remote access tco: license line plus hidden labor

If you’re buying remote access for a team, the sticker price — the licence line on the invoice — is the easy bit. The hard costs are the hours nobody invoices: packing MSI, SSO work, onboarding, firewall trouble, session‑support time, certificate rotation, and the on‑call interruptions that add up at 2 a.m. This article breaks 'remote access TCO' into the licence line plus the operational hours and gives a reproducible 3‑year model you can adapt to your numbers.

What 'remote access TCO' actually covers

When IT asks for a TCO, they mean more than vendor billing. A practical remote access TCO includes: the recurring licence/subscription, one‑time deployment labour, recurring operational labour, infrastructure costs (relays, servers, monitoring), and risk‑related costs such as audit/forensics and incident response. You can bucket costs into one‑time vs recurring and into vendor vs people vs infrastructure.

• Licence/subscription fees (per‑seat, per‑device, concurrent, enterprise tiers).
• Initial deployment (packaging, GPO/MSI rollout, documentation, training).
• Integration work (SSO, MFA, directory sync, endpoint naming).
• Support load (session time, troubleshooting, break/fix).
• Operational overhead (patch testing, certificate renewal, relay/server maintenance, monitoring, backups).
• Compliance and audit tasks (logs, retention, evidence requests).

The licence line: how vendor pricing scales

Vendor invoices vary: per‑seat monthly, per‑device annual, or concurrent‑seat models. Add‑ons (session recording, unattended access bundles, device management APIs) quickly multiply the line item. For clarity, here are Tenvo's public tiers you should model into your spreadsheet: Free $0, Lite $2.99/mo, Pro $7.99/mo — Tenvo's managed relay (multi‑region) is the default recommended delivery.

Use the vendor line as a starting point, not a conclusion: multiply by your seat count and term, then add the people and infrastructure work below. If you want a side‑by‑side comparison with other vendors' license models, see our roundup in Remote desktop cost: 3-year TCO of major tools.

Example: 100 seats, Tenvo Pro ($7.99/mo)
Monthly licence: 100 × $7.99 = $799
Yearly licence: $799 × 12 = $9,588
3‑year licence: $9,588 × 3 = $28,764
(Use the same math for other tiers/seat counts.)

The invisible hours — the stuff nobody puts on the invoice

Licences are predictable; people time is not. Below are common tasks with conservative hour estimates for a 100‑seat desktop fleet and a blended labour rate of $100/hour. Change the rate and counts for your region or MSP margin.

• Packaging, test and validation: 20 hours (MSI/enterprise installer changes, baseline testing).
• Device onboarding: 0.25 hr/device × 100 = 25 hours (naming, inventory, enrolment).
• SSO & MFA integration: 12 hours (IDP config, mapping groups, test accounts).
• Network & firewall work: 6 hours (ports, proxy exceptions, NAT).
• Documentation & training: 8 hours (KB, runbook updates).
• Support sessions: estimated 1.5 sessions/device/year × 0.33 hr/session = 49.5 hours/year.
• On‑call/incident handling: 20 hours/year (escalations, post‑mortems).
• Patch & update testing: 8 hours/year.
• Compliance & audit preparation: 6 hours/year.

Summing those rows: initial one‑time labour ≈ 71 hours → $7,100. Recurring labour ≈ 83.5 hours/year → $8,350/year. Over three years that’s $7,100 + ($8,350 × 3) = $32,150 in people costs for 100 seats (at $100/hr).

Relay, infrastructure and the false 'free' of self‑hosting

Two delivery choices dominate: use a vendor‑managed relay (the default Tenvo recommendation) or self‑host your relay and ancillary services. Managed relays remove a lot of operational burden: multi‑region failover, certificate lifecycle, logging collectors, and a hardened stack maintained by the vendor. Self‑hosting is worth it only when a written requirement forces it: compliance prohibitions on third‑party infrastructure, an air‑gapped network, or strict data‑residency laws.

Important security note: when two endpoints connect directly (peer‑to‑peer), the session is end‑to‑end between them. When traffic falls back to a relay, TLS terminates at the relay, which means whoever operates the relay is technically in a position to inspect session traffic. Design your policy accordingly.

Operationally, self‑hosting cost components you must add to your spreadsheet include server instances (multi‑region to avoid single‑region failover), load balancers, monitoring, backups, certificate renewal automation and people hours for patching/incident response. For many teams the managed relay option is cheaper once you count these sustained staffing costs.

Self‑host example (100 seats):
Extra infra: $300/month → $3,600/year → $10,800 over 3 years
Extra ops: 10 hours/month → 120 hours/year → $12,000/year → $36,000 over 3 years
Extra 3‑year cost (infra + ops): $46,800
If your licence + people cost is ~$61k (see next section), self‑hosting pushes you to ~$108k over 3 years.

Putting it together: a reproducible 3‑year model (100 seats)

Key takeaways from this model: the licence line (≈ $28.8k) is only half the story. The people costs (≈ $32.1k) are the other half. Self‑hosting the relay nearly doubles the bill in this example because of sustained ops hours and multi‑region infra. If you have a compliance need that forces self‑hosting, plan for the extra $40k–$60k over three years for a 100‑seat environment unless you have existing staff capacity.

Questions to gather before you build your own TCO

• Seat count and growth rate (12/36/60 months).
• Support load: average sessions per device per year and average session length.
• Internal labour rate to blow up ticket hours to dollar amounts (use fully‑loaded salary or MSP bill rate).
• Delivery model: managed relay (recommended) vs mandatory self‑hosted and the exact compliance text forcing self‑host.
• Required integrations: SSO, directory sync, endpoint management, session recording, APIs.
• RTO/RPO expectations for relay infra and whether multi‑region failover is required.
• Audit/log retention requirements (how many GB per month and for how long).

Collect those inputs and put them into a simple spreadsheet: licences (monthly × seats × months), one‑time labour (hours × rate), recurring labour (hours/year × rate × years), and infra (monthly × months). That gives you a defensible TCO you can bring to leadership.

If you’re considering self‑hosting as a cost saver, read Self‑Hosted Remote Desktop: Why, How, and What Breaks and compare the operational requirements to the managed option. For quick field setup and a sanity check on rollout time, our How to Set Up Remote Access in 60 Seconds guide is a practical follow‑up.

Want an apples‑to‑apples comparison of licence models across the market? See our three‑year comparison at Remote desktop cost: 3‑year TCO of major tools for reference figures you can drop into the spreadsheet above.

Ready to test with your environment? Download Tenvo (Free, Lite $2.99/mo, Pro $7.99/mo) and try the managed relay to see how it changes your ops math: Download Tenvo.