Microsoft enterprise licensing changes favor Windows RT, put Android and iOS in their place

If you can't beat them, manage them. It's a strategy that has worked well for Microsoft in the past, and it is emerging as a key element in announcements last week about how Microsoft will license Windows 8 in all its variations, including the x86 consumer, Professional and Enterprise editions, the embedded Windows RT and the cloud-based Windows Intune.

While Microsoft's primary goal is to stop Apple's growth in the enterprise, which it will do by tilting licensing policies in favor of Windows tablets, the company has a Plan B that will help monetize Apple and Android devices in the enterprise through management.

Rights are limited Without Changes

The most obvious way that Microsoft has tilted licensing in its favor is a provision that exempts devices running Windows RT from special virtualization licensing.

Today, most desktop virtualization rights are limited to customers who purchase Software Assurance (SA), Microsoft's upgrade and benefits add-on for volume licensees, when they buy Windows OS upgrades. (Microsoft doesn't sell full Windows licenses through volume-licensing programs.) SA, which costs up to $55 a year, gives businesses the right to run multiple virtual machines on their desktops and to access remote virtual machines.

If Microsoft did not change the rules, here's what you'd have to do if you had a device running Windows RT. Since it can't get a Windows upgrade (embedded OSes can't be upgraded to Windows) the user of this device would need to purchase a Virtual Desktop Access (VDA) subscription, which costs about twice as much as Software Assurance, for every Windows RT device.

Microsoft does have a "roaming right" that is available for users whose PCs have Software Assurance on Windows. It is supposed to let these users access a virtual desktop infrastructure from another device, but the fine print imposes bizarre restrictions -- no device that is controlled, even indirectly, by the licensee can be used this way. Microsoft says only something like a public kiosk is eligible. Also, the device can't run on the licensee's network. In short, the SA Roaming Right only permits access from untrusted devices over insecure networks, the kind of thing that most corporations will do their level best to block.

That language rules out home or personally owned PCs, since a PC used by the licensee's employee to get work done doesn't qualify as a third-party device. (Nevertheless, many Microsoft Web pages and informational documents erroneously include home PCs in the SA roaming right.)

Something Special about Windows RT

Windows 8 licensing fixes some of this. According to Microsoft's Windows blog, any user of a PC with Software Assurance on Windows who also has a device running Windows RT receives VDA rights and can use that device to access a VDI image in the corporate datacenter. No nonsense restricts this to a third-party device or forbids its use on corporate premises. It's what the SA Roaming Right should have been.

However, non-Windows devices don't get such a free ride. It's not good enough that an iPad user has a PC with SA on Windows. They also need to purchase a new Companion Device License.

The blog's description of the CDL has some quirks that deserve close examination. Aside from the fact that iPad owners need to buy it while Windows RT device owners don't, there's this:

• The CDL, even at extra costs doesn't level the playing field for non-Windows devices, since VDA rights are mentioned for Windows RT, but not for the CDL.
• Windows RT devices can use their VDA rights to access "a full VDI image running in the datacenter"; iPads get the right to access "their corporate desktop".
• The Windows RT right doesn't specify how many devices it applies to; the CDL applies to "four personally owned devices".

This information comes from a blog, and not from an official document like Microsoft Product Use Rights, but if we take it literally, it could put iPad and Android tablet owners at quite a disadvantage. Here's how:

1. Non-Windows devices may not have access to a virtual desktop infrastructure in the datacenter, which is easier to manage centrally. If they want that, they'll maybe have to buy the full VDA, which Windows RT devices get for free.

2. The rights offered by the CDL-- remote access to one's corporate desktop -- are not new. Anyone who is the primary user of a PC licensed for Windows already has the right to access that device from any other device, including an iPad. That's in the Windows EULA and it has been there for many years. In announcing a paid license that does the same thing, Microsoft may be removing the free "primary user" right, which would be a big loss. Today, tools like TeamViewer, LogMeIn, or GoToMyPC let iPad users access the PC in their cubicle and have full access to Office, SharePoint, and other corporate resources without paying another dime.

3. Use of company-owned iPads and Android tablets may be prohibited, even with the CDL, since it applies only to "personally owned" devices.

To sum this up, what we've seen so far suggests that WinRT devices will have a significant licensing advantage over non-Windows tablets. Microsoft is not only giving WinRT devices free access to VDI that others need to pay for, but it may be taking away rights that non-Windows devices have today, forcing customers to pay to get them back.

Windows Intune Device Management

On the off chance that iPads and Android tablets will still have a future in Windows shops after Windows tablets come out, Microsoft is prepared to make a little more money off them by providing management tools.

Windows Intune gives subscribers (at $132 a year) the right to install the latest version of Windows on their PC. A cloud-based console can be used to manage those PCs, push software out to them, make sure they have the latest antivirus signatures, and so on.

Intune is not a compelling offering for larger customers (although small customers with limited IT resources may find it attractive). Most enterprises already get the latest version of Windows and license some System Center tools for managing their desktops, so Intune is just an expensive way to get a Windows upgrade and some management tools.

However, it also includes the Software Assurance virtualization rights, without forcing customers to also buy a Windows upgrade that they may not need, and that's positive for some businesses.

In its next iteration, Intune will add management (but not SA virtualization rights) for devices that support Microsoft's ActiveSync technology, including iPads, iPhones and Android tablets and phones. ActiveSync doesn't offer the most comprehensive suite of management options, and in many cases the devices support only a fraction of the features that ActiveSync offers. Nevertheless, Intune may be the path of least resistance for a lot of customers who don't have a good mobile device management system in place today, and it could let Microsoft profit quite handsomely from all of those Apple and Android tablets.

If you count just $1 a month of the Intune fee as what you're paying for managing a non-Windows tablet, Microsoft is making $12 a year, and perhaps $36 over the life of the device for management features. That's more than the royalties Microsoft will ever get off Apple and Google.

Intune's underlying management technology comes from the new System Center 2012, which will offer broader management for non-Microsoft mobile devices and will further encourage customers to keep investing in Microsoft's management tools.

It echoes Microsoft's virtualization strategy. Where VMware charges big money for ESX and nice sums for VMware Workstation, Microsoft gives away Hyper-V and Virtual PC. But because most of the workloads running in those VMs, even on VMware's platform, are running Microsoft workloads and are best managed with Microsoft's System Center tools, the company is monetizing VMware's customers through management.

It looks like whether they win the tablet wars or not, they're determined to win the management wars.

Photo Credit:  olly/Shutterstock

Paul DeGroot is one of the world's leading experts on Microsoft licensing policies, rules and volume licensing programs. Over a ten-year period, he developed and led the licensing practice at Directions on Microsoft, an independent analyst firm focused on understanding Microsoft policies and strategies. DeGroot formed Pica Communications, LLC, where he is principal consult, in 2010, to bring his licensing expertise to a broad range of customers worldwide. Please follow him on Twitter.