The compliance gap was almost always a deployment discipline problem rather than deliberate overuse, and the true up tracks the peak assigned count rather than the average
A short provisioning spike for a project or a seasonal team can set the bill even after the seats are handed back. Average use never enters the calculation.
Prepared by Redress Compliance · August 18, 2026 · Adobe agreement reviews. 25 to 35 reviews led, 2024 to 2025.
Executive summary
Leaver seats made up 10 to 25 percent of assigned licences, belonging to people who had left or changed roles and whose access was never reclaimed.
Generic and shared accounts created named user breaches that surfaced at review. Teams shared a login to avoid asking for a seat, which is the cheapest possible way to create a finding.
True up cost tracked the peak assigned seat count, not the lower average actually in use. Unmanaged provisioning is therefore expensive even when it is temporary.
The renewal is the only moment the quantity resets downward. Mid term the contracted number moves in one direction, so the ratchet is structural rather than accidental.
What is actually being licensed?
Named users, not machines and not purchase orders. A licence attaches to a specific person through the administration console, so compliance is about assignment and use rather than the number on the order.
The enterprise model is set out on Adobe's enterprise admin guide, with the programme terms on the licensing terms page.
Three rules the model runs on
- One identity per seat, with no shared or generic accounts.
- Assignment counts, so a seat assigned but unused still consumes the entitlement.
- The console is the record, which means the evidence of a breach already sits in the vendor's system.
Older device based licensing counted machines. Named user counts people, so hot desking, shared workstations and contractor turnover now raise questions that device licensing never did.
What actually triggers a true up?
Assigned seats exceeding the contracted quantity. It is measured on the contract cycle and billed at the next anniversary, so it is a counting event rather than a separate audit event.
| Factor | What it measures | Risk | Lever |
|---|---|---|---|
| Named user assignment | Seats tied to identities | Shared or generic logins | Console clean up |
| Leaver seats | Assigned to departed staff | Wasted and non compliant seats | Reclaim at offboarding |
| Contracted quantity | The fixed seat count | True up on overage | Reset down at renewal |
| Peak provisioning | The highest assigned count | The true up cost driver | Manage provisioning |
Because the true up tracks the peak, a short spike for a project or a seasonal team can set the cost even after the seats are reclaimed. Reclaim promptly and the peak never forms.
The Adobe compliance audit defence
The client side settlement playbook, from console evidence to the number you actually agree.
Get the brief →What 25 to 35 Adobe reviews showed
Across roughly 25 to 35 Adobe agreement reviews led between 2024 and 2025, the compliance gap was almost always a deployment discipline problem rather than deliberate overuse. Three patterns recur.
- Leaver seats: 10 to 25 percent of assigned seats belonged to people who had left or changed roles.
- Shared logins: generic and shared accounts created named user breaches that surfaced at review.
- Peak provisioning: true up cost tracked the peak assigned seat count, not the lower average actually in use.
The evidence of a breach is already in the vendor's own system. The console records assignment, which is why keeping it clean is the defence.
- Every risky clause flagged with the verbatim quote and page anchor
- Entitlements, caps and protections verified across your whole contract portfolio
- Paste ready replacement language and an evidence trail for the response
Which agreement traps cost the most?
The ones that look like normal operations. A term agreement fixes a quantity and a price, and its traps come from the gap between that fixed number and messy real world deployment.
- Leaver drift: seats stay assigned after people go, inflating the count.
- Shadow sharing: teams share a login rather than ask for a seat, creating a named user breach.
- Quantity ratchet: the contracted number rises at true up and is rarely reset down.
The ratchet only unwinds at renewal
Mid term the quantity moves up. The renewal is the one moment it can be reset to real use, which is why the console reconciliation belongs before the renewal rather than after it. The escalator mechanics sit in the term agreement negotiation guide.
Watch the briefing · 6:06Right Sizing Your Adobe Estate Before You NegotiateInactive seats renew silently and compound at the annual uplift.
How do you keep the console audit ready?
Run a quarterly reconciliation of assigned seats against active staff, and tie seat reclaim to the offboarding process rather than to a periodic clean up project.
Two controls, one running continuously
Offboarding is the control that removes leaver drift permanently. A quarterly sweep removes the seats that escaped it, and the two together keep the peak close to the real requirement.
The whole estate view, across the creative, document and experience product lines, sits in the term agreement pillar and the creative enterprise guide. The cross vendor version is the audit defence playbook.
What the reviews measured, 2024 to 2025
Two cuts of the engagement file describe where the exposure came from.
People who had left or changed roles, whose access was never reclaimed at offboarding.
The highest assigned seat count in the period, so a temporary spike prices the true up even after the seats come back.
Neither is deliberate overuse. Both are process gaps, which makes them cheaper to close than to argue about after a review has opened.
Your first five moves
- Reconcile assigned seats against active staff every quarter, because 10 to 25 percent of them belonged to leavers or role changers in the reviews.
- Tie seat reclaim to the offboarding process, which is the only control that removes leaver drift permanently rather than periodically.
- Eliminate generic and shared accounts, since each one is a named user breach recorded in the vendor's own console before anybody asks about it.
- Manage provisioning to the real need so the peak never forms, because the true up prices the highest assigned count rather than the average in use.
- Reset the contracted quantity down at renewal. It is the only moment the number moves in that direction, and the Adobe practice runs the reconciliation before the quantity is assessed.
Frequently asked questions
How does Adobe enterprise licensing work?
On a named user model. A licence is assigned to a specific person through the administration console, so compliance turns on who holds a seat rather than how many seats were purchased.
What is the most common compliance gap?
Leaver seats. Between 10 and 25 percent of assigned seats belonged to people who had left or changed roles, and the access was never reclaimed.
Do shared logins matter?
Yes. Generic and shared accounts breach the named user model, and the console records assignment, so the evidence of the breach is already in the vendor's system.
What triggers a true up?
Assigned seats exceeding the contracted quantity. The count is taken on the contract cycle and billed at the next anniversary, so it is a counting event rather than an audit.
Why is peak provisioning expensive?
Because the true up tracks the peak assigned count rather than the average in use. A short spike for a project or seasonal team can set the cost even after the seats are handed back.
Does an unused seat still count?
Yes. Assignment consumes the entitlement whether or not anybody opens the software, which is why the assigned list rather than the usage report is the number to manage.
Can the contracted quantity go down mid term?
No. The quantity rises at true up and is rarely reset, so the ratchet only unwinds at renewal. That makes the pre renewal reconciliation the cheapest lever in the agreement.
What is the primary audit evidence?
The administration console. Deployment and assignment data held there is what a review reads, which is why keeping it clean is a defence rather than an administrative chore.
How often should reconciliation run?
Quarterly, against active staff, with reclaim tied to offboarding. The quarterly sweep catches what the offboarding process missed rather than replacing it.
Is the gap usually deliberate?
Almost never. Across the reviews it was a deployment discipline problem rather than intentional overuse, which is worth saying plainly when a review opens.