Microsoft license audits, from letter to settlement. How to cut the finding before you pay it.

A Microsoft audit finding is an opening bid, calculated from the data you provide. Agree the scope, reconcile your own position first and answer with documented positions, and the settled figure usually lands well below the first one.

How does a Microsoft license audit arrive?

A Microsoft license review arrives in one of three forms: a formal audit letter, a partner led SAM engagement, or a softer license effectiveness assessment. They differ in tone and in how much choice you appear to have. Each ends in a reconciliation of what you run against what you own, and the result reaches Microsoft whichever form it takes.

The response is the same in every case: agree the scope in writing, run your own reconciliation, and answer with documented positions. Skip those steps and the auditor builds the reconciliation from your data instead.

What does the verification clause let Microsoft do?

Your agreement sets the rules, so read the version you signed before you reply to anything. In the Microsoft Customer Agreement, Microsoft may verify compliance at any time on 30 days' notice, either through an independent auditor bound by nondisclosure or by asking you to complete a self audit.

• Information duty. You must promptly provide the information and documents Microsoft or the auditor reasonably requests in connection with the verification. Recent MCA versions grant visual access to systems running the products, which is less than handing over credentials or running the auditor's tools unsupervised. The word "reasonably" gives you grounds to hold requests to an agreed scope.
• Remedy. Verification is at Microsoft's expense. If the review finds unlicensed use, you have 30 days to order licenses covering the period of that use.
• The threshold. If unlicensed use is 5 percent or more of your total use of all products, you also reimburse Microsoft's verification costs and buy the missing licenses at 125 percent of your then current price.

That threshold raises the value of every correction you win. Enterprise Agreement and MBSA wording is similar, though details vary by version. Our note on bounding the audit clause covers the terms worth changing at your next renewal.

Is a SAM engagement an audit?

Contractually, no. A partner led SAM engagement is offered as a voluntary service at no charge, and you can decline it or set its terms. In practice the partner's output, usually an effective license position, goes to Microsoft, and a declined or stalled engagement can be followed by a formal letter.

Treat the invitation as the start of a review. Agree scope, data format and who receives the output before the first script runs. Our guide to SAM engagement preparation covers the partner side in more detail.

Why is the opening audit finding usually too high?

The opening figure is built from your data by the party whose job is to resolve every ambiguity upward. Stripped to its mechanics, a Microsoft audit is one subtraction: deployments minus entitlements equals exposure. Microsoft brings neither number to the table, so in a precise sense you co author the finding.

That is why cooperating by volume costs so much. Send every export, console dump and user list, and duplicate accounts become users, test systems become production deployments, and gaps in the export become findings.

Every one of these corrections exists before the opening figure does. Whichever side does the reconciliation first decides which version of the count everyone argues about. Our list of common Microsoft audit findings goes product by product.

Double counted users

User counts come from several directories that rarely agree. One employee can hold an on premises Active Directory account, an Entra ID identity, a test login and a mailbox left over from an acquired company. Reconcile to people first: HR headcount, then licensed identities, then every exception you can explain, such as service, shared, disabled and leaver accounts.

Entitlements you already own

Claim every entitlement before you dispute any deployment. Owned licenses missing from the reconciliation are the fastest corrections in the process, because they need proof of purchase and no argument.

Look past the current agreement. Perpetual licenses from expired Select or Enterprise agreements, licenses bought by companies you acquired, OEM Windows Server on physical hosts and test use covered by Visual Studio subscriptions are all commonly missed.

The wrong metric on servers

Server products are where metric errors cost the most. The rules below come from Microsoft's own licensing guidance, and each one is a frequent point of dispute.

• Windows Server minimums. Every server needs at least 16 core licenses, with at least 8 per physical processor. Standard covers 2 virtual machines per fully licensed host, and Datacenter covers unlimited virtual machines.
• SQL Server per core. At least 4 core licenses per physical processor, or 4 per virtual machine when you license by VM. Licensing individual VMs requires Software Assurance or subscription licenses.
• License reassignment. Without Software Assurance or subscription licenses, SQL Server licenses stay on a server for at least 90 days. Auditors then argue that every host a VM can move to must be licensed.
• Non production instances. Developer edition is licensed for development, testing and demonstration only. Test instances on Developer edition, or used by Visual Studio subscribers, come out of the production count.

Auditors also count passive failover replicas at times. With Software Assurance or subscription licenses, each licensed instance may run one passive replica for high availability and one for disaster recovery at no extra cost. Our guide to SQL Server audit defense covers the database cases.

How do you run a Microsoft self audit before the letter arrives?

Reconcile what you run against what you own before Microsoft formalizes anything, and close the gaps while you control the timing. Across the reviews we advised, a self audit run before engagement cut the eventual finding by 20 to 40 percent. It also gives you a stated position to set against the auditor's number.

Where your entitlement records live

• Microsoft 365 admin center. Go to Billing, Your products, select the Volume licensing tab, then View contracts. Select the license IDs and choose Create License Summary, or pick View license summary from the More actions menu. It groups entitlements by product family and version across Open, Select, Select Plus and Enterprise agreements, and View orders on the same menu shows each order.
• Cloud subscriptions. The Your products page and your CSP partner's invoices for Microsoft 365, Dynamics 365 and Azure.
• Everything outside volume licensing. OEM purchase records for servers, retail licenses, and the contracts and invoices of every company you acquired.

