Software licensing explained: types, risks and what to check before you install

Getting software licensing wrong can mean unexpected audit true-ups, wasted spend on unused subscriptions and security gaps from unmanaged installations. Understanding the types of software licensing before you buy or deploy helps IT, procurement and finance make decisions together, rather than resolve expensive problems later.

Software licensing is the framework of permissions and conditions that determines how an organisation may install, access, use, copy or distribute software. It defines who or what is covered, the permitted environments, the duration of use and any associated payment, support and compliance obligations.

Key takeaways ·       A licence grants defined rights to use software; it does not transfer ownership. ·       Match the charging model to your users, devices, infrastructure and actual requirements. ·       Check entitlement, security, approvals and deployment rights before installation. ·       Review usage and renewals regularly, and keep evidence ready for software audits.

What is software licensing, and why does it matter?

A software licence grants permission to use software under specified conditions, not ownership of its intellectual property. Buying a licence key or successfully activating a product is not, by itself, proof that every deployment is covered. Your entitlement depends on the agreement, product, edition, quantity and permitted use.

• Cost: unused seats, duplicate tools and unsuitable tiers waste budget. Under-licensing can require additional purchases or contractual true-ups to cover a shortfall.
• Compliance: use beyond agreed rights can lead to contractual disputes, audit findings or legal claims. The consequences depend on the agreement and the circumstances.
• Security: unapproved or unsupported software can escape patching and security controls. Genuine, properly licensed software still needs secure configuration, updates and monitoring, which is why licensing and cybersecurity decisions belong together.

Common types of software licence

Software licence types describe different things: who can use a product, how capacity is measured, which features are included and how long rights last. They can overlap: a named-user licence might also be subscription-based and tied to a particular edition.

Model	How it’s charged	Best for	Watch-outs
User-based	Per named user or concurrent user/session allowance	People using multiple devices, or eligible shared-use teams	Assignment rules, peak concurrency, external users
Device-based	Per licensed device	Shared workstations and shift environments	Remote access and additional devices
Core or socket-based	Per licensable core or populated processor socket	Server and infrastructure workloads	Minimums, core factors and virtualisation rights
Edition or tier-based	According to features or service level	Matching capability to specific roles	Add-ons, bundle overlap and upgrade triggers
Subscription	Recurring payment for a fixed entitlement term	Time-limited access and evolving services	Commitment length, renewal and cancellation windows
Perpetual	Usually an upfront payment for continuing use rights	Stable requirements for a specified version	Separate maintenance, upgrades and end of support
Usage and consumption-based	By defined units such as transactions, storage or compute time	Variable or measurable workloads	Overages, minimum commitments and metering
Site and enterprise agreements	Negotiated scope, quantities or organisation-wide commitments	Larger, standardised estates	Entity boundaries, exclusions and true-ups
Open source and free software	Often no licence fee; support or hosting may cost extra	Suitable workloads with clear support and governance	Licence conditions, notices and source-code obligations

User-based (named and concurrent)

Named licensing assigns rights to an identified person, often across a permitted number of devices. Concurrent licensing allows a defined number of users or sessions at the same time, subject to the contract’s counting rules. Compare eligible users and peak demand, not just average logins. An inactive account can keep consuming an assigned licence until someone removes the assignment.

Device-based

Device-based licensing assigns rights to a machine rather than an individual. It can suit a workstation shared across shifts, but one device licence won’t always cover every application, remote-access scenario or additional endpoint. When comparing user-based vs device-based licensing, map how people actually work and check reassignment restrictions.

Core and socket-based

Core-based licensing counts licensable processor cores; socket-based licensing counts populated processor sockets. The two aren’t interchangeable, so don’t simply multiply cores by sockets. Count the cores across the relevant processors, then apply the vendor’s minimums, factors and deployment rules. For example, Windows Server 2025 Standard and Datacenter, licensed by physical core, require every physical core to be covered, with at least eight core licences per processor and 16 per server. A server with two six-core processors therefore needs 16 core licences, not 12. Access licences and virtualisation rights are checked separately. Microsoft’s Windows Server 2025 licensing guide sets out the full rules.

Edition or tier-based

Editions and tiers package different features, capacity limits or service levels. Check which capabilities each role needs, whether features require separate add-ons and whether enabling an option triggers a higher entitlement. A lower edition may be sufficient, but do not assume that installing only part of a higher edition makes a lower-tier licence valid.

Subscription vs perpetual

A subscription grants rights for a fixed term and normally requires renewal to continue use. Monthly billing can still sit within an annual or multi-year commitment. A perpetual licence generally permits ongoing use of a specified version under its terms, but future versions, continuing support and security updates usually need separate maintenance or upgrade rights. Compare the full cost of a subscription vs perpetual licence, including maintenance, upgrade plans and exit requirements.

