I could not find a clear answer, thus decided to raise my question here. I have a customer with 500 internal users and 10.000+ external customers. Planning to implement a single FIM server, with both the sync engine and the portal installed.Internal users will be sourced from an HR system.External users are sourced from a CRM system.User and group provisioning to Active Directory will be done using code in the sync engine, no portal synchronization rules will be implemented.Portal will be managing group memberships (either manual or dynamic).Portal will be used to implement business logic: Based on attributes, a flag will be set in an attribute, signaling the custom code in the sync engine to either provision or deprovision a user or group object.Portal will be used for password reset functionality for internal users.External users will access sharepoint site only, using the credentials provisioned to AD. Optional (depending on licensing cost): Portal might be used for password reset external customersPortal might be used for history storage and reporting (2010R2 datawarehouse functionality)External users might be managed in the FIM portal directly, instead of being sourced from an external CRM system. I understand that I need: FIM Server license500 CAls for the internal users My blank spot is with the external users. There seems to be a lot of contradicting information. In one place I read a CAL is required for each identity managed by the FIM portal while another article says an external connector license is sufficient for all external (nonaffiliated) customers. Do i need a FIM CAL for all 10.000+ external customers, or is an external connector license enough in the scenario described above? Do the optional requirements impact the required CALs? Kind regards, Erik Cheizoo eXcellence & Difference eXcellence & Difference - We keep your business running

Hello Erik, According to the Forefront Identity Manager 2010 R2 Licensing Datasheet the following applies to external users. --8< --- There are two waysdepending on the relationship to the external userto issue or manage identities of people outside the organization. Each Forefront Identity Manager server accessed by partners, suppliers, or other unaffiliated external users requires an External Connector license.Each affiliated external user requires a CAL. For example, someone who performs contract work requires a CAL. --8< --- I would put customers in the first relationship catecory so an external connector license should cover you, but you might want to double check that with your licensing partner or Microsoft. Since your requirements are to manage some aspect of your accounts in the portal (Groups/Password reset/Business Logic) you will need CAL/Connector licenses even though you do your provisioning using code. --- Jesper Lnnqvist, Identity Architect http://addition-it.se