Where your deployment data lives

• Clients and servers. Microsoft Configuration Manager hardware and software inventory.
• Virtual hosts. vCenter or Hyper-V inventories, showing physical cores per host and which VMs can run where.
• Databases. SERVERPROPERTY('Edition') and SERVERPROPERTY('ProductVersion') on each SQL Server instance report the installed edition and version.
• Users. Microsoft 365 admin center usage reports and Entra ID sign in activity, set against assigned licenses.

Put the result together as an effective license position per product: entitlements, deployments, the difference, and a note on every assumption. Close what you can by buying, reassigning or uninstalling before any letter arrives. The annual true up is the natural moment to refresh it.

How should you respond once the Microsoft review starts?

Agree the scope in writing before any data leaves your hands, and hold every later request against it. Scope creep turns directly into finding creep.

What to put in writing before any data leaves

• Products and entities. Name the products and affiliates in scope. Anything unnamed stays out.
• Measurement date. One date for deployments and entitlements, so the count does not drift during a review that runs for months.
• Data method. Your team runs any scripts and reviews the output before it is sent, with no direct system access unless you agree to it.
• Timeline. Dates for data delivery, the draft report and your written response to it.
• Use of the data. Used only to verify compliance for the agreed scope, in line with the confidentiality terms of the clause.

Handing over everything to show good faith is the wrong instinct

The common advice is to be fully transparent: send every export Microsoft asks for and trust the process to be fair. We disagree, because the auditor's scripts count installations and accounts, and every record you cannot explain on the spot is scored as a license owed.

Once a raw export sits in the auditor's working file, you spend the rest of the review explaining it line by line. Good faith means meeting the clause on time with reconciled, documented positions for the agreed scope. Answer every request that way, and correct double counts and wrong metrics line by line against the contract language.

What the auditor or account team will say, and what to say back

• "We need the full inventory export to get started." We will provide deployment data for the agreed products and entities, in the agreed format, by the agreed date.
• "The tool output is the authoritative count." The tool counts installations and accounts, while the contract defines what needs a license. We will reconcile the two item by item.
• "Development and test servers are in scope." They are in scope for review. Here are the Visual Studio subscriptions and Developer edition instances that cover them.
• "This needs to close by the end of the quarter." We will close when the reconciliation is agreed, and we are open to timing that suits Microsoft once the number is right.

Against a stated position, the auditor's number is a competing claim to be argued line by line. Against silence, it is the only number in the room.

Should a Microsoft audit settle in cash or a commitment?

Price both routes before you choose. Where your plans support it, the commitment route usually costs less: settlements steered toward a forward looking cloud commitment landed 30 to 50 percent below the cash demand in the reviews we advised.

The auditors produce a cash figure, but Microsoft's business runs on cloud growth. A commitment serves that model in a way a compliance payment never will, and the account team knows it. The strongest closing position belongs to a company that has already decided what it wants to buy next.

A worked example

Say a hypothetical company receives an opening finding of $2,000,000. The table shows the figure as each correction lands, followed by the commitment route at the midpoint of the range above.

The corrections alone take the figure down by 40 percent, and they can also move unlicensed use below the 5 percent threshold. That matters: if the $1,200,000 finding stayed above it, the 125 percent price would add $300,000, plus Microsoft's verification costs.

The commitment row is a saving only because the cloud spend was already in the budget. Commit to spend you did not plan and the discount is gone.

What to get into the settlement agreement

• A release. Written confirmation that the settlement resolves compliance for the products, entities and period reviewed.
• A commitment tied to real plans. Cloud spend you would have bought anyway, such as a Microsoft 365 upgrade or an Azure migration already on the roadmap.
• Your agreement price. Licenses bought to close the finding priced at your current discount, with the uplift waived.
• Order timing. The 30 day order window running from the signed settlement date.

What have we seen in Microsoft audits in 2024 and 2025?

Across roughly 30 to 45 Microsoft compliance reviews we advised between 2024 and 2025, the opening exposure figure and the settled figure were rarely close. Findings commonly fell 20 to 50 percent between the two. Microsoft did not concede those amounts; the corrections came from reconciliation work the buyer could have done first.

Three patterns recurred:

• Raw data floods. Buyers sent everything, and their own ambiguity paid for the finding.
• No entitlement register. The register did not exist when the letter arrived, so owned licenses went unclaimed for weeks while the auditor's figure stood.
• Settlements run as compliance events. Buyers negotiated a penalty with the audit team instead of treating the close as the commercial transaction it is, with the account team and the next purchase on the table.

The buyers who did best owned both numbers in the subtraction, deployments and entitlements, before the auditors built them. The wider Microsoft library sits in our Microsoft knowledge hub.

How do you stay ready for the next Microsoft audit?

Fix the gaps the review exposed and keep the reconciliation running as a standing document. A company that can state its license position on one page is a poor audit target, because the economics of the exercise depend on ambiguity it no longer offers. Refresh the position at each true up, after each acquisition and before each renewal.

The next renewal is also where you can narrow the audit clause and add price protections. Our Microsoft Enterprise Agreement guide covers that negotiation.

What to do next

1. Now, before any letter. Run the self audit: deployments reconciled against entitlements, with gaps closed while they are still yours to close.
2. Build the entitlement register. Make every owned license claimable on day one, including acquired, OEM and older agreement licenses.
3. When the letter or invitation arrives. Read your verification clause, then agree scope, measurement date and data method in writing before you send anything, whatever form the review takes.
4. During data collection. Run the scripts yourself and send reconciled positions with the evidence behind them.
5. At the draft report. Respond item by item, claim entitlements first, and check where the corrected figure sits against the threshold.
6. At settlement. Price the cash route against the commitment route and get a written release. Our Microsoft advisory practice runs the defense with you.

Frequently asked questions