Contents
Key takeawaysThe eight findingsServer and infrastructure findingsMicrosoft 365, Power BI and VisioCost before and after the noticeSAM engagementsThe 90 day windowWhat we saw, 2024 to 2026What to do nextFAQMicrosoft audit findings are predictable: eight gaps drive most settlements. Each can be fixed at your own prices in the 90 days before the auditor opens the conversation, and priced at settlement rates after it.
- Eight findings, one pattern. SQL Server cores, Windows Server CALs, Microsoft 365 mismatches and Power BI lead a list of eight predictable gaps.
- A negotiation in compliance language. Findings follow a standard sequence, while settlements depend on how prepared you are when the notice lands.
- SAM is the soft opening. A SAM engagement collects the same data for the same practice that runs formal audits, so give it the same discipline.
- Fix before the notice. Before it, most gaps close through uninstalls, reconfiguration and true ups at your prices; after it, past use is priced as found.
- Findings compound. A settlement is a stack of findings priced at list, and every gap closed early removes its full weight from that stack.
- Make it annual. Because you rarely know when an audit is coming, the eight reconciliations belong on a fixed yearly calendar ahead of the true up.
What are the most common Microsoft audit findings?
Eight findings drive most Microsoft audit settlements: SQL Server core licensing, Windows Server CAL gaps, Microsoft 365 plan mismatches, Power BI Premium, dev and test misuse, Hybrid Benefit claimed without Software Assurance, virtualization mobility and Visio and Project sprawl. Each one is a reconciliation you can run yourself before an auditor runs it for you.
Microsoft audits more enterprises than any other software vendor, through a team inside its Software Asset Management practice that works a standard sequence. The findings are therefore predictable. The settlements are not, because a Microsoft audit is a commercial negotiation that happens to use compliance language.
| Finding | How it arises | Fix before the notice |
|---|---|---|
| SQL Server core licensing | Under counted cores, edition mismatches, passive replicas that are not passive | Reconcile cores, editions and replicas instance by instance |
| Windows Server CAL gaps | Users and devices reach servers with no CAL coverage, often through a multiplexing layer | Count the population against CAL entitlements, multiplexing included |
| Microsoft 365 mismatches | Users on E3 consuming features licensed only in E5 or add ons | Reconcile feature use per named user before Microsoft builds the list |
| Power BI Premium | Capacity size and sharing patterns exceed the licensed tier | Map usage to tier and scope sharing to what you own |
| Dev and test misuse | Production workloads running on development use rights | Classify every environment against its actual traffic |
| Hybrid Benefit without SA | Azure Hybrid Benefit rates claimed on lapsed Software Assurance | Check SA continuity behind every benefit claim |
| Virtualization mobility | VMs move between hosts faster or further than the license rights allow | Reconcile host assignments and mobility rights to the real cluster |
| Visio and Project sprawl | Installs far beyond the small groups that were licensed | Sweep installs against assignments; it is the oldest finding and still pays out |
None of these is exotic. Each is a reconciliation that someone in your team could have run and did not, which is why all eight belong on an annual self assessment calendar that ends before your true up.
The Microsoft EA Preparation Playbook: The Work That Wins the Renewal
How do the server findings arise, and how do you fix them?
Five of the eight are server and infrastructure findings. Each rests on a specific licensing rule, and each can be checked with tools you already run.
SQL Server cores, editions and replicas
Per core licensing needs at least 4 core licenses per physical processor, or 4 per virtual machine when you license by VM. Licensing individual VMs requires Software Assurance or subscription licenses. Auditors check both minimums, and they check the edition: an Enterprise instance on a server licensed for Standard is a full Enterprise finding.
Replicas cause the largest surprises. With SA or subscription licenses, each licensed instance may run one passive replica for high availability, one for disaster recovery and one for disaster recovery on Azure. A replica stays passive only while it serves no data and runs no active workloads, so a readable secondary feeding reports needs its own licenses.
- Edition and version. Run SERVERPROPERTY('Edition') and SERVERPROPERTY('ProductVersion') on every instance and compare the result with what you bought.
- Cores. Take physical core counts from the hosts and virtual core counts from vCenter or Hyper-V, then apply the 4 core minimums.
