# Licensing

OS and Applications, Microsoft Licensing Guide

# Operating Systems and Applications

The table below lists the operating systems available for the Frame platform and their corresponding licensing and image requirements based on the selected infrastructure.

<table id="bkmrk-operating-system-ahv" style="width: 100%; height: 352.825px;"><thead><tr style="height: 59.35px;"><th style="width: 20.2542%; height: 59.35px;">Operating System</th><th style="width: 15.6076%; height: 59.35px;">AHV</th><th style="width: 16.4416%; height: 59.35px;">AWS</th><th style="width: 16.4416%; height: 59.35px;">Azure</th><th style="width: 15.964%; height: 59.35px;">GCP</th><th style="width: 15.3704%; height: 59.35px;">IBM</th></tr></thead><tbody><tr style="height: 42.475px;"><td style="width: 20.2542%; height: 42.475px;">Windows 10 \*</td><td style="width: 15.6076%; height: 42.475px;">✓ <sup>[1](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 42.475px;">✓ <sup>[2](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 42.475px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 15.964%; height: 42.475px;">✓ <sup>[2](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 15.3704%; height: 42.475px;">✓ <sup>[2](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td></tr><tr style="height: 42.475px;"><td style="width: 20.2542%; height: 42.475px;">Windows 11</td><td style="width: 15.6076%; height: 42.475px;">✓ <sup>[1](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 42.475px;">✓ <sup>[2](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 42.475px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 15.964%; height: 42.475px;">✓ <sup>[2](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 15.3704%; height: 42.475px;">✓ <sup>[2](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td></tr><tr style="height: 55.35px;"><td style="width: 20.2542%; height: 55.35px;">Windows Server 2019</td><td style="width: 15.6076%; height: 55.35px;">✓ <sup>[1](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 15.964%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 15.3704%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td></tr><tr style="height: 55.35px;"><td style="width: 20.2542%; height: 55.35px;">Windows Server 2022</td><td style="width: 15.6076%; height: 55.35px;">✓ <sup>[1](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 15.964%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 15.3704%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td></tr><tr><td style="width: 20.2542%; height: 55.35px;">Windows Server 2025</td><td style="width: 15.6076%; height: 55.35px;">✓ <sup>[1](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 15.964%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 15.3704%; height: 55.35px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td></tr><tr style="height: 42.475px;"><td style="width: 20.2542%; height: 42.475px;">Ubuntu 20.04</td><td style="width: 15.6076%; height: 42.475px;">✓ <sup>[1](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 42.475px;">✓</td><td style="width: 16.4416%; height: 42.475px;">✓</td><td style="width: 15.964%; height: 42.475px;">✓</td><td style="width: 15.3704%; height: 42.475px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td></tr><tr><td style="width: 20.2542%; height: 42.475px;">Ubuntu 24.04</td><td style="width: 15.6076%; height: 42.475px;">✓ <sup>[1](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td><td style="width: 16.4416%; height: 42.475px;">✓</td><td style="width: 16.4416%; height: 42.475px;">✓</td><td style="width: 15.964%; height: 42.475px;">✓</td><td style="width: 15.3704%; height: 42.475px;">✓ <sup>[3](https://docs.difr.com/link/39#bkmrk-customer%27s-must-prov)</sup></td></tr></tbody></table>

<div align-items:="" center="" column="" id="bkmrk-" style="justify-content: center, display: flex, flex-direction:;"></div><p class="callout info"> \* Frame supports Windows 10 releases that have not yet met their [official end of service date](https://docs.microsoft.com/en-us/windows/release-information/).</p>

#### Footnotes

1. Customers must provide their own OS licenses and image for Nutanix AHV.
2. Customers must provide their own OS licenses.
3. OS license **included** in cost.

<details id="bkmrk-important-customers-"><summary>Important</summary>

Customers are responsible for applying operating system security updates to their accounts.

</details>1. Administrators are responsible for managing operating system and application updates for their accounts. As a best practice, administrators should ensure OS updates are compatible with any applications before installing them. Admins may choose to configure automatic updates or apply them manually. Similarly, this concept applies to configuring updates for any applications you have installed. Many Frame customers find that having a separate Frame account for testing significant system configuration changes is beneficial.

We also recommend testing any application and OS updates in the Sandbox environment and/or test pool before publishing to the production pool (or promoting a test publish to production). Any OS/application updates applied to the Sandbox will require a publish to propagate those changes to the test and production pools. If a new update has caused an issue, you can roll back to an older version of the application/OS and republish or restore from a Sandbox backup.

