AVD on a Windows Server image needs RDS CALs - and if you're Entra-only, there's no clean way to buy them?

Posting this because it cost us a day and I couldn't find it laid out anywhere in one place. Maybe can someone help us?

Setup: We have small client, 4 concurrent users, single session host in a AVD deployment (hostpool, agent, the works). Image is Windows Server 2025 Datacenter.

They forgot about the CALs and the 120 day grace-period ended...

So the thing is, we're Entra-joined with no AD DS and after searching MS docs, online etc we found:

• Per-User CALs write tracking data to the AD user object. No AD DS = no object. Microsoft's own docs say workgroup mode is Per-Device only. People report 60-minute session drops if you try anyway. And MS won't convert CAL types after purchase.
• Per-Device CALs work fine without a domain - but License Mobility to Azure is a Software Assurance benefit that applies to User CALs. Device CALs don't get it.

So... the type that works technically can't legally go to Azure, and the type that can go to Azure doesn't work without a domain. There is no "just buy 4 CALs" path for the customer right?

They can't move to multi-session, there's an ERP installed and configured on the box.

The Question: Is there a way to( or what is the best way) to solve this cleanly on Entra-only?

Options we see are

1. stand up Entra Domain Services just to make Per-User CALs valid
2. RDS User SLs via CSP, still needs a domain for tracking (with second small VM as DC),
3. Rebuild hosts on multi-session, keep ERP on server (High cost for second VM)

Is there some other way we can achieve a Windows Server 2025 with RDP for 4 Users with correct licensing and without AD DS?