Hello,
Thank you for posting in Q&A forum.
Yes, Client Access Licenses (CALs) would be required in this scenario.
Microsoft Active Directory (AD) is a directory service for Windows domain networks that provides centralized management of network resources. When implementing AD in an organization and onboarding users to the domain, Client Access Licenses (CALs) are necessary to grant users the legal right to access the server-side services provided by AD.
There are two types of CALs:
User CALs: Required for every user who accesses the server.
Device CALs: Required for every device that accesses the server, regardless of the number of users.
You can choose either based on what makes the most sense for your organization's structure and needs. In your case, if these 500 users are each going to authenticate against the AD domain from potentially different devices, then User CALs would likely be more appropriate.
I hope the information above is helpful.
Best regards
Zunhui
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.