# Application Licensing

One of the more common challenges with onboarding applications to Frame, is supporting the various license models that come with the variety of software in the market. Most industry-standard licensing models can be supported by Frame with only a few exceptions. In cases where a particular licensing model is not supported, the software vendor will typically have an alternative license model that can be used. The following summarizes the common licensing approaches.

## Standalone Licensing

Apps that require standalone licensing may have trouble keeping their activation/licensing information active when published to production instances.

Standalone licensing sometimes fails in production environments due to the license being hardware-locked to a specific Windows hostname, network MAC address, hard drive unique ID, or some other hardware ID associated with the Windows installation. If you install the license on the Sandbox and then publish to production instances, the unique hardware fingerprint for the production instances will have changed and the licensing mechanism may prevent the sofwater from running. Note that sometimes these licensing mechanisms may allow some time period of use after being copied only to prompt for reactivation later. It's always best to consult with the software vendor first to understand how their licensing is intended to work.

In some cases, Frame can ensure that production instances have the exact same hostname as the Sandbox that they were originally configured for. This will enable support for standalone licensing that only relies on the hostname. This configuration resides in the Frame Gateway and is part of the Vendor configuration. By default, this value is set to create unique hostnames for all instances as shown below (contact Frame if you require this setting to be changed and don't have Gateway access for your deployment):

![Unique Hostnames](https://docs.difr.com/uploads/images/gallery/2025-10/t4Oinstanceshostnames.png)

Most applications that have standalone licensing models also have other licensing options including enterprise volume licensing and network licensing.

## Enterprise Volume Licensing

One of the most common licensing mechanisms available from software vendors is called enterprise volume licensing or volume activation. This approach makes it much easier for IT departments to distribute software across a large enterprise with many devices. Typically, a single key can be used to activate the software on the Sandbox (a.k.a. the “Template Image”) and the publishing process maintains the activation. This parallels the process used in physical PC environments where a template image is used to push entire hard drive images to PCs connected on the network.

Note that with some software, there is a limit to how many times an image can be created and copied before activation restrictions engage and prevent use of the software. For example, you may be able to install and activate on a Sandbox and then publish from that Sandbox to the production instances on that account. But you may not be able to clone the Sandbox to another account and then publish from that account (this constitutes a copy of a copy being published).

Ultimately, the licensing protections that software vendors use for enterprise licensing can vary significantly. It's therefore important to consult with the software vendor on what licensing approach is best for a managed environment like Frame.

## Network Licensing

Often, the best way to license applications for production instances is by configuring a dedicated network licensing server to serve licenses to production instances in real time. When a licensed instance is powered off, the license is then returned to the licensing server to become available to other instances.

+ This licensing server can exist within the same account (using Frame's Utility Server feature), AWS VPC, or can be accessible via a VPN tunnel.
+ The licensing server must have inbound TCP ports open on both the Windows Firewall and via AWS. If the account is within a VPC, the ports do not need to be opened via AWS.
+ Client-side access to a licensing server on AWS must be configured via IP address, as hostname resolution is disabled on AWS for security reasons.
+ Typically, if the Sandbox is properly configured and can connect to a licensing server and receive a valid license, one simply needs to publish (cloning the Sandbox image to production instances) in order for the licensing to work on production instances.

This licensing model is common with high-end engineering and graphics intensive applications.

## Cloud-based Licensing

Software vendors have been increasingly turning to cloud-based licensing. This means that the software license is more flexible and is tied to the user rather than to a device. Thus, a user can run the software on any device so long as it has internet connectivity and can reach the software vendor's cloud-based licensing system. Typically, a user login is required at the start of an application session. This login can be presented to a Frame user right after launching their Frame session. If entering a user's credentials is not desired, then an SSO integration may be an option when using this licensing approach.

## License Integration with Frame

ISVs can build their licensing models with Frame in mind. Frame offers unique data-handling tools that can be leveraged for licensing.

For example, if an ISV can tie their user authentication to their licensing for their users, this information can be passed from the ISV directly into a Frame session and the application can then access the licensing data as necessary. This, of course, is assuming that the ISV has written their app to expect this licensing data when a Frame session is started.

Similarly, if the ISV has their own authentication mechanism used to validate users, an SSO integration with Frame is another option.

## USB Dongle Licensing

While rare, some applications require physical dongles to be attached to the PC running the software. Naturally, this approach does not work with cloud-based virtual machines. In some cases, “soft” versions of the dongles can be used - but this typically requires close interaction with the software vendor.

