Microsoft SAM & Licence Optimisation

This guide is part of the Microsoft Licensing Knowledge Hub. Related guides include True-Up Best Practices, Microsoft Audits: CIO's Playbook, EA Renewal Preparation Toolkit, and M365 Licence Optimisation.

Microsoft's licensing estate is arguably the most complex in enterprise IT. It spans Enterprise Agreements (EAs), CSP subscriptions, OEM bundles, Open Value, SPLA, and Azure consumption. Without structured Software Asset Management, organisations face three compounding risks that erode budgets, weaken negotiating positions, and expose the business to compliance demands.

Compliance exposure. Microsoft conducts SAM engagements and formal audits that can result in multi-million-dollar true-up demands. Without accurate data, organisations have no credible defence and no negotiating position. Microsoft's audit teams use sophisticated tooling to identify deployment gaps. An organisation that cannot produce a verified Effective Licence Position (ELP) when confronted with audit findings is at the mercy of Microsoft's methodology and numbers. See our Microsoft Audit Defence Service.

Overspend and shelfware. Studies consistently show that 15 to 30% of Microsoft licences go unused or underused. E5 suites purchased for users who only need E3 features. SQL Server Enterprise on workloads that only require Standard. Azure reservations that go unmatched. Power BI Pro licences for users who never log in. Each represents hidden waste that compounds every month.

Weak negotiation position. Every EA renewal and CSP renegotiation is a commercial event. Without a verified ELP, your team is negotiating blind. You accept Microsoft's bill of materials (BOM) rather than presenting your own data-driven counter-proposal. Microsoft's account team controls the narrative, the data, and the pricing. See our EA Negotiation Strategies for CIOs.

Stakeholders and governance. Effective SAM requires cross-functional sponsorship. IT Asset Management (ITAM) owns the tooling and data, but Finance controls the budget, Procurement signs the contracts, Legal interprets the terms, and IT Operations deploys and decommissions. Without a governance board that includes all four functions, optimisation recommendations stall in committee. Assign executive sponsorship (CIO or CFO) to break deadlocks and ensure SAM findings translate into action.

SAM Maturity Stages

Most organisations operate at Stage 1 or 2. The goal is to reach Stage 3 within the first 12 months and sustain it through continuous governance. Stage 4 is achievable for organisations that integrate SAM data into financial planning, procurement workflows, and vendor management strategy.

Building the Baseline: The 90-Day Sprint

The first deliverable of any new SAM programme is an Effective Licence Position (ELP). This is a verified reconciliation of what you own versus what you have deployed. It typically takes 60 to 90 days and follows a structured workflow: deploy discovery tools, collect entitlement data from all channels, normalise and reconcile the two datasets, identify gaps (under-licensed) and surplus (over-licensed), and produce an actionable ELP report. This ELP becomes the foundation for every optimisation, negotiation, and compliance activity that follows.

A complete Microsoft SAM discovery must capture four layers of data. Missing any one of these layers creates blind spots that undermine the entire ELP.

Hardware and infrastructure. Physical servers (core counts, processor types), virtual hosts and VM mappings, cloud subscriptions (Azure, AWS, GCP), and container environments. This layer is critical for server-based licensing (Windows Server, SQL Server) where physical host characteristics determine licence requirements. A server with 2 x 12-core processors requires a different licence count than a server with 1 x 8-core processor. Without accurate hardware data, core licensing calculations are guesswork. See our Licensing Metrics: Cores, Users, Devices guide.

Software installations. Every Microsoft product installed, including versions, editions, and features enabled. Pay particular attention to SQL Server features (Always On Availability Groups, In-Memory OLTP, Transparent Data Encryption) that may indicate Enterprise edition requirements. Also capture Office/M365 installations on shared devices, VDI environments, and Remote Desktop Services (RDS) hosts, all of which have specific licensing rules that differ from standard desktop deployment.

User and device assignments. Active Directory users, M365 licence assignments in Entra ID (formerly Azure AD), and device registrations. Cross-reference assigned licences against actual sign-in activity to identify dormant accounts. Users who have not signed in for 90+ days are candidates for licence recovery. Contractors, temporary workers, and external collaborators who access Microsoft 365 resources also require appropriate licensing.

Cloud consumption. Azure subscriptions, resource groups, and consumption data. Azure Hybrid Benefit (AHB) usage, reserved instance utilisation, and Azure Arc-managed servers for hybrid licensing scenarios. Track which Azure VMs have AHB applied and which do not. Every unmatched VM represents a missed savings opportunity. See Negotiating Azure Commitments in Your EA.

Discovery Tools

Gathering what you own is often harder than discovering what you have deployed. Microsoft entitlements are spread across multiple channels, each with different documentation formats, access portals, and retention rules.

Enterprise Agreement (VLSC). The Volume Licensing Service Centre holds your EA entitlements, but it is notoriously difficult to navigate. Export licence summaries and cross-reference against your renewal proposals. Watch for true-up additions that may not appear on your original order. VLSC is being replaced by the Microsoft 365 admin centre for licence management, but historical entitlements may still require VLSC access.

CSP / NCE subscriptions. Cloud Solution Provider subscriptions are managed through your reseller's portal or the Microsoft Partner Centre. Ensure you have direct access to subscription details, not just invoices. Annual versus monthly commitment terms affect cancellation flexibility. Track which subscriptions are annual (locked for 12 months) versus monthly (cancellable at any time).

OEM and pre-installed. Windows and Office licences that came with hardware. These are tied to the device, not transferable, and often overlooked in reconciliation. This leads organisations to buy volume licences for machines that already have valid OEM entitlements. For a 1,000-device refresh, failing to account for OEM Windows licences could mean purchasing 1,000 unnecessary volume licences.

Software Assurance. SA grants upgrade rights, licence mobility, and Azure Hybrid Benefit among other benefits. Track SA expiry dates carefully. Lapsed SA means you lose version upgrade rights and are frozen on the version installed at the time SA expired. You also lose AHB eligibility, which can significantly increase Azure compute costs.

The ELP Reconciliation

The ELP compares entitlements against deployments to produce a position for each Microsoft product family. The output is a matrix showing surplus (over-licensed, recovery opportunity) or shortfall (under-licensed, compliance risk) for every product and metric.

Once the ELP is built, it reveals specific optimisation opportunities across the Microsoft estate. These are the strategies that consistently deliver the largest savings.

M365 suite right-sizing. The most common source of Microsoft overspend is E5 licences assigned to users who only need E3 features. E5 includes advanced security (Defender for Endpoint P2), compliance (eDiscovery Premium), and telephony (Teams Phone). Most users never activate these capabilities. Downgrading surplus E5 users to E3 and adding targeted add-ons only where genuinely needed can save $20 to $40 per user per month. For a 5,000-user organisation with 2,000 unnecessary E5 assignments, the annual savings range from $480K to $960