Usage and consumption-based

Charges follow a defined measure, such as API requests, transactions, data processed or compute hours. Establish what is metered, who monitors it and how overages work. Budget alerts, ownership tags and usage limits can help control spend, but confirm whether a limit actually stops consumption or merely triggers a notification.

Site and enterprise agreements

These agreements can simplify buying across a defined site or organisation, but “enterprise” does not mean unlimited use. Check included products, legal entities, locations, contractors and acquired businesses, alongside minimum commitments and reporting requirements. Record when growth must be declared and how any true-up is calculated.

Open source and free software: obligations still apply

Open source licences permit commercial use, but conditions still apply. Depending on the licence and how you modify, distribute or provide the software over a network, you may need to preserve notices, give attribution or make relevant source code available. “Free software” refers to freedoms rather than price, and proprietary freeware may restrict business use. Keep a record of components and their licences, assess security and support, and take legal advice where obligations are unclear. The Open Source Initiative’s FAQs explain the distinctions.

What to check before you install

Use this checklist before installing an application, enabling a paid feature or giving someone access to a cloud service. If a check cannot be completed, record the unresolved issue and escalate it before deployment.

• Licence type and entitlement: confirm product, version, edition, quantities, licence metric and permitted users or devices. Check existing rights before making another purchase.
• Approval and budget ownership: obtain the required IT, procurement and security approvals. Name the business owner, budget holder and renewal decision-maker.
• Security review: check known vulnerabilities, required patches, supplier due diligence and support arrangements. Assess data protection, data location, access permissions and any necessary contractual safeguards.
• Terms: confirm virtualisation and cloud rights, transferability, reassignment, remote access, support and upgrades. Record renewal dates, cancellation windows, price-change provisions, data export and exit requirements.
• Compatibility and supportability: validate operating systems, integrations, dependencies, performance requirements and vendor support lifecycles. Test deployment and rollback through approved change control.
• Record-keeping: retain the agreement, applicable terms, order and entitlement confirmation, approvals and deployment details in a central register. Assign an owner to keep it current.

Licensing in virtual, cloud and hybrid environments

A workload’s licence rights don’t move with it by default. Establish whether the product is licensed against the physical host, individual virtual machines, assigned users or consumption. Map where workloads can run, including failover hosts and disaster recovery, before changing the environment.

• Core minimums and virtualisation: physical and virtual core rules can differ. Windows Server virtual-machine licensing is available for eligible subscription licences or licences with active Software Assurance and has a minimum of eight core licences per VM. Check all eligibility, customer-level minimums and access requirements in the applicable terms.
• Bring-your-own-licence (BYOL): confirm that your product, licensing programme and chosen provider qualify. Shared hosting, dedicated infrastructure and licence reassignment can have different conditions; an on-premises entitlement is not blanket permission for any cloud.
• SaaS user sprawl: reconcile assigned seats with joiners, movers, leavers and actual requirements. Identify duplicate tenants, trial conversions and overlapping subscriptions.
• VDI and remote access: validate rights for the desktop operating system, applications and access services separately. A remote desktop connection does not eliminate user, device or server access licensing requirements.

Recent changes (as of November 2026): in October 2022, Microsoft introduced its Flexible Virtualization Benefit, extending eligible subscription and Software Assurance rights to qualifying outsourcers’ shared servers. Some providers are excluded and product-specific conditions apply, so check the current Flexible Virtualization Benefit guidance. Separately, new commercial pricing for Microsoft 365 took effect on 1 July 2026, with existing customers moving to it at their first renewal after that date. Prices vary by product, country and currency, so work from your own agreement and renewal quote rather than a headline US price. Microsoft’s pricing update FAQ has the detail, and our overview of Microsoft 365’s 2026 changes covers what’s new. Both examples show why deployment rights and renewal assumptions need regular review.

Managing licences over time

Software asset management brings together discovery, purchasing records, contractual entitlements and usage evidence. The aim is to understand what you have, what you are entitled to use and what the organisation still needs, rather than simply counting installations.

1. Inventory and discover: maintain visibility across endpoints, servers, virtual infrastructure and SaaS. Capture edition, version, owner and relevant licensing metrics.
2. Reconcile entitlement against deployment and usage: compare discovery data with agreements, purchase records and assignment history. Investigate exceptions rather than treating every detected component as a separate purchase requirement.
3. Maintain a renewals calendar: record expiry dates, notice periods, commitments and decision owners. Begin reviews early enough to act before cancellation deadlines.
4. Reclaim unused rights carefully: coordinate with application owners, preserve required data and follow reassignment rules. Removing an assignment may not reduce a committed subscription bill until renewal.
5. Plan for true-ups: forecast growth, acquisitions and infrastructure changes, and follow contractual reporting dates. Budget for legitimate additional use and resolve discrepancies promptly.

