Adobe license audit and true up risk: why the peak seat count sets the bill.

Adobe bills the highest number of seats assigned in the period, so a short project spike can set the true up even after the seats come back. Most gaps come from leavers and shared logins, and both are fixable.

What does Adobe actually license, and why does it matter in an audit?

Adobe licenses named users. It does not license machines or purchase orders. Each license attaches to a specific person through the Adobe Admin Console, so your compliance position depends on who holds a seat and how many seats are assigned, whatever the order form says you bought.

The enterprise model is documented in Adobe's enterprise admin guide. The contract terms, including the General Terms that sit under an ETLA or other enterprise order, are on Adobe's licensing terms page.

Three rules the named user model runs on

• One identity per seat. Shared and generic accounts are not allowed. The General Terms prohibit sharing login IDs and passwords, and prohibit two or more users signing in with the same ID at the same time.
• Assignment counts. A seat that is assigned but never opened still consumes the entitlement, so the assigned list is the number you manage.
• The console is the record. Assignment history lives in Adobe's own system, which means any evidence of a breach is already in the vendor's hands before anyone asks you a question.

Older device based licensing counted machines. Named user licensing counts people, so hot desking, shared workstations and contractor turnover now raise questions that device licensing never did.

Take a hypothetical design studio with 40 workstations running three shifts. Under device licensing it needed 40 licenses, while under named user rules it needs one seat for every person who signs in.

What the contract says about a formal verification

Adobe's current North American General Terms (2025v1, section 11) give Adobe the right to verify your use. On an ETLA, the anniversary true up is the routine way overage gets billed. The verification clause applies when Adobe decides to look further.

• Frequency. Beyond the usage data both parties can see in the console, Adobe may use other means of verification no more than once every 12 months, and may appoint an independent third party to run it.
• Data request. You have 30 days from the request to provide raw data from a software asset management tool, valid payment documentation and other information Adobe reasonably asks for.
• Onsite review. If the data does not settle the question, Adobe may audit onsite at your business locations with 14 days' prior notice, during regular business hours.
• Cost shifting. If use exceeds what the agreement permits by more than 5 percent, you pay Adobe's reasonable verification costs on top of the additional fees.
• Payment. Additional fees are due within 30 days of the invoice date. The clause does not say what price applies to them.

What triggers an Adobe true up?

A true up is triggered when assigned seats exceed the contracted quantity. The count is measured on the contract cycle and billed at the next anniversary. It is a counting event built into the agreement, separate from any audit, and it happens whether or not Adobe ever sends a verification letter.

Why the peak sets the bill

The true up tracks the highest assigned seat count in the period, and the average never enters the calculation. A short spike for a project or a seasonal team can set the cost even after those seats are handed back.

Adobe records that peak itself. The license assignment report, in the Global Admin Console under Insights, Reports, License Assignment, shows the peak assigned quantity by month or year.

How automatic assignment rules create spikes

Automatic assignment rules make spikes easy to create. On enterprise contracts that allow over delegation, Adobe's own documentation says any eligible user who requests access or follows a product access URL is approved automatically, regardless of how many licenses remain. An access link posted in a busy project channel can push the count past the contract in a week.

A worked example: one project, two outcomes

Say you hold an ETLA for 1,000 named users at a hypothetical $900 per seat per year. You run 960 assigned seats. A three month project adds 120 seats in month 5, and they are reclaimed in month 8.

In the first scenario the average of 990 sits under the 1,000 contracted, yet the peak of 1,080 creates an overage of 80 seats. If those 80 seats then stay in the contracted quantity for the last two years of a three year term, one project costs $144,000 for seats the business stopped using after month 8.

In the second scenario, the 96 reclaimed seats are 10 percent of the 960 baseline, at the low end of the leaver share we see in reviews. They absorb the whole project, and no true up is due.

What have we seen in recent Adobe agreement reviews?

We led roughly 25 to 35 Adobe agreement reviews between 2024 and 2025. In almost every one the compliance gap came from deployment discipline, and deliberate overuse was rare. Three patterns came up again and again.

• Leaver seats. Between 10 and 25 percent of assigned seats belonged to people who had left the company or changed roles. Their access was never reclaimed at offboarding.
• Shared logins. Teams shared a generic login to avoid asking for a seat. Those accounts created named user breaches that surfaced at review, and they are the cheapest possible way to create a finding.
• Peak provisioning. The true up cost followed the peak assigned seat count, which sat above the lower average actually in use.

Neither the leaver problem nor the peak problem is deliberate. Both are process gaps, and they are cheaper to close than to argue about once a review has opened.

The console records every assignment, so the evidence of a breach is already in Adobe's system. Keeping that record clean is your defense.

Which Adobe agreement traps cost the most?

The traps that cost the most look like normal operations. A term agreement fixes a quantity and a price for the term, and the exposure comes from the gap between that fixed number and how people join, leave and share work in practice.