- Replicas. List every Always On secondary and check whether read routing or reporting jobs point at it.
Windows Server CALs and multiplexing
Every authenticated user or device that reaches a Windows Server needs a CAL, and Microsoft states plainly that multiplexing does not reduce the number required. A portal, middleware tier or pooled connection in front of the server changes nothing, because the people behind it still count.
Check what you already own before you count the gap:
- Microsoft 365 E3 users. The suite includes Enterprise Mobility + Security E3, which carries Windows Server CAL rights for each licensed user. Remote Desktop Services CALs are separate.
- Contractors and shared devices. This is where the real gaps usually sit, because these people and machines often hold no Microsoft 365 license.
- External users. For large external populations, an External Connector license per server is often cheaper than individual CALs.
Virtualization and license mobility
Server licenses are assigned to physical hardware and may be reassigned no more often than once every 90 days, except when a server is retired for permanent hardware failure. License Mobility across server farms is not available for Windows Server, so each host must carry enough Standard licenses for the most VMs it can run, or be covered by Datacenter.
The exception matters for the fix. With SA or subscription licenses, VMs licensed individually can move within the same server farm at any time. Reconcile each cluster's DRS or failover rules against the licenses assigned to each host, and write down which hosts a licensed VM may run on.
Dev and test environments that became production
Visual Studio subscriptions cover designing, developing, testing and demonstrating programs, and every person using the software that way needs a subscription. Microsoft treats an environment as production once end users of the application access it for more than acceptance testing. Environments that connect to production databases or support disaster recovery count as production too.
SQL Server Developer edition has the same boundary. It carries every Enterprise feature and is licensed only for development, testing and demonstration. The fix is to classify each environment by its actual traffic and connections, since the name on the server proves nothing.
Azure Hybrid Benefit without Software Assurance
Workloads using Azure Hybrid Benefit may run only while the underlying SA or subscription term is active. When that term ends, Microsoft expects you to renew, switch the benefit off or remove the workloads. A lapsed SA renewal leaves every VM still flagged for the benefit as unlicensed Azure use, priced at the rate you avoided.
- Find the claims. Export every VM whose licenseType property shows the benefit, plus any SQL Server resources using centrally managed Hybrid Benefit.
- Match the cover. Tie each claim to an SA or subscription contract and its end date.
- Check the minimums. Windows Server needs at least 8 core licenses per VM under the benefit, even on a 4 core instance.
- Watch migrations. Windows Server Standard licenses can run on premises and in Azure at the same time only once, for up to 180 days, while you migrate.
Microsoft Audit Defense Guide
The eight findings, their remediation steps and the annual self assessment calendar in one guide.
Get the white paper →Where do Microsoft 365, Power BI, Visio and Project findings come from?
These findings come from features and installs that spread faster than the licenses behind them. They cost less per unit than server findings but touch far more users.
Microsoft 365 plan mismatches
The typical pattern is a tenant licensed for E3 that consumes E5 capabilities. Microsoft 365 E3 includes Entra ID P1, while E5 includes P2, and Privileged Identity Management needs Entra ID P2 or Entra ID Governance licenses for the users it covers. Security tools follow the same logic, as our note on Defender for Endpoint P1 and P2 shows.
Build the named user consumption reconciliation before Microsoft does: each premium feature switched on in the tenant, the users it applies to and the license each holds.
Power BI capacity and sharing
Microsoft is retiring the Power BI Premium P SKUs in favor of Fabric F SKUs, and capacity size decides who needs a license. On F64 or larger, users with a free license can view Power BI content. Below F64, every viewer needs Power BI Pro or Premium Per User, listed at $14 and $24 per user per month.
The finding usually appears after a capacity is resized or a workspace is shared with people who hold no Pro license. Map each workspace to its capacity and check every viewer.
Visio and Project installs
Visio and Project are the oldest items on the list and still pay out. Desktop installs spread through old media and self service portals, far beyond the few specialists who were licensed.
Visio Plan 1 lists at $5 and Plan 2 at $15 per user per month, and the Visio in Microsoft 365 web app comes with commercial Microsoft 365 subscriptions. Sweep installs against assignments, move people who only view or make light edits to the web app, and license the rest on the plan they use.
