SQL Server Licensing Compliance Guide: Avoiding Audit Exposure

SQL Server Licensing Compliance: The Seven Critical Pitfalls

SQL Server licensing is one of the most audit-sensitive areas in Microsoft's portfolio. Complex rules around core-based licensing in virtualised environments, edition rights, CAL accounting, disaster recovery entitlements, and licence mobility create compliance gaps that Microsoft's audit teams routinely exploit. A single under-licensed SQL Server Enterprise instance on a 40-core host can generate a true-up liability exceeding $500,000. This guide identifies the seven pitfalls routinely found in Microsoft licensing audits and provides a practical remediation framework.

Pitfall 1: Under-Licensing in Virtualised Environments

Virtualisation under-licensing is the number-one SQL Server audit finding globally. The complexity of core-based licensing in virtual environments, combined with VM sprawl, live migration, and shared infrastructure, creates compliance gaps that even diligent SAM teams miss. When infrastructure teams virtualise SQL Server on VMware or Hyper-V, VMs migrate between hosts via vMotion or Live Migration. New SQL VMs are often cloned without licence allocation, and partially licensed hosts are assumed to cover all VMs, which is false unless all physical cores are licensed with Enterprise Edition plus Software Assurance (granting unlimited virtualisation rights).

Every running SQL Server instance must be fully licensed. In audits, Microsoft auditors map every VM to its physical host. A single unlicensed SQL Server Enterprise VM on a 40-core host can trigger a $550,000 plus true-up (40 cores times approximately $14,000 per core list price). If the auditor determines the VM migrated across multiple hosts, each host may need to be licensed, multiplying the exposure. Standard Edition at 4-core minimum per VM is less expensive but still material when 10 to 20 VMs are unlicensed across an estate.

Remediation: Track every SQL VM in real-time. Licence entire hosts where feasible. Use Software Assurance for licence mobility. Scan regularly using Microsoft's MAP Toolkit or third-party tools (Snow, Flexera, ServiceNow SAM).

Pitfall 2: Edition Mismatch and Unintentional Enterprise Feature Usage

Edition mismatch—running Enterprise Edition binaries on a server licensed for Standard—is a high-frequency, high-cost audit finding. A DBA downloads the wrong installation media or uses a generic product key during setup. The server runs Enterprise Edition binaries while only Standard licences are assigned. In an audit, Microsoft detects the installed edition and compares it to entitlements. The financial gap is enormous: Enterprise at $14,256 per core vs Standard at $3,945 per core, a 3.6 times cost multiplier. On a 16-core server, the difference is $165,000.

Developer Edition is free but restricted to development and testing only. It includes all Enterprise features, making it tempting for internal tools and reporting databases. If a Developer Edition instance processes production data or serves end-users, it is completely unlicensed from Microsoft's perspective.

Remediation: Implement strict deployment controls. Maintain an internal software library with edition-specific media. Run monthly checks across all instances and compare to your licence register. Use sys.dm_db_persisted_sku_features to identify Enterprise-only features.

Pitfall 3: Server plus CAL vs Per-Core Model Errors

SQL Server Standard offers two licensing models: Per-Core (no CALs needed, unlimited users) and Server plus CAL (one server licence plus a CAL for every accessing user or device). Choosing the wrong model is a common and expensive mistake.

The indirect access trap: if an application (ERP, CRM, web portal) queries a SQL Server database, every user of that application needs a SQL Server CAL, not just the application's service account. A web application with 5,000 users connecting to a SQL Standard Server plus CAL instance requires 5,000 CALs (5,000 times $230 equals $1,150,000), far exceeding the cost of per-core licensing.

Pitfall 4: DR, QA, and Non-Production Licensing Gaps

Non-production environments, including disaster recovery, QA, staging, and training, are a persistent compliance blind spot. The assumption that "non-production does not need licensing" is incorrect under Microsoft's terms.

With active Software Assurance, you receive one passive failover instance at no additional licence cost. "Passive" means the server receives data but does not serve read queries or run reports. The moment a DR server serves read workloads, it is "active" and requires its own full licence. If you install Standard or Enterprise edition in a QA/test environment, that instance must be licensed. The safest approach: use Developer Edition (free, full Enterprise features) for all non-production SQL Server instances.

Pitfall 5: The 90-Day Licence Reassignment Rule

Microsoft's licensing terms restrict licence reassignment: a SQL Server core licence cannot be moved to a different server more frequently than once every 90 days. This rule has significant implications for virtualised and dynamic environments.

If you assign SQL Server core licences to Server A on January 1, those licences cannot be reassigned to Server B until April 1. The only exceptions are permanent hardware failure or active Software Assurance, which grants licence mobility rights within a server farm. In VMware environments with vMotion, SQL VMs can migrate between physical hosts automatically, potentially multiple times per day. Without SA licence mobility, every host that could receive a SQL VM must be fully licensed. Software Assurance is not optional for virtualised SQL Server—it is a compliance requirement in practice.

Pitfall 6: Shadow IT and Untracked SQL Server Installations

SQL Server Express Edition is free and can be installed by any developer without procurement approval. Third-party applications frequently bundle SQL Server Express or even Standard Runtime licences. This creates a shadow IT compliance problem.

SQL Server can exist in your environment without SAM knowledge. Express Edition has limitations (10 GB database size, 1 GB RAM). If workloads outgrow Express and are upgraded to Standard without a licence, you have a compliance gap. Third-party application bundles that include SQL Server Standard Runtime restrict usage to that specific application only. If other applications query it, the Runtime licence is violated.

Remediation: Run quarterly discovery scans across all servers and workstations. Flag every SQL Server instance and reconcile against your licence register.

Pitfall 7: Documentation and Proof of Licence Ownership

In a Microsoft audit, the burden of proof is on the customer. If you cannot produce documentation proving you purchased sufficient licences, Microsoft will assume you are under-licensed. Ensure your Microsoft Volume Licensing Service Centre (VLSC) shows all SQL Server licence purchases. Cross-reference VLSC entitlements with your internal deployment records. Document which licences are assigned to which physical hosts or VMs. Maintain SA renewal records with exact coverage periods. Maintain a record of SQL Server version and edition installed on every instance using SELECT @@VERSION and SERVERPROPERTY('Edition') quarterly.

SAM Remediation Framework: Quarterly Compliance Cycle

Use this quarterly cycle to maintain continuous SQL Server compliance.

Q1 Discovery and Inventory: Run full SQL Server discovery across all physical hosts, VMs, and workstations. Identify every instance: edition, version, core count, host assignment, and SA status. Output: complete instance inventory with licence requirement calculation.

Q2 Reconciliation and Gap Analysis: Compare discovery results against licence entitlements (VLSC plus OEM plus CSP records). Identify gaps: under-licensed instances, edition mismatches, expired SA, missing CALs, unlicensed DR servers. Output: prioritised remediation list with financial exposure per gap.

Q3 Remediation Execution: Close gaps: purchase missing licences, downgrade editions, replace Standard/Enterprise with Developer in non-production, enable SA where mobility is needed, document licence assignments. Output: updated effective licence position with zero gaps.

Q4 Documentation and Audit Readiness: Update all documentation: VLSC reconciliation, hardware inventory, licence assignment records, SA coverage dates, edition/version register. Test audit readiness: can you produce every document Microsoft would request within 48 hours?

Financial Exposure Summary: By Pitfall

Understanding the financial magnitude of each pitfall helps SAM teams prioritise remediation efforts.