Microsoft Product Use Rights Interpretation Guide: Enterprise Reference

The Microsoft Product Use Rights (PUR) document is simultaneously the most important and the most misunderstood document in enterprise Microsoft licensing. It defines not just what you can do with a product, but specifically how you may deploy it, who may use it, in which environments, and under what conditions. Microsoft auditors interpret the PUR literally — and organisations that rely on common-sense interpretations of licence terms rather than reading the actual PUR text create audit exposure that compounds over time.

Based on 500+ Microsoft licensing engagements, PUR misinterpretation is the second most common source of audit findings after unmanaged virtualisation (SQL Server and Windows Server). This guide covers the PUR concepts that create the most significant commercial risk: downgrade rights, virtualisation rules, second-use rights, external user provisions, and reassignment rules.

The PUR Document: Structure and Update Cycle

Microsoft's Product Use Rights document is published at microsoft.com/licensing and updated approximately quarterly (January, April, July, October). The document is structured by product family, with each section defining: the licence type (per device, per user, per processor/core, per OSE); permitted use scenarios; use restrictions (what the licence does not cover); and specific provisions for virtualisation, cloud deployment, and multi-tenant hosting.

The EA incorporates PUR by reference — meaning the effective licence terms are those in the PUR at the time of use, not necessarily those at the time of purchase. Microsoft's EA does include a provision requiring 30 days' advance notice of materially restrictive changes, but the threshold for "materially restrictive" is determined by Microsoft. Changes that eliminate previously-relied-upon use rights have occurred without specific customer notification. Quarterly PUR review should be a standing item in your SAM programme governance calendar.

Downgrade Rights: Complete Reference

Downgrade rights are one of the most commercially valuable PUR provisions and one of the most poorly understood. The basic principle: a perpetual licence for version N grants the right to run version N-1, N-2, or earlier versions of the same product. This has significant practical value — organisations that have purchased Windows Server 2022 licences can continue running Windows Server 2016 or 2019 without purchasing additional licences, purely through downgrade rights.

Downgrade Rights by Product Category

Downgrade Rights and Software Assurance

A critical and frequently misunderstood distinction: perpetual licences include downgrade rights permanently. Software Assurance (SA) extends those rights to new-version upgrades but does not affect the underlying downgrade right — downgrade rights are an inherent feature of perpetual licences, not an SA benefit. If SA lapses, you lose upgrade rights (to future versions) but retain downgrade rights (to older versions) because you still own the perpetual licence.

This distinction matters commercially: organisations that are considering dropping SA to save cost should understand that they retain all downgrade rights permanently. What they lose is version upgrade rights — if a new Windows Server or SQL Server version is released after SA expires, they cannot move to it without purchasing a new licence. The financial analysis of dropping SA should compare the SA annual cost against the probability and value of upgrade rights exercise within the SA period.

Virtualisation Licensing Rules

Virtualisation is the most complex and audit-sensitive area of Microsoft PUR interpretation. The core rules are straightforward in theory and consistently misapplied in practice.

Windows Server Virtualisation Rights

Windows Server Standard and Datacenter are licensed per physical core (minimum 8 cores per processor, minimum 16 cores per server). The virtualisation rights attached to each edition determine how many VMs can run on the licensed host:

The Standard edition multiplication trap is the most common Windows Server compliance finding. A 32-core server running 10 VMs with Windows Server Standard requires 5 licences (each covering 32 cores = 32 × $1,069 list = $5,345/licence × 5 = $26,725). Organisations that purchase 1 or 2 Standard licences thinking the single licence "covers" the server create a 3–4 licence deficit invisible until audit.

SQL Server Virtualisation Rules

SQL Server licensing in virtual environments has two permitted models: per physical core (licenses every core on the host — all VMs covered); or per virtual machine core (licenses the virtual cores assigned to each SQL Server VM — minimum 4 vCores per VM). The per-VM model appears cheaper but creates a restriction: the licensed VMs cannot move between hosts without re-licensing the destination host. In VMware or Hyper-V environments with vMotion or live migration, per-VM licensing on VMs that float across hosts violates the PUR — the hosts those VMs land on must also be licensed.

Microsoft's auditors specifically check for vMotion configurations with per-VM SQL Server licensing in DRS/HA clusters. This is the single most common audit finding we encounter in SQL Server audits, creating liabilities of $500,000–$5,000,000 in organisations with large VMware estates and per-VM SQL Server licensing elections.