What does a finding cost before the notice compared with after it?
Before the notice you choose the cheapest fix, which is often a configuration change. After it, Microsoft prices the past use as found. Under the Microsoft Customer Agreement, you must order licenses covering the whole period of unlicensed use within 30 days of a verification.
If unlicensed use reaches 5 percent or more of your total use of all products, you also reimburse Microsoft's verification costs and buy the missing licenses at 125 percent of your then current price. Enterprise Agreement wording is similar, so read the version you signed.
A worked example
Take a hypothetical company whose self assessment finds three gaps. A 16 core SQL Server Enterprise secondary serves reports. 120 people run Visio desktop without a license, and 90 of them only view diagrams. 250 Power BI viewers without Pro sit on an F32 capacity. We use list prices and assume the gaps have existed for 24 months.
| Gap | Fixed before the notice | Found by the auditor |
|---|---|---|
| SQL Server secondary serving reports | Reporting moved to the primary, secondary passive again under SA: $0 | 8 two core Enterprise packs at $15,123: $120,984 |
| Visio desktop, 120 users | 90 moved to the web app; 30 on Plan 2 at $15 for 12 months: $5,400 | 120 users at $15 for 24 months: $43,200 |
| Power BI viewers, 250 users | Pro at $14 for 12 months: $42,000 | Pro at $14 for 24 months: $84,000 |
| Subtotal | $47,400 | $248,184 |
| If the 5 percent threshold is crossed | Not applicable | $310,230 at 125 percent, plus verification costs |
The internal fix costs about a fifth of the auditor's subtotal, and what it buys is forward use you need anyway. Real negotiations move both columns, yet the direction holds, and it repeats across all eight findings.
Is a Microsoft SAM engagement an audit?
In practice, yes. A Software Asset Management engagement arrives as help: a collaborative review, funded by Microsoft, with no findings letter. The deployment inventories, usage exports and entitlement records it collects go to the same practice that runs formal audits, and the review turns into an audit whenever the numbers justify it.
Treat it with the same discipline as a formal audit. Name a single channel for all contact, run your own reconciliation before any data leaves, and agree the scope in writing. Our guide to negotiating better Microsoft deals assumes that discipline is already in place.
What the SAM partner or account team will say, and what to say back
- "This is a free review to help you optimize." Then the output can go to us first, and we decide what is shared with Microsoft.
- "We just need the discovery tool on your network." We will run our own inventory for the agreed products and send reconciled results in the agreed format.
- "Development servers are in scope too." They are in scope for review, and here are the Visual Studio subscriptions and Developer edition instances that cover them.
- "Declining may lead to a formal audit." We are not declining. We are agreeing scope, timing and data method in writing before we start.
Why do the 90 days before the notice matter most?
The 90 days before the auditor opens the conversation are the last period in which every finding can be fixed at your own prices. Inside that window, licenses are trued up at negotiated rates, workloads are reclassified and replicas are fixed. The audit that follows meets a reconciled position.
After the notice, the same gaps are priced at list, stacked together and argued against a deadline. That is how predictable findings turn into seven and eight figure settlements, and the bargaining position flips to Microsoft. You rarely know when the 90 days start, so the only reliable approach is a standing annual cycle.
| When | What to do |
|---|---|
| Every year, about 4 months before your true up | Run all eight reconciliations and record data sources and dates |
| Before the true up order | Fix what you can by removal or reconfiguration, then buy the remainder at agreement prices |
| On any SAM invitation | Refresh the reconciliation, name one contact, agree scope in writing |
| Notice day | Read the verification clause you signed; the MCA gives Microsoft the right to verify on 30 days' notice |
| During the audit | Run your reconciliation in parallel and answer each finding separately |
| Settlement | Negotiate the findings one by one, ideally inside a renewal where there is room to trade |
The annual cycle leans on three pieces of work you should already own: the SQL Server reconciliation, the security consumption gap check and a disciplined Enterprise Agreement true up.
Why staying out of sight is the wrong advice
A common line is that you should not go looking for compliance gaps, because a self assessment creates a record of known shortfalls and Microsoft may never ask. We think that is wrong. The audit program is large and its findings follow a standard sequence, so an unexamined gap is only waiting for the auditor.
