IT Asset Manager's Guide to Microsoft EA in 2026: The Complete Framework for Compliance, Optimisation, and Cost Control Across the Entire Agreement Lifecycle

Every other ITAM practice — compliance, optimisation, true-up management, renewal preparation — depends on having an accurate, continuously updated licence inventory. If you do not know exactly what you own, what is assigned, and what is available, you cannot make informed decisions about anything else.

1. The Three-Layer Inventory:

An effective Microsoft licence inventory tracks three layers simultaneously. Entitlements (what you own): every licence purchased under the EA, by SKU, quantity, and effective dates — sourced from the signed EA schedule, VLSC portal, and Microsoft 365 Admin Center. Assignments (what is deployed): every licence assigned to a user, device, or server — sourced from M365 Admin Center, Azure AD (Entra ID), SCCM/Intune, and server inventories. Availability (what is unassigned): the gap between entitlements and assignments — your licence pool. This pool should be actively managed, not just a residual number.

2. Reconciliation Cadence:

Reconciliation between entitlements and assignments should happen at minimum quarterly, and monthly in the quarter leading up to the EA anniversary (true-up). Each reconciliation should identify over-assignments (licences assigned beyond entitled count — compliance risk), under-assignments (entitled licences not assigned — potential waste or buffer), inactive users (licences assigned to users with no activity in 90 days — reclaim candidates), departed employees (licences assigned to terminated users — immediate reclaim), and device-based licensing gaps (devices with software installations but no corresponding licence).

3. The Licence Pool Strategy:

Maintain a deliberate licence pool (typically 3–5% of total entitlements) for new hires, project needs, and temporary requirements. This pool prevents emergency purchases at premium rates and ensures new employees can be productive from day one. However, the pool should be monitored — if it consistently exceeds 5%, you are likely over-licensed and can reduce at renewal. Learn more about independent Microsoft advisory services.

Compliance is not a point-in-time exercise — it is a continuous practice. Organisations that treat compliance as an annual check (at true-up) or a reactive response (to an audit notice) consistently face larger exposure and higher costs than those that maintain compliance as an ongoing operational discipline.

1. The Five Compliance Safeguards:

Integrate licence assignment with HR processes: every new hire receives the correct licence type from the pool as part of onboarding. Every departure triggers automatic licence reclaim. This integration should be automated where possible (using identity governance tools or scripted processes between HR systems and M365/Entra ID). Never deploy without a licence: establish a policy that no software installation, cloud service activation, or server deployment occurs without a confirmed licence entitlement. This applies to all environments — production, development, test, and disaster recovery. Quarterly internal compliance reviews: compare deployed software against entitlements every quarter. Focus on the highest-risk areas — server products in virtualised environments, Azure Hybrid Benefit usage, and device-based installations. Monitor cloud service assignments continuously: M365 licence assignments change daily as users join, leave, change roles, or request new services. Use M365 Admin Center reports or SAM tools to flag any SKU where assignments exceed entitlements. Control shadow IT and self-service: establish governance around self-service capabilities (Power Platform, Azure subscriptions, Teams app installations) to prevent unapproved licence consumption.

2. High-Risk Compliance Areas for ITAM Focus:

The EA annual true-up is the process where you report actual licence usage to Microsoft and purchase any licences consumed above your committed counts. Without proactive management, the true-up becomes an unpleasant financial surprise. With proactive management, it becomes a controlled, predictable, and often minimised cost.

1. The True-Up Timeline:

The true-up occurs at each EA anniversary. The ITAM team should begin preparation 90 days before the anniversary date — not in the final week. The preparation timeline: 90 days before — pull comprehensive licence usage data for all SKUs; identify any SKUs trending above committed counts. 60 days before — execute clean-up actions: reclaim licences from departed employees, inactive users, and completed projects; downgrade users who do not need premium SKUs (E5 to E3, etc.). 30 days before — finalise the true-up report; verify that all clean-up actions have been completed; calculate the exact true-up quantity and cost per SKU. Anniversary date — submit the true-up report to Microsoft; purchase additional licences as required.

