SAM engagements, audits, and self assessments: how they start, what they look at, and how to run one on your own terms first. Three knowledge checks along the way, and 1 clip from a senior cloud advisor.
The presenter in this session is an AI generated avatar. The curriculum and guidance are real, produced by Redress Compliance analysts from our consulting engagements and market network.
This is a taught session, not a talking head. The instructor works through analyst grade slides, and three times the video stops on a question with four options on screen. Pause, commit to an answer, and the next slide explains which option is right and why each of the others is wrong. Once in the session the frame splits and a senior cloud advisor gives the view from inside real Oracle negotiations, and the instructor picks the clip apart when the slides return.
The full narration of this session, section by section, for reading and reference. Guest analyst clips are marked.
Welcome back, session thirty one of forty, and this opens module seven. Module six was the renewal, which is the event. Module seven is everything between the events, and it starts with compliance. Now, I want to set the tone carefully, because compliance sessions in licensing courses tend to be either alarming or evasive and neither is useful. Here is the honest position. The findings in a Microsoft audit are predictable. There are eight of them, they recur, and six of the eight are reconciliations this course has already taught you how to run. What varies between organisations is not whether the gaps exist, because most estates have some. What varies is who found them first. And the price difference between finding a gap yourself and having an auditor find it is not a percentage, it is a multiple, which is what this session is really about.
Five takeaways. One, three forms and one question: a SAM engagement, an audit, and a self assessment all ask whether your deployment matches your entitlement, and what differs is who holds the answer first. Two, the eight findings: eight recurring findings drive most settlements, and every one is a reconciliation you can run internally before anybody asks. Three, what it costs unprepared: mid market settlements ran one point five to four million dollars across the defences reviewed, with the top quartile exceeding twenty million as findings stacked at list price. Four, the ninety day window: gaps closed before the notice left the settlement stack, gaps discovered by the auditor joined it, and that is the whole difference. Five, the SAM invitation: estates hit hardest had handed over unreconciled data in a soft review, which gave the hard audit its discovery phase for nothing.
Three forms of the same question, differing in tone rather than in substance. The SAM engagement: partner led, compliance framed, presented as help, and I want to be fair here because it is genuinely useful work. The point is simply that the data it produces serves both sides equally, which is the fact to keep in view when deciding what to hand over and when. The audit: formal, contractual, and adversarial in structure even when it is entirely civil in tone, looking at the same eight things a SAM engagement looks at, with findings priced at list and stacked into a settlement. And the self assessment: the same reconciliation run by you, on your calendar, with results held internally, and it is the only one of the three where a finding is a task rather than a liability. The buyer side version of software asset management keeps all the rigour of the vendor's version and points it at the bill instead of at the exposure.
The eight findings that drive most settlements, and watch the third column because it is the point of this slide. SQL Server core gaps: cores licensed below the counting rules, which is session twenty two. Windows Server CAL shortfalls, also session twenty two. Microsoft 365 plan mismatches, users on plans that do not cover their use, which is sessions eleven and fifteen. Power BI Premium overuse, capacity consumed beyond entitlement, which is the session twenty four capacity problem. Dev and test misuse, non production licences used in production, and that one is new here and it is common. Hybrid Benefit claimed on lapsed Software Assurance, which is the attestation from session twenty two. Virtualisation mobility breaches, workloads moved outside the movement rules, also session twenty two. And Visio and Project sprawl, assigned widely and used narrowly, which is session thirty three. Six of the eight are reconciliations you already know how to run.
First check. A partner offers a free SAM engagement to help you optimise. What is the first move? A, accept, free analysis is worth having and the findings will be useful. B, decline until your own reconciliation exists, because the same data serves opposite sides and estates that handed over unreconciled data gave the audit its discovery phase for free. C, refuse all SAM engagements permanently. D, accept but limit it to one product family. Pause it. The offer is genuine and the analysis is real work, so as you think, ask yourself who else can use the output once it exists.
The answer is B. The estates hit hardest in the defences reviewed had been through SAM engagements whose data they handed over unreconciled, which converted a soft review into the hard audit's discovery phase at no cost to the other party. And that is not a claim of bad faith by anybody, it is simply a description of how information behaves once it exists in two places. A treats free as cheap, and the analysis genuinely is useful, which is precisely why you want to have run it yourself first. C is an overcorrection that forfeits a real source of technical help, and a permanent blanket refusal tends to read as something worth investigating. D is a sensible instinct in the wrong order, because scoping matters and it comes after your own reconciliation rather than instead of it. Decline politely, run your own, then engage with a position rather than with an open question.
