improvements.

Licenses Not Required for Nonemployees

Some organizations host mailboxes for nonemployees—such as customers, partners, alumni, and off-site contractors—to enable secure communication with their employees, or as a benefit to help maintain a relationship with the client. Exchange 2013 drastically reduces the cost to license such scenarios by eliminating the need to license access by such nonemployee clients, called "external users" in Microsoft parlance.

In past versions of Exchange, organizations had to license nonemployee clients, either by acquiring a CAL for each client or by purchasing an External Connector license for each Exchange server. An External Connector license cost US$50,500 and provided the right for an unlimited number of nonemployee clients to access a single physical Exchange Server machine. If nonemployees accessed multiple physical Exchange servers, each of those physical servers required its own Exchange Server External Connector license.

With Exchange 2013, nonemployee use scenarios are covered as long as regular Exchange Server 2013 licenses are assigned to each server; neither CALs nor External Connectors are required. However, Exchange 2013 retains some restrictions that also applied to the External Connector in past versions: in particular, on-site contractors count as employees and require CALs, and the organization hosting Exchange may not charge external clients for access, as that would require special licensing for commercial hosting.

Outlook Upgrade Could Be Required

Exchange 2013 is compatible with Outlook 2007, Outlook 2010, and Outlook 2013. That means that organizations using Outlook 2003 will need to upgrade their clients and possibly purchase new licenses. (Outlook installations covered by SA as of Oct. 2012 are entitled to Outlook 2013.)

Some new features require the latest version, Outlook 2013. For example, Outlook 2013 is required for Outlook Policy Tips, and the new Exchange 2013 site mailboxes cannot be accessed on versions of Outlook older than Outlook 2013.


New capabilities of Exchange Server 2013 and Outlook 2013 are previewed in "Exchange Server 2013 Previewed" on page 6 of the Oct. 2012 Update.

Exchange Server 2010 licensing is explained in the May 2010 Licensing Outline, "Exchange Server 2010 Licensing, On-Premises and Hosted."

Windows Server 2012 licensing is summarized in "Windows Server 2012 Editions and Licensing Changes" on page 16 of the Aug. 2012 Update.

Licensing downgrade rules are discussed in "Downgrades Are Key to License Compliance" on page 17 of the Feb. 2013 Update.

Reassignment rights changes are discussed in more detail in "Virtualized Servers More Likely to Need SA" on page 17 of the Nov. 2012 Update.

Spam and malware filtering for Exchange Server 2013 are explained in more detail in

Per-user CAL price increases are outlined in "Per-User CAL Prices Raised 15%" on page 16 of the Dec. 2012 Update.

The discontinuation of Forefront Protection 2010 for Exchange Server is covered in "Phaseout of Forefront Antimalware Impacts License Suites" on page 18 of the Dec. 2012 Update.