2. Clean-Up Tactics That Reduce True-Up Cost: Learn more about Microsoft Enterprise Agreement negotiation guide.

3. Negotiated True-Up Protections:

The best time to address true-up risk is during the EA negotiation (before signing), but ITAM should advocate for these terms regardless. Request pre-agreed true-up pricing: ensure that any licences purchased at true-up are at the same discounted rate as the original EA — not at list price. Negotiate a growth cap: request a clause limiting the true-up obligation to a maximum percentage increase (e.g., 10% above committed counts) in any single year. Explore true-down rights: standard EAs only allow true-up (increases). Negotiate the ability to reduce licence counts at the anniversary if usage has decreased — this is rare but achievable in some negotiations.

SKU right-sizing — ensuring every user is assigned the lowest-cost licence that covers their actual feature requirements — is the single most impactful optimisation technique available to ITAM. Most organisations over-provision by 10–20%, assigning premium SKUs (E5) to users who only need standard capabilities (E3 or F3).

1. The Right-Sizing Framework:

Analyse feature usage per user across the M365 suite. For each user, determine which features they actually use (email, Teams, SharePoint, OneDrive, Phone System, advanced compliance, analytics, Copilot). Map each user's feature requirements to the lowest-cost SKU that provides those features. Identify users who can be downgraded without losing functionality they actually use. Execute the downgrades in batches, communicating with affected users and their managers. Learn more about Microsoft EA renewal preparation toolkit.

2. M365 SKU Decision Matrix:

3. Financial Impact Example:

A 10,000-user organisation with 2,000 E5 licences discovers that 600 of those E5 users do not use E5-specific features (Phone System, advanced compliance, analytics). Downgrading those 600 users from E5 ($57/month) to E3 ($36/month) saves $252/user/year × 600 users = $151,200 per year — or $453,600 over a 3-year EA term. Additionally, 1,500 frontline workers are on E3 when F3 ($8/month) would suffice: savings of $336/user/year × 1,500 = $504,000 per year — or $1,512,000 over 3 years. Total right-sizing savings: $655,200/year — $1,965,600 over 3 years. This represents approximately 15% of total EA user licence spend and requires no reduction in business capability.

Software Assurance (SA) is a significant component of on-premises EA licensing cost — typically 25% of the licence value per year. SA includes a portfolio of benefits beyond upgrade rights that many organisations fail to claim. Every unclaimed SA benefit is money paid but value not received.

1. The Complete SA Benefit Catalogue:

2. Azure Hybrid Benefit — The Highest-Value SA Benefit:

Azure Hybrid Benefit (AHB) allows you to use your on-premises Windows Server and SQL Server licences (with active SA) in Azure, avoiding the cloud licence cost. For a typical enterprise running 50–200 Azure VMs, AHB can save $100K–$500K+ per year. Every Windows Server or SQL Server VM running in Azure without AHB enabled is wasting money that has already been paid for through SA. ITAM should audit every Azure VM monthly: is AHB enabled? Does the organisation have the SA entitlement to support it? Any VM running without AHB when an SA entitlement exists is immediate recoverable savings.

Effective ITAM at enterprise scale requires tooling. Manual spreadsheets work for small environments but cannot maintain accuracy across thousands of users, multiple licence types, and dynamic cloud services. The right SAM tools automate reconciliation, flag compliance issues, and provide the dashboards that make ITAM data actionable.

1. SAM Tool Categories:

Microsoft-native tools: M365 Admin Center (licence assignment and usage reports), Azure Cost Management (Azure consumption and AHB tracking), Microsoft Entra ID (identity and access management — user lifecycle), VLSC (entitlement records and SA benefit activation), and Microsoft Adoption Score (usage and productivity metrics). Third-party SAM tools: Snow License Manager, Flexera, ServiceNow SAM, Certero, Aspera — these provide cross-vendor inventory, automated reconciliation, compliance dashboards, and optimisation recommendations. They are particularly valuable for on-premises server licensing and virtualisation compliance, which Microsoft's native tools do not cover well. Custom automation: PowerShell scripts and Power Automate flows for automated licence reclaim (departed employees), weekly reconciliation reports, and alert-based monitoring. Learn more about Microsoft EA true-up compliance guide.

