Convert the Microsoft SAM Engagement Into a Defensible Settlement

The Microsoft Software Asset Management engagement carries the same financial exposure as a formal audit, yet the customer who prepares a clean five source baseline settles 60 to 80 percent below the opening finding.

Prepared by Redress Compliance  ·  June 2026  ·  Representative 12,000 seat Microsoft estate scenario (benchmark scenario, not a quote)

A SAM engagement is a Microsoft review of your deployment against your contracted entitlement, delivered through an authorized partner. It is positioned as collaborative, but the financial outcome matches a formal audit when the finding produces a true up payment.

The one real difference is the price book applied to the gap. In a SAM engagement, the shortfall is usually remedied at your ordinary discounted prices.

A formal audit clause can let Microsoft insist on a markup over your normal rate, and on reimbursement of audit costs. That softer price book is the only reason to prefer the SAM route, and it is also why the partner pushes for the broadest scan.

How the engagement is triggered

The trigger is an engagement letter, not a lawsuit. It commonly follows an Azure consumption signal, an EA renewal approaching, an acquisition, a sharp seat change, or a long quiet period since the last review. The customer typically has weeks, not months, to respond.

• Partner delivered: a Microsoft authorized SAM partner runs the data collection, not Microsoft directly.
• Entitlement baseline: the stated output is a deployment baseline the customer can carry into the next renewal.
• Settlement procedure: the partner has no authority over final settlement language. Microsoft does.

Build your own version of the five data sources before the partner does. The customer who controls the deployment record controls the finding. The partner reconciles five inputs against your entitlement, and each one has a known preparation discipline.

Scope the data request in writing

The contract language that limits the partner scan is the cheapest control available. Define the entities, domains, and date range in scope, and exclude affiliates not party to the agreement. A scan that reaches into out of scope entities inflates the finding with deployments you never had to license under this contract.

Five product rules drive most enterprise findings. Each one turns on a metric choice that the SAM scan defaults to the most expensive reading of. Knowing the rule lets you defend the cheaper, compliant reading.

Windows Server: CAL plus External Connector versus User CAL

External access can be licensed two ways. You buy a Client Access License for each external user or device, or one Windows Server External Connector per server that covers unlimited external users. Above a few hundred external users the External Connector is far cheaper, yet the SAM finding often prices external access as per user CALs.

SQL Server: core based versus Server plus CAL

SQL Server Enterprise is core only, with a four core minimum per processor. Standard offers a Server plus CAL option that is cheaper for small, well bounded user populations.

Passive secondary replicas for failover carry use rights only under active Software Assurance, so a partner counting an unlicensed passive node as production is a frequent and reversible finding. The Microsoft Product Terms govern both points.

Microsoft 365, Power Platform, and Visual Studio

• M365 user versus device: assignment defaults to per user, but shared and kiosk scenarios can take device based licensing at lower cost.
• Power Platform per app versus per user: a per app plan covers a defined app set per user, while per user covers unlimited apps. Makers running one or two apps are routinely overpriced on the per user plan.
• Visual Studio subscriptions: licensed per named user with dev and test rights. The finding appears when subscriber software runs in production, or when subscriptions sit assigned to leavers.

Sort every gap into one of three buckets before you negotiate. The annual EA true up captures additions at your contracted price level, while the audit settlement captures residual unlicensed deployment at the settlement rate. Confusing the two pays the settlement rate on additions the true up would have absorbed at the discounted price.

The three bucket sort

1. True up additions: genuine new deployment that belongs in the next anniversary order at the committed discount.
2. Pre engagement remediation: gaps you can close before the engagement closes by reassigning, reclaiming, or removing software.
3. Residual audit findings: the unlicensed deployment that genuinely remains, which is the only thing the settlement should price.

The true up runs at the agreement anniversary and prices additions at your contracted level, not the audit rate. Routing an addition through the true up rather than the settlement is one of the highest value moves in the engagement. Pair this with our Microsoft EA true up complete guide and the true up process detail.

The M365 line reconciles to zero residual because $0.48 million of it routed into the next true up at the contracted price and the rest was proven already entitled. That is the difference between sorting the buckets and accepting one number.

Escalate past the partner at the right moment. The SAM partner has no authority over final settlement language, so the customer who moves the conversation into Microsoft directly inside the timing window reaches a band materially below the partner finding.

When to escalate

The escalation trigger is the gap between the partner finding and your reconciled position, not a calendar date. Once your three bucket sort shows the residual is a fraction of the headline, take that evidence to the Microsoft account team and licensing executive who own the commercial relationship, not the partner who is paid on the finding.

• Timing window: escalate before the partner closes the report, while the number is still moving.
• Account team dynamics: Microsoft wants the renewal and the cloud commitment, which gives the customer leverage the partner does not feel.
• Settlement language: the residual gap, the price book applied, and the cycle reset are all negotiable at the Microsoft level.

Where the common advice on SAM cooperation is wrong

The standard reseller and partner advice is to cooperate fully, hand over the complete deployment scan early, and earn goodwill toward a discount on the residual. We disagree.

The partner is paid against the finding, so the unbounded early scan maximizes the base, and the goodwill discount is then applied to an inflated number. In the engagements behind this paper, customers who scoped the request and remediated first settled far below those who cooperated fully.

The buyer side move is to control the deployment record and the scope, then escalate. Do not trade transparency for a discount on a number you helped inflate.

The opening SAM finding is the partner's revenue target, not your liability. Prove the entitlement, sort the buckets, and escalate before the report closes.

A good settlement protects the next cycle, not just this one. Place clauses that fix the baseline, cap the residual, and reset the audit clock so the same finding cannot be relitigated next year.

Each clause pairs with negotiated language placed inside live Microsoft settlements. The data residency posture and the partner channel allocation are negotiated alongside, so the customer controls who sees the deployment record and how it is stored.

Run audit defense on the same clock as the EA renewal. The deployment baseline you negotiate at settlement becomes the entitlement reference you carry into the renewal, so the two events reinforce each other instead of colliding.

The customer who treats each engagement as a standalone fire fight pays the cycle tax every time. The customer who carries the baseline forward turns the settlement into a renewal asset. That is the difference between defending an audit and managing the Microsoft relationship.