How it starts, five ways the conversation opens. The helpful review: an optimisation offer framed as value, arriving through the partner channel, which is the most common opening and the easiest to accept without thinking about it. The question you cannot answer: a specific query about deployment that reveals somebody has already looked, and answering quickly and incompletely is how a scope gets set by the other side. A merger or major change, because corporate events attract attention since entitlement rarely survives them cleanly, and session thirty nine covers what actually transfers. A lapsed renewal or a dispute, because compliance attention and commercial friction correlate more than anybody says out loud. And the formal notice, the audit clause invoked in writing, by which point the window has already closed for anything not already fixed. Whatever the opening, the response is the same three things: one channel, scope in writing, and your own reconciliation before any data leaves.
Guest analyst The compliance case I think about most often did not start as a compliance case at all. A European financial services group, and they were offered what was described as a licensing optimisation review, at no cost, by a partner they had a good relationship with. Entirely genuine offer, and the partner was not acting in bad faith at any point, which matters to how the story reads. The review needed data, so the customer provided it: deployment inventories, directory exports, server configurations. Nobody reconciled any of it first, because the whole point of the exercise was that somebody else would do the analysis. The review came back with some helpful optimisation suggestions and a handful of areas flagged as needing attention. About fourteen months later a formal audit notice arrived, and the scope of that audit mapped very precisely onto the areas that had been flagged. Now, I have no evidence of anything improper, and I want to be careful about that. What I can say is that the discovery work had already been done, at the customer's expense in effort and at no cost in leverage, and the customer had spent fourteen months not fixing the things they had been told about. The settlement was in the mid seven figures, and I would estimate that most of it was avoidable, because the gaps had been identified with over a year of runway to remediate them at internal prices. The lesson the licence manager took, and I think it is the right one, was not never accept help. It was never hand over data you have not read yourself.
Fourteen months of runway, spent not fixing the things they had been told about. Read your own data first. Second check.
Check two. You discover a genuine licensing gap during your own self assessment. What is it worth to fix it now? A, nothing, a gap is a gap whenever it is found. B, a great deal, because gaps closed before a notice leave the settlement stack entirely and remediate at internal prices rather than at list inside a settlement. C, it is better to wait and see whether anybody asks. D, only worth fixing if an audit looks likely. Pause it, and as you think, ask what the same gap costs as a true up line on your own paper against what it costs as a finding on somebody else's.
The answer is B. A gap you close yourself is a true up line, a reclassification, or a configuration fix, priced at your negotiated rates. The identical gap found by an auditor is a finding, priced at list, stacked with seven others, and settled as a single number. That is why mid market settlements ran one point five to four million dollars with the top quartile above twenty million: the findings stack, and they stack at list rather than at your rate. A ignores the pricing difference, which is the entire economics of this session. C is the position that produces those top quartile outcomes, and I understand how organisations get there, because remediation costs real money today while the risk stays theoretical. D treats audit likelihood as knowable, and the honest answer is that you cannot forecast it reliably, which is exactly why the self assessment runs annually on your calendar rather than in response to a signal.
The ninety day window, three things that only exist before the notice, and preparation timing divided the outcomes in these defences more than the findings themselves did. The right to fix quietly: before a notice, a gap is an internal correction with no counterparty, and after it the same correction is an admission inside a process somebody else is running. Internal pricing: true ups, reclassifications, and configuration fixes cost a fraction of their settlement weight, because a settlement prices at list and a true up prices at your rate. And control of scope and sequence: you choose which reconciliation runs first, how long it takes, and what gets fixed before anything is shared, and none of those choices survive a formal notice. One specific note: the Hybrid Benefit and virtualisation findings are pure paperwork when the records exist, so keeping Software Assurance continuity and mobility evidence current turns two of the eight into a filing exercise.