Second-Use Rights

Second-use rights permit a licensed user to install qualifying applications on additional devices. Microsoft 365 subscription applications include the most generous second-use rights in the Microsoft portfolio: up to 5 PCs/Macs, 5 tablets, and 5 smartphones per licensed user. This covers the "personal laptop" scenario explicitly — an M365 Apps for Enterprise user can install Office applications on their personal home laptop, company laptop, and personal smartphone simultaneously.

For server products, second-use rights are narrower. Software Assurance includes Home Use Programme (HUP) rights — the right to install a secondary copy of Office productivity software on a home computer for the licensed employee's personal use. HUP does not extend to server products (SQL Server, Windows Server) or to contractor/external user installations.

Licence Reassignment Rules

The 90-day reassignment restriction is one of the most operationally impactful PUR rules for organisations with high staff turnover or contractor populations. Under the standard PUR rule, a software licence assigned to a specific user or device may not be reassigned to another user or device within 90 days of the initial assignment.

Exceptions to the 90-day rule: permanent hardware failure of the assigned device (immediate reassignment permitted to replacement device); permanent departure of the assigned user from the organisation (immediate reassignment to replacement hire permitted). Both exceptions require documentation — if Microsoft audits reassignment records, you need evidence of device failure or employee departure to justify sub-90-day reassignment.

For subscription licences (M365, Dynamics 365, Azure), the 90-day rule applies differently. Microsoft's subscription management portal enforces a 25-seat minimum reassignment for monthly subscriptions, but does not technically restrict reassignment frequency for individual seats within a subscription. The practical implication: M365 licences can be reassigned monthly through the Admin Centre without violating PUR, even though the underlying subscription licence terms reference the 90-day rule for perpetual components.

External User Provisions

The external user provisions in Microsoft's PUR are among the most commercially significant and least understood. Different products treat external users (partners, contractors, customers) very differently:

Azure Hybrid Benefit: PUR Rules for Cost Optimisation

Azure Hybrid Benefit (AHUB) is one of the most valuable cost optimisation provisions in the Microsoft PUR, allowing organisations to apply on-premises Windows Server and SQL Server licences to reduce Azure VM costs by 40–70%. The PUR rules governing AHUB eligibility create the most common missed savings opportunity in Azure estates:

For Windows Server: each 2-core Windows Server Standard licence with active SA covers 1 Azure VM (up to 8 virtual cores). Each 16-core Windows Server Datacenter licence covers all Azure VMs on any number of Azure hosts. The AHUB election must be made at the VM level in Azure — it is not automatic. We consistently find 25–40% of eligible Azure VMs not running AHUB, representing $50,000–$200,000/year in unclaimed savings for mid-enterprise Azure deployments.

For SQL Server: each 4-core SQL Server Enterprise licence with SA covers up to 4 vCores in Azure SQL Database or Azure SQL Managed Instance (or 4 vCores on an Azure VM). SQL Server Standard covers 1 vCore per licence. AHUB for SQL Server requires current SA on the qualifying licence — lapsed SA licences do not confer AHUB rights. See the companion guide on Microsoft SAM programme implementation for how to integrate AHUB tracking into your ongoing SAM operations.

Frequently Asked Questions

What are Microsoft Product Use Rights (PUR)?

The PUR document defines exactly how each Microsoft product may be used under your licence — permitted scenarios, deployment restrictions, virtualisation rights, downgrade rights, reassignment rules, and external user provisions. Updated quarterly, it is the legal baseline for Microsoft audit determinations.

How often does Microsoft update the PUR?

Approximately quarterly (January, April, July, October). Changes can be restrictive or expansive. EA terms incorporate PUR by reference, so rights can change mid-contract. Quarterly PUR review is essential for organisations with complex deployment patterns.

What are downgrade rights?

The right to run an earlier version of a product using a licence for a newer version. Perpetual licences include downgrade rights permanently — they are not an SA benefit. If SA lapses, you retain downgrade rights but lose upgrade rights to future versions.

What are second-use rights?

The right to install qualifying software on additional devices. M365 Apps for Enterprise includes rights for up to 5 PCs/Macs, 5 tablets, and 5 smartphones per user. Server product second-use rights are narrower — SA Home Use Programme covers personal laptop use for productivity software only.

How does the 90-day reassignment rule work?

Licences assigned to a user or device may not be reassigned within 90 days, with exceptions for hardware failure and permanent employee departure. Both exceptions require documentation. M365 subscription licences can be reassigned monthly through the Admin Centre without violating PUR in practice.

What are external user provisions?

Different Microsoft products treat external users differently. SharePoint Online includes unlimited B2B guest access at no cost. Dynamics 365 Portals require separate External Access licensing. SQL Server in web application scenarios requires Internet Connector licensing for anonymous access. Do not assume one product's external user model applies across the portfolio.