• Leaver drift. Seats stay assigned after people go, and the count creeps up with every departure.
• Shadow sharing. A team shares one login instead of asking for a seat, which creates a named user breach.
• Quantity ratchet. The contracted number rises at each true up and is rarely reset down.
• Open door provisioning. Automatic assignment rules or a generous product request process let seats be added faster than anyone reviews them.

The ratchet only unwinds at renewal

During the term the contracted quantity only goes up. Seats added at an anniversary stay on the invoice until the term ends, and handing seats back mid term does not lower the fee. The renewal is the one point where the quantity can be reset to real use.

That is why the console reconciliation belongs before the renewal quote arrives. The escalator and price mechanics are covered in our term agreement negotiation guide, and renewal timing in ETLA renewal tactics for 2026.

Why a cleanup just before the anniversary comes too late

The usual advice is to run a big license cleanup a few weeks before the true up date. We disagree with relying on it, because the peak is recorded when it happens. A cleanup in month 11 lowers today's count without erasing the month 6 spike that the assignment report already shows.

A late cleanup also finds leavers who have held seats for most of a year. Reclaim at the moment someone leaves or a project ends, so the peak never forms.

Common mistakes and what they cost

• Keeping leaver accounts to protect their files. IT often leaves a departed user's seat in place because deleting the user deletes their cloud assets. Use the Admin Console's asset reclaim option to move the files, then remove the product assignment.
• Assuming directory sync frees the seat. With Microsoft Entra ID Sync, a user removed from the sync scope is disabled, not deleted, so the account stays in the Admin Console. Confirm that the product assignment has been removed as well, or the seat can stay in the count.
• Buying headroom to avoid true ups. Extra seats bought at signature are paid for across the whole term. A working reclaim process usually costs less than three years of spare capacity.
• Treating a generic login as a cost saving. One shared account used by eight people is a breach of the General Terms and can turn into eight seats once found.

How do you keep the Adobe Admin Console audit ready?

Run a quarterly reconciliation of assigned seats against active staff, and tie seat reclaim to your offboarding process instead of a periodic cleanup project. Those two habits keep the assigned count close to the real requirement and leave you with records you can show Adobe.

Two controls, one running continuously

Offboarding is the control that removes leaver drift for good, because the seat comes back on the day the person leaves. The quarterly sweep catches what offboarding missed, such as role changes, project seats and accounts created outside HR processes.

How to check your own position

1. Users export. Export the user list with product assignments from the Admin Console and join it to your HR list of active staff by email address.
2. License assignment report. If you run a Global Admin Console, pull the monthly peak assigned quantity for each product and compare it with the contracted quantity.
3. Audit log. Under Insights, Logs, the audit log records user additions, removals and product access changes. It keeps only the last 90 days, so export it to CSV every quarter.
4. Identity provider sign in logs. The console tells you who holds a seat. For Federated ID users, your identity provider's sign in logs show who has not signed in recently, which is the list to reclaim from first.
5. Assignment rules and requests. Review which automatic assignment rules are active, who can approve product requests and whether your contract allows over delegation.

For the full picture across the creative, document and experience product lines, see the term agreement pillar and the creative enterprise guide. The cross vendor version of this process is our multi vendor audit response guide.

How should you respond when Adobe raises a compliance question?

Respond in writing, ask for the basis and scope of the request, and reconcile the console data yourself before you agree to any number. The question can come from the account team at an anniversary as easily as from a formal audit letter.

What the account team will say, and what to say back

• "Your console shows more assigned seats than you licensed, so we will add them at the anniversary." Ask for the assignment data by month and the date the count was taken. Check it against your own export, and remove disabled, duplicate and test accounts before the figure is agreed.
• "Shared accounts breach the terms, so every member of that team needs a license." Accept the principle and close the accounts. Then license the people who actually used the login, based on your sign in records, rather than the whole department.
• "Renew at your current quantity and we can hold the price." Price the renewal on the reconciled count. A held unit price is worth little if it applies to seats that belong to leavers.
• "We would like to run a license verification." Ask which clause of your agreement applies, which products and which period. Provide what the 30 day data request covers and nothing beyond it.

What to do next

1. This quarter. Reconcile assigned seats against active staff, and repeat it every quarter.
2. At offboarding. Tie seat reclaim to the leaver process, so seats come back the day people leave instead of at the next cleanup.
3. Shared accounts. Close every generic and shared login and license the people who actually used it, before Adobe's console data raises the question for you.
4. Provisioning. Review automatic assignment rules and product request approvals, and staff temporary projects from reclaimed seats you already own.
5. Renewal. Reset the contracted quantity down at renewal, the one moment it can fall. Our Adobe practice runs the reconciliation before the quantity is assessed.

Frequently asked questions