# Microsoft Licensing Guide for Frame

Ultimately, Frame customers are responsible for ensuring their compliance with [Microsoft Licensing Terms](https://www.microsoft.com/en-us/licensing/product-licensing/products) and any other agreements pertaining to Microsoft.

This guide specifically covers Microsoft licensing from a Windows Operating System (OS) VM access perspective for use as a Frame workload VM. This does not include any relevant Windows endpoint device licensing, Microsoft Office/O365, or any other Microsoft or third-party software and/or subscription licensing that may be required.

<details id="bkmrk-warning-this-documen"><summary>Warning</summary>

This document is provided as-is for informational purposes only and may not reflect the most up-to-date requirements from Microsoft. The information in this guide is provided to help guide your authorized use of Microsoft products you are licensing; it is not your agreement with Microsoft. Frame customers are strongly encouraged to speak with their Microsoft representative to validate compliance.

</details>## Windows 10 and Windows 11

<details id="bkmrk-resources-official-w"><summary>Resources</summary>

- [Official Windows Licensing Brief for Virtual Desktops (PDF)](https://download.microsoft.com/download/3/D/4/3D42BDC2-6725-4B29-B75A-A5B04179958B/Licensing_brief_PLT_Windows_10_licensing_for_Virtual_Desktops.pdf)

</details>### Deploying on Amazon Web Services (AWS)

To comply with Microsoft's licensing terms, all virtualized Windows desktops and applications deployed in AWS must run on **Dedicated Instances**. This applies to both Frame-provided and customer BYO images running Windows 10 or 11. The Dedicated Instance infrastructure ensures that each virtual machine runs in an isolated environment, meeting the requirements outlined in the [Microsoft EULA](https://www.microsoft.com/en-us/windowsvirtualdesktop/eula). The AWS infrastructure must either be customer-managed (BYO) or Dizzion-provided (Complete customers only). Legacy Frame customers using Frame IaaS are not eligible.

<details id="bkmrk-user-licensing-requi"><summary>User Licensing Requirements</summary>

Every user accessing a Windows 10 or 11 desktop or application must have a VDA (Virtual Desktop Access) entitlement.

</details>#### Windows Activation via KMS or ADBA

When deploying BYO Windows 10 or 11 images, customers must configure an activation method to ensure compliance.

**Activation Options:**

- **KMS (Key Management Service)**
    - KMS can be configured within the customer’s infrastructure or on a utility server. Frame virtual machines must have network access to the KMS server.
- **ADBA (Active Directory-Based Activation)**
    - Recommended if KMS is not already in place. ADBA simplifies the activation process by leveraging existing Active Directory infrastructure.

<details id="bkmrk-resources-official-m"><summary>Resources</summary>

Official Microsoft Documentation for KMS activation  
Official Microsoft Documentation for ADBA activation

</details>If neither KMS nor ADBA is configured, Frame virtual machines may not activate properly, which can result in compliance issues.

### Deploying on Nutanix AHV

In order to access a Windows 10/11 VM hosted on-premises by Nutanix AHV, the device used to access the Windows 10/11 VM or the user must have a **Windows Virtualization Rights entitlement**. This entitlement is included with the Microsoft licenses listed in the table below:

<table id="bkmrk-model-microsoft-lice"><thead><tr><th>Model</th><th>Microsoft License</th><th>How to Purchase</th></tr></thead><tbody><tr><td rowspan="4">Per User</td><td>Windows Enterprise E3 Subscription License</td><td rowspan="0">Bring Your Own License</td></tr><tr><td>Windows Enterprise E5 Subscription License</td></tr><tr><td>Windows VDA E3 Subscription License</td></tr><tr><td>Windows VDA E5 Subscription License</td></tr><tr><td rowspan="2">Per Device</td><td>Windows VDA Subscription Licenses</td></tr><tr><td>Windows 10 Software Assurance</td></tr></tbody></table>

<details id="bkmrk-considerations-only-"><summary>Considerations</summary>

- Only one of the licenses in the table above are required on either a per-user or per-device basis.
- Microsoft 365 licenses that include Windows 10/11 Enterprise E3/E5 are only eligible for Windows Virtualization Rights entitlement if the user is the primary user of a device with a [Qualifying Operating System](https://download.microsoft.com/download/3/D/4/3D42BDC2-6725-4B29-B75A-A5B04179958B/Licensing_brief_PLT_Windows_10_qualifying_operating_%20system_requirements.pdf).

