AWS license-manager documentation change
Summary
Added detailed documentation about subscription charges for Microsoft Office, Visual Studio, and RDS subscriptions. Includes billing scenarios, CAL token expiration behavior, and warnings about user management requirements to stop charges.
Security assessment
The changes clarify billing mechanics and user management procedures but do not address security vulnerabilities or weaknesses. The warning about Active Directory user removal relates to billing termination rather than security controls.
Diff
diff --git a/license-manager/latest/userguide/user-based-subscriptions.md b/license-manager/latest/userguide/user-based-subscriptions.md index 8be9b42ff..1296e5fdf 100644 --- a//license-manager/latest/userguide/user-based-subscriptions.md +++ b//license-manager/latest/userguide/user-based-subscriptions.md @@ -5 +5 @@ -ConsiderationsUser-based subscription prerequisitesSupported software subscriptionsAdditional software +ConsiderationsSubscription charges in License ManagerUser-based subscription prerequisitesSupported software subscriptionsAdditional software @@ -18,0 +19,2 @@ Each associated user and [vCPU](https://docs.aws.amazon.com/AWSEC2/latest/UserGu + * Subscription charges in License Manager + @@ -64 +66,90 @@ The following considerations apply when using user-based subscriptions with Lice - * To stop incurring subscription charges for a user, you must disassociate the user from all instances they are associated with. For more information, see [Disassociate users from an instance that provides user-based subscriptions](./usubs-manage-users.html#usubs-disassociate-users). + * To stop incurring Microsoft Office or Visual Studio subscription charges for a user, you must disassociate the user from all instances they are associated with. For more information, see [Disassociate users from an instance that provides License Manager user-based subscriptions](./usubs-disassociate-users.html). + + + + +## Subscription charges in License Manager + +Subscription and billing in License Manager varies based on the subscription product that's used. + +**Microsoft Office and Visual Studio subscriptions** + + +For Microsoft Office and Visual Studio subscriptions, billing stops as soon as you have disassociated the user from all instances that provide the subscription product, and unsubscribed them from the product. + +**Microsoft Remote Desktop Services (RDS) subscriptions** + + +Microsoft RDS is billed on a per user, per month basis based on a combination of the user subscription and the client access license (CAL) token that's issued from the license server when the user connects to an instance that provides the subscription product. + +### Microsoft RDS billing in License Manager + +Microsoft RDS billing begins when the Active Directory user is subscribed through License Manager, and ends after the client access license (CAL) token expires, 60 days from the date it's issued, with no proration for partial months. Billing continues until the token expires, even if you unsubscribe the user. + +If an unsubscribed user continues to log in after the license token expires, they are automatically re-subscribed, and billing continues until they are again unsubscribed and their token expires. + +Similarly, if a user who has never subscribed, but logs into an instance that is associated with the license server, License Manager automatically subscribes them and begins RDS billing. Billing continues until they are unsubscribed and their token expires. + +To stop billing for a user at the end of the current month, you must remove that user from the Active Directory that's configured for the license server before unsubscribing. + +###### Warning + +If you remove an Active Directory user who still has an active Microsoft Office or Visual Studio subscription, that user will no longer be able to access instances that they are associated with. + +The following example scenarios demonstrate how RDS billing works. + +The following scenario shows a standard set of actions that affect billing for an Active Directory (AD) user who is subscribed on 12/15/2024, but never accesses a subscription instance. + +_Action:_ If the user never unsubscribes, billing continues indefinitely. + +AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends +---|---|---|---|---|---|--- +12/15/2024 | 12/15/2024 | \-- | N/A | \-- | \-- | \-- + +_Action:_ The user is unsubscribed on 1/15/2025. + +AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends +---|---|---|---|---|---|--- +12/15/2024 | 12/15/2024 | \-- | N/A | `1/15/2025` | `No` | `1/31/2025` + +The following scenario shows how the license token expiration affects the user subscription for an Active Directory (AD) user who is subscribed on 9/15/2024 and logs into a domain-joined subscription product instance the same day. + +_Action:_ Initial subscription and login for AD user. + +AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends +---|---|---|---|---|---|--- +9/15/2024 | 9/15/2024 | 9/15/2024 | 11/15/2024 | \-- | \-- | \-- + +_Action:_ The same AD user is unsubscribed on 10/19/2024. However, since the user wasn't removed from the directory, billing continues until the end of the month during which the license token expires. + +AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends +---|---|---|---|---|---|--- +9/15/2024 | 9/15/2024 | 9/15/2024 | 11/15/2024 | `10/19/2024` | \-- | `11/30/2024` + +_Alternative action:_ Before unsubscribing the AD user, the AD administrator removes the user from the directory on 10/20/2024. In this case, billing stops at the end of the month during which the user is removed from the directory. + +AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends +---|---|---|---|---|---|--- +9/15/2024 | 9/15/2024 | 9/15/2024 | 11/15/2024 | \-- | `10/20/2024` | `10/31/2024` + +The following scenario shows how an unsubscribed Active Directory (AD) user whose license token has expired is automatically resubscribed when they access a domain-joined subscription product instance. + +_Action:_ Initial subscription and login for AD user. + +AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends +---|---|---|---|---|---|--- +9/15/2024 | 9/15/2024 | 9/15/2024 | 11/15/2024 | \-- | \-- | \-- + +_Action:_ The same AD user is unsubscribed on 10/19/2024. However, since the user wasn't removed from the directory, billing continues until the end of the month during which the license token expires. + +AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends +---|---|---|---|---|---|--- +9/15/2024 | 9/15/2024 | 9/15/2024 | 11/15/2024 | `10/19/2024` | \-- | `11/30/2024` + +_Action:_ The same AD user accesses a domain-joined subscription product instance after their previous license token expires but before billing ends. Billing continues until the user is unsubscribed again and their new token expires. + +AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends +---|---|---|---|---|---|--- +`11/20/2024 (re-subscribed)` | `billing continues` | `11/20/2024` | `1/20/2025` | \-- | \-- | \-- + +The following scenario shows how an Active Directory (AD) user who was never subscribed to RDS SAL is automatically subscribed when they log into a domain-joined subscription product instance. @@ -65,0 +157 @@ The following considerations apply when using user-based subscriptions with Lice +_Action:_ An AD user who was never subscribed to RDS SAL logs into a domain-joined subscription product instance on 9/15/2024, and is auto-subscribed. Billing begins, and continues until the user is unsubscribed and their new token expires. @@ -66,0 +159,3 @@ The following considerations apply when using user-based subscriptions with Lice +AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends +---|---|---|---|---|---|--- +9/15/2024 (auto-subscribed) | 9/15/2024 | 9/15/2024 | 11/15/2024 | \-- | \-- | \-- @@ -67,0 +163 @@ The following considerations apply when using user-based subscriptions with Lice +For more information about how Microsoft RDS per user CALs work, see the **Per User CALs** section in the [License your Remote Desktop deployment](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-client-access-license) article on the _Microsoft Learn_ website. @@ -330 +426 @@ License Manager will attempt to recover unhealthy instances, but instances that - * You must [Disassociate users from an instance](./usubs-manage-users.html#usubs-disassociate-users) prior to terminating the instance. + * You must [Disassociate users from an instance](./usubs-disassociate-users.html) prior to terminating the instance.