Connect licence management to identity processes so accounts left behind when people move or leave are investigated promptly. Our guide to common identity and access management vulnerabilities provides related guidance on access governance and orphaned accounts. As a practical starting point, review high-change subscriptions monthly, reconcile the wider estate quarterly and reassess before renewals or major technical changes; adjust the cadence to risk and contractual requirements.

Software audits: what to expect and how to prepare

A vendor audit checks whether software use matches contractual entitlements. The process varies by publisher and agreement, but commonly involves notification, agreeing scope and timetable, collecting deployment and entitlement evidence, reconciliation, reviewing findings and resolving any shortfall. A vendor’s voluntary software asset management review is not the same as a formal contractual audit, so confirm which one you are dealing with.

Evidence to keep: signed agreements and amendments; applicable product terms; orders, invoices and entitlement confirmations; subscription and assignment history; dated discovery and usage reports; server and virtual-machine configurations; and records supporting transfers, upgrades or exceptions. Discovery data alone does not establish your legal rights.

1. Validate and coordinate: verify the request, appoint one response lead and involve procurement, IT, finance, legal and a qualified licensing specialist.
2. Review the agreement: establish the applicable audit rights, scope, deadlines, confidentiality and permitted collection methods before sharing information or running tools.
3. Preserve and validate evidence: retain dated records, investigate data quality and reconcile findings against entitlements. Follow approved security and data-protection processes for any disclosure.
4. Review and resolve: ask for the basis of disputed findings, agree justified remediation through authorised channels and document closure and control improvements.

How a managed services partner can help

Licensing is easier to control when it is connected to day-to-day IT operations: who has access, what is deployed, how changes are approved and where cloud spend goes. A managed services partner can bring those areas together. Before you commit, ask which systems are covered, what reporting you will receive and who remains accountable for purchasing and compliance decisions. Within our Intelligent Managed Services:

• Managed IT Support Services provide a 24/7 service desk, ITIL-aligned incident, change and request management, and joiner, mover and leaver processes that keep user access up to date.
• Modern Workplace Services include Microsoft 365 licensing and tenant management, automated patch and policy management, and usage analytics that help stop unused software renewing.
• Managed Infrastructure supports public, private and hybrid cloud, with Azure cost visibility, rightsizing, and proactive patching and maintenance.
• Managed Cybersecurity provides 24/7 threat detection and response from our UK-based security operations centre, alongside identity and access management and endpoint protection.

Frequently Asked Questions

What is software licensing?

Software licensing defines the permissions and conditions for using software, including who or what is covered, permitted environments and duration. It grants rights under specified terms rather than ownership of the software’s intellectual property.

What is the difference between a licence and a subscription?

A licence is the permission to use software. A subscription is a time-limited commercial arrangement that can include that permission alongside services, support or updates. Licences may be subscription-based or perpetual, and a monthly invoice doesn’t always mean you can cancel monthly.

What happens if software isn’t properly licensed?

You may need to purchase additional rights, address audit findings or resolve a contractual or legal claim. Access or support can also be affected under the applicable terms. Involve the relevant internal owners and a licensing specialist promptly; consequences depend on the agreement and circumstances.

What is the difference between named and concurrent licensing?

Named licensing assigns a licence to a particular person. Concurrent licensing limits how many eligible users or sessions can use the software simultaneously. Check the precise counting method, reassignment rules and peak demand rather than assuming account sharing is permitted.

How does core-based licensing work?

It measures entitlement by processor cores, applying the product’s physical or virtual core rules, minimums and any factors. For Windows Server 2025 physical-core licensing, cover all physical cores with at least eight licences per processor and 16 per server. Other products can use different rules.

Do inactive users still need a licence?

Possibly. An assigned named-user licence can remain allocated regardless of recent activity. Review permissions, retention needs and reassignment rules before reclaiming it. Removing a licence assignment or disabling an account may not reduce a committed subscription payment until renewal.

Is open source software free to use in business?

Open source licences permit business use, often without a licence fee, but obligations still apply. Review notices, attribution and any relevant source-code requirements. Hosting, maintenance and support may cost extra, and software advertised simply as “free” may have different commercial-use restrictions.

How often should we review our licences?

Use a risk-based schedule: monthly checks for fast-changing SaaS assignments, quarterly reconciliation of the wider estate and a full review before renewals are a practical starting point. Also review after acquisitions, workforce changes, migrations or vendor-policy updates, and meet any contractual reporting requirements.

Get clarity on your software estate

Not sure what you’re licensed for, what’s actually deployed or what renews next? Contact our team about your software estate. We’ll look at how you buy, deploy and manage software today, show where our managed services can help and agree the scope before you commit.