</details>### Deploying on Microsoft Azure

In order to access a Windows 10/11 VM hosted in Microsoft Azure, the user must have a Windows 10/11 Multi-tenant Hosting Rights entitlement. This entitlement is included with the Microsoft licenses listed in the table below:

<table id="bkmrk-model-microsoft-lice-1"><thead><tr><th>Model</th><th>Microsoft License</th><th>How to Purchase</th></tr></thead><tbody><tr><td rowspan="4">Per User</td><td>Windows Enterprise E3 Subscription License</td><td rowspan="0">Bring Your Own License</td></tr><tr><td>Windows Enterprise E5 Subscription License</td></tr><tr><td>Windows VDA E3 Subscription License</td></tr><tr><td>Windows VDA E5 Subscription License</td></tr></tbody></table>

<details id="bkmrk-considerations-only--1"><summary>Considerations</summary>

Only one of the licenses listed in the table above are required on a per-user basis.  
Microsoft 365 licenses that include Windows 10 Enterprise E3/E5 are only eligible for Windows 10 Multitenant Hosting Rights entitlement if the user is the primary user of a device with a Qualifying Operating System.

</details>## Windows Server

### Deploying on Nutanix AHV

In order to access a Windows Server (2012 R2, 2016, 2019) VM hosted on-premises on Nutanix AHV, the device used to access the Windows Server VM or the user must have both a Windows Server CAL (Client Access License) that matches the specific Windows Server OS version **and** a Microsoft RDS (Remote Desktop Services) CAL allocated.

<table id="bkmrk-model-microsoft-lice-2"><thead><tr><th>Model</th><th>Microsoft License</th><th>How to Purchase</th></tr></thead><tbody><tr><td>Per User</td><td>Windows Server CAL + Microsoft RDS CAL</td><td rowspan="2">Bring Your Own License</td></tr><tr><td>Per Device</td><td>Windows Server CAL + Microsoft RDS CAL</td></tr></tbody></table>

<details id="bkmrk-considerations-only--2"><summary>Considerations</summary>

Only one set of licenses listed in the table above are required on either a per-user or per-device basis.

Windows Server CAL may already be included with your Windows Server OS (depending on edition). The above does not include any required Windows Server Standard Edition or Datacenter Edition core-based licensing when deploying Windows Server VMs on-premises. These must be purchased as well.

</details>### Deploying on Microsoft Azure, AWS, or GCP

In order to access a Windows Server (2012 R2, 2016, 2019) VM hosted in Microsoft Azure, the Windows Server license must be included as part of the cloud provider's hourly pay-go pricing. As an exception that applies only to Azure, if the customer already owns on-premises Windows Server licenses with active Software Assurance, they can leverage the [Azure Hybrid Use Benefit](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/hybrid-use-benefit-licensing) to pay a lower hourly rate for pay-go Windows Server VMs.

In addition, each device used to access the Windows Server VM or each user must have a Microsoft RDS CAL allocated with active Software Assurance. Alternatively, customers can purchase a Microsoft RDS SAL (Subscriber Access License), which is only available on a per-user per-month basis.

<table id="bkmrk-model-microsoft-lice-3"><thead><tr><th>Model</th><th>Microsoft License</th><th>How to Purchase</th></tr></thead><tbody><tr><td>Per User Per Month</td><td>Microsoft RDS SAL</td><td>Available for Purchase from Frame or Bring Your Own License</td></tr><tr><td>Per User</td><td>Microsoft RDS CAL with Software Assurance</td><td rowspan="2">Bring Your Own License</td></tr><tr><td>Per Device</td><td>Microsoft RDS CAL with Software Assurance</td></tr></tbody></table>

<details id="bkmrk-considerations-only--3"><summary>Considerations</summary>

- Only one of the licenses listed in the table above are required on either a per-user or per-device basis.

</details>### Purchasing Microsoft RDS SAL from Frame

Customers who elect to purchase Microsoft RDS SALs from Frame are still liable for ensuring compliance with [Microsoft Licensing Terms](https://www.microsoft.com/en-us/licensing/product-licensing/products) for the relevant Windows Server product being accessed.

### Using Frame Secure Anonymous Tokens

Customers using [Secure Anonymous Tokens](https://docs.difr.com/books/platform-administrators-guide/page/secure-anonymous-tokens) for user authentication in to Frame are required to maintain a detailed record of all unique users logging into Frame each month throughout the term of their Frame subscription. For these customers who purchased Microsoft RDS SALs via Frame, they are also required to send Frame the actual number of unique users who accessed Frame during the previous monthly billing cycle on a monthly basis for compliance purposes. The following information should be provided to Frame:

- Frame Customer entity name
- Monthly billing period (MM/DD/YY - MM/DD/YY)
- Number of unique users