A self assessment gives you the cheapest remedies, such as uninstalls, reconfigured replicas and reassigned licenses. If the written record worries you, have your legal team commission the work rather than skipping it.
What have we seen in Microsoft audit defenses from 2024 to 2026?
Across roughly 40 to 55 Microsoft audit and SAM defenses we ran between 2024 and 2026, outcomes divided on the timing of preparation more than on the findings themselves. Unprepared mid market companies settled in a $1.5M to $4M band, and the top quartile exceeded $20M as findings stacked at list prices.
The pattern inside those numbers was consistent. Gaps closed before the notice dropped out of the settlement stack, while every gap the auditor found first was added to it at list.
A finding you discover internally is maintenance. The same finding in an auditor's workbook is a line item priced at list, next to seven others.
What the hardest hit companies had in common
Familiarity with Microsoft's review process hurt more than it helped. The companies hit hardest had been through SAM engagements and handed over their data unreconciled, which gave the later audit its discovery phase for free.
What the best prepared did differently
- They ran the eight findings internally every year and kept the working papers.
- They held their own reconciliation and sent Microsoft summarized results for the agreed products only.
- They negotiated the audit as a commercial event, contesting each finding on its own merits instead of accepting a total.
What triggers the audit in the first place is also consistent: renewal behavior, deployment telemetry, SAM data handed over unreconciled, and events such as mergers and acquisitions. You control the third one completely.
What to do next
- This quarter. Run the eight findings as a self assessment and keep the reconciliations inside your own team.
- Before the next true up. Fix each gap at the cheapest level first: uninstall, reconfigure or reassign, then buy what remains at agreement prices.
- On any SAM invitation. Treat it as the opening of an audit: one channel, scope in writing, your reconciliation before any data leaves your hands.
- Every SA renewal. Keep SA continuity and host assignment records current, because the Hybrid Benefit and virtualization findings become paperwork when the records exist.
- If a notice arrives. Contest findings individually, never as a stack, and settle through a renewal where there is room to trade.
- For support. Our Microsoft practice runs the defense with you, before and after the notice.
Frequently asked questions
Which Microsoft audit findings come up most often?
SQL Server core and replica gaps, Windows Server CAL shortfalls, Microsoft 365 plan mismatches, Power BI Premium overuse, dev and test misuse, Hybrid Benefit claims on lapsed Software Assurance, virtualization mobility breaches, and Visio and Project sprawl. The server findings usually carry the largest amounts per gap, while Microsoft 365 and Visio findings touch the most users.
How much do Microsoft audit settlements cost?
Mid market settlements averaged $1.5M to $4M across our defenses, and the top quartile exceeded $20M, with findings stacked at list prices against a deadline. The same gaps fixed before a notice usually cost a small fraction of that.
Is a Microsoft SAM engagement really an audit?
Functionally, yes. The review is presented as optional and collaborative, but its data reaches the team that runs formal audits and can convert into one. Agree scope in writing, name one contact and send reconciled results rather than raw discovery tool output.
When should we remediate Microsoft compliance gaps?
Before any notice, on a fixed annual cycle that ends before your true up order. That timing means you can remove or reconfigure first and buy only what remains at agreement prices. Once a verification starts, the clause requires licenses for the whole period of unlicensed use.
What triggers a Microsoft audit?
Internal compliance signals at Microsoft: renewal behavior, deployment telemetry, SAM engagement data handed over unreconciled, and corporate events like mergers and acquisitions. The audit team sits inside the SAM practice and works a standard sequence.
How do we defend a Microsoft audit already underway?
Control the channel and the data. Agree scope in writing, run your own reconciliation in parallel, and contest findings one at a time. Negotiate the settlement as a commercial transaction, ideally inside a renewal where you have room to trade. It is a weaker position than acting before the notice.
Does Microsoft 365 E3 include Windows Server CALs?
Yes for its licensed users. Microsoft 365 E3 includes Enterprise Mobility + Security E3, which carries Windows Server CAL rights. Remote Desktop Services CALs are not included, and contractors or devices without a Microsoft 365 license still need their own CALs.