Negotiating the findings, because an audit is a commercial event and it behaves like one. Dismantle individually: answer each finding on its own facts, because a stack is designed to be settled whole and individual findings are not. Check the method: how was each figure counted and over what period, since counting assumptions drive more value than the rules do. Apply your own evidence: your reconciliations against their assertions, because the same data cuts both ways once you hold it. Separate genuine from disputed: concede what is real, quickly and clearly, because credibility on the real ones is what buys you the disputed ones. And price the remedy rather than the finding: fix forward where fixing is cheaper than settling, because a licence bought is worth more than a penalty paid and you keep the licence. That fourth row is where buyers err in both directions, disputing everything or conceding everything, and both are expensive.
Last check. An audit presents eight findings totalling a large number. How do you respond? A, negotiate the total down as a single settlement figure. B, take each finding separately, check the counting method behind each, concede what is genuine, and dispute the rest on its own facts, because a stack is built to be settled whole. C, dispute all eight to maximise the reduction. D, accept the findings and negotiate payment terms. Pause it, and ask yourself why those findings arrived as a single total rather than as eight separate conversations, because the packaging is a choice.
The answer is B. Findings arrive stacked because a stack is far easier to settle than eight separate arguments, and the total anchors everybody on a discount off a number rather than on whether each component is actually correct. Broken apart, most stacks contain a mixture: some findings are genuine and should be conceded immediately, some rest on counting assumptions that do not survive your own reconciliation, and some are simply wrong. A negotiates the anchor while accepting the structure, which is the session ten error in its most expensive form. C burns the credibility you need on the findings where you are right, and an auditor who catches you disputing something obviously genuine will read every subsequent objection differently and fairly so. D skips the substance entirely and converts a disputed position into a payment plan, which is the worst outcome available because it also concedes the precedent for next time.
The self assessment method, three commitments run annually, and the work is mostly scheduling because the reconciliations already exist elsewhere in this course. One, run the eight on your calendar: an annual self assessment covering all eight findings, with reconciliations held internally and dated, and since six of the eight reuse work from modules three to five the marginal effort is much smaller than it sounds. Two, fix inside the window: remediate at internal prices while there is no notice, using true ups, reclassifications, and configuration fixes, because a gap fixed this quarter is a line item and the same gap next year is a finding. Three, one channel and scope in writing: every compliance approach, however friendly, goes through one named person, with scope agreed in writing and your own reconciliation complete before any data moves. The estates that fared best did exactly this, and none of it required special tooling.
Session thirty one, three sentences. One: a SAM engagement, an audit, and a self assessment ask the same question and differ only in who holds the answer first, and the buyer side version of the discipline points the same rigour at the bill rather than at the exposure. Two: eight findings drive most settlements and six of them are reconciliations this course has already covered, so an annual self assessment is largely a scheduling problem rather than a new capability you have to build. Three: gaps closed before a notice leave the settlement stack and remediate at internal prices, which is why mid market settlements ran one point five to four million dollars for estates that waited, with the top quartile above twenty million. Next session is the other half of this, which is what the vendor can actually see, and what you should be able to see first.
Homework, about an hour, and this week you schedule the self assessment. One, list the eight: write them down against your estate, and mark which ones you have already reconciled in earlier sessions of this course, because that list is usually longer than people expect. Two, find the weakest: which of the eight would you least like an auditor to look at first, because that is where your self assessment starts. Three, check the Software Assurance records, since Hybrid Benefit and mobility findings are paperwork when the evidence exists, and confirm yours does, per session twenty two. Four, name the channel: one person through whom every compliance approach passes, and actually tell the people most likely to receive that first friendly email. Five, diary it annually: a date, an owner, and a fortnight, because the whole control is that it happens on your calendar rather than on somebody else's.
Five reads before next session, all free on redress compliance dot com. First, common Microsoft audit findings, which carries the eight findings, the settlement bands, and remediation inside the window. Second, Microsoft SAM and licence optimisation, on the buyer side version of the discipline pointed at the bill rather than at the exposure. Third, avoiding common compliance pitfalls in SQL Server licensing, which is the single largest of the eight and worth reading properly. Fourth, the audit defence readiness checklist, for what to have in place before any notice arrives. And fifth, common Microsoft licensing mistakes, because most findings begin life as one of those rather than as anything exotic. Next session is what Microsoft can see: admin centre telemetry, assigned against active licences, and building your own evidence before anybody asks you for it. See you there.