2. Selecting the Right Approach:

3. The ITAM Dashboard — What to Track:

Regardless of tooling, the ITAM function should maintain a dashboard tracking these metrics in real time or near-real time: licence utilisation rate per SKU (assigned / entitled — target 90–95%), active user rate per SKU (active / assigned — target 85%+), compliance position per SKU (assigned vs entitled — any SKU >100% is a compliance alert), true-up projection (estimated cost at current trajectory), SA benefit utilisation (claimed / available benefits), Azure AHB coverage (VMs with AHB / eligible VMs — target 100%), and licence pool availability (unassigned licences by SKU).

ITAM cannot manage Microsoft licensing in isolation. Every IT team member who deploys software, provisions users, spins up servers, or creates Azure resources affects the organisation's licence position. Building licence awareness across IT is essential for sustainable compliance and optimisation.

1. Who Needs Training and What They Need to Know:

2. Key Policies to Establish:

Reuse-first policy: always check for available licences (pool or reclaimable) before purchasing new ones. No-deploy-without-licence policy: no software or cloud service deployment without a confirmed licence entitlement verified by ITAM. Offboarding licence reclaim: automated or mandatory licence reclaim within 24 hours of employee termination. Azure Hybrid Benefit mandate: every eligible Azure VM must have AHB enabled — no exceptions without documented justification. Project closure licence review: every project that uses Microsoft licences must include a licence return step in the closure checklist.

ITAM's contribution extends far beyond day-to-day compliance and cost control. The data and insights accumulated by a mature SAM function are the most valuable asset in EA renewal negotiations — they transform procurement from negotiating blind to negotiating with complete information.

1. The Data That Drives Better Renewals:

Three years of licence utilisation data provides: actual usage per SKU vs purchased quantity (identifies right-sizing opportunities), feature utilisation per user (identifies downgrade opportunities), growth trends (enables accurate forecasting for the next term), shelfware identification (products purchased but not effectively adopted), and Azure consumption patterns (enables optimal MACC sizing). This data answers the critical renewal questions: how many licences of each type do we actually need? Which SKUs should be increased, decreased, or eliminated? What is our justified demand for the next 3 years? Learn more about Microsoft audits and license compliance playbook.

2. Using SAM Data in Negotiation:

When procurement presents Microsoft with data showing that only 70% of purchased E5 licences are actively used, the argument for reducing E5 quantity (or converting surplus to E3) is irrefutable. When data shows that 15% of Power BI Pro licences have zero usage, the case for eliminating those licences at renewal is clear. When Azure consumption data shows consistent 110% MACC utilisation, the argument for a larger commitment at a deeper discount is well-supported. Without ITAM data, procurement negotiates based on assumptions. With ITAM data, procurement negotiates based on facts — and facts win negotiations.

3. Audit Leverage:

A mature SAM practice provides audit leverage in two ways. Proactive compliance demonstration: showing Microsoft that you maintain continuous compliance through quarterly internal reviews reduces audit motivation. Many organisations that demonstrate mature SAM practices through documented internal reviews experience fewer and less invasive audits. Defensive posture if audited: if an audit occurs, having comprehensive, current documentation of your licence position allows you to respond quickly and accurately, minimising disruption and reducing the likelihood of adverse findings. Organisations without documentation face longer, more invasive audits with higher compliance risk.

This consolidated checklist provides the step-by-step operational framework for IT Asset Managers to maintain compliance, optimise costs, and maximise value from the Microsoft Enterprise Agreement.

IT Asset Managers who execute this framework consistently deliver 10–25% lower Microsoft EA costs compared to organisations without structured SAM practices. The savings compound across licence right-sizing, eliminated shelfware, minimised true-ups, claimed SA benefits, Azure Hybrid Benefit coverage, audit risk reduction, and data-powered renewal negotiations.

For organisations building or maturing their Microsoft SAM capability, optimising existing EA investments, or preparing for renewal, Redress Compliance provides independent advisory with deep expertise in Microsoft licensing mechanics, compliance management, and the operational practices that transform EA cost structures.