SQL Server for enterprise workloads

Calculate the licensed core count before choosing a pack quantity

Start with the deployment boundary, not the database size or number of employees. For a physical SQL Server Enterprise deployment licensed by physical cores, count every physical core on the server, subject to Microsoft's minimum of four core licences per physical processor. A two-core pack supplies two core licences; it does not license an entire processor or server. Hyper-threading does not double the physical-core count under this method, and unused physical cores still count.

Separate software activation from the legal entitlement to run the planned configuration. A working product key does not, by itself, establish edition rights, core quantity, Software Assurance coverage or licence transfer eligibility. Before purchasing, obtain documentation identifying the version, edition, licensing channel and number of core licences supplied. SQL Server licensed per core does not require SQL Server CALs, but Windows Server licensing and any applicable Windows Server access licences remain separate obligations.

• Inventory physical processors and cores per processor.
• Apply the four-core minimum separately to each processor.
• Divide the required core licences by two to calculate two-core packs.
• Check entitlement documentation rather than relying on activation alone.
• Budget for the underlying operating system separately.

Choose a virtualisation model that matches your host and migration plans

For current SQL Server licensing, licensing individual virtual machines requires subscription licences or licences with active Software Assurance. Under that model, count the virtual cores assigned to each SQL Server VM, with a minimum of four core licences per VM. A small two-vCPU database VM therefore does not reduce the requirement below four. Confirm the applicable Microsoft Product Terms for your agreement and version, especially when assessing older perpetual licences or planning an upgrade.

An alternative for dense consolidation is Enterprise unlimited virtualisation: license all physical cores on a host with Enterprise core licences covered by active Software Assurance, meeting the physical-processor minimums. This permits any number of SQL Server instances in any number of virtual operating system environments on that licensed server. The entitlement does not automatically cover neighbouring hosts. Before enabling automatic VM migration, map every possible destination and verify its coverage or the applicable licence mobility rights.

• Record assigned virtual cores for every SQL Server VM.
• Do not assume a perpetual key includes individual-VM licensing rights.
• Compare per-VM licensing with fully licensing each intended host.
• Include maintenance and failover hosts in the placement plan.
• Review reassignment restrictions before moving licences between servers.

Classify every availability replica as passive or separately licensed

An availability group is a resilience design, not a blanket licensing exemption for its secondary servers. Under Microsoft's qualifying Software Assurance or subscription benefits, certain passive failover instances can run without separate SQL Server licences, subject to the applicable Product Terms. A secondary serving reporting queries or other active SQL Server workloads generally needs its own licence coverage. Classify replicas by what they actually do, rather than by whether the architecture diagram labels them primary or secondary.

Document each replica's location, purpose and permitted operations before purchasing licences. Microsoft's failover rights distinguish high availability from disaster recovery and impose conditions on passive instances, capacity and simultaneous operation. Certain maintenance operations on qualifying passive instances are permitted, but that should not be interpreted as unrestricted production use. If a replica will handle business intelligence queries, test workloads or application traffic, assess it as an active deployment rather than assuming the passive entitlement applies.

• List reporting and application connections to each secondary.
• Verify the precise passive-instance rights attached to your licences.
• Check permitted backup and maintenance activities against Microsoft's terms.
• Record the licensing impact of planned failover tests.
• Reassess coverage when changing replica roles or adding read-only routing.

Validate encryption and recovery as separate production controls

Treat storage encryption, connection encryption and protection from privileged database access as different requirements. Transparent Data Encryption protects database data and log files at rest; it does not prevent authorised SQL queries from reading plaintext. TLS protects network connections when properly configured. Always Encrypted protects selected column values through supported client drivers, with keys managed outside the database engine. Its security properties and query capabilities depend on the configuration, including whether secure enclaves are used.

Build a recovery runbook before moving regulated data into production. For certificate-based TDE, back up the certificate protecting the database encryption key together with its private key, and store the recovery material securely outside the database server. Restoring an encrypted database elsewhere requires access to the corresponding protector. Test restoration on an isolated target, then verify application connectivity, logins, jobs and external dependencies. Replication or an availability group does not replace independent backups against deletion, corruption or ransomware.

• Define separately which data needs at-rest, transport and column protection.
• Check driver compatibility before adopting Always Encrypted.
• Require certificate validation when configuring encrypted client connections.
• Include encryption-key recovery in every restore rehearsal.
• Measure recovery time and acceptable data loss through testing.

SQL Server Enterprise two-core pack examples. Physical examples license the entire server; individual-VM examples require eligible subscription licences or active Software Assurance. Operating system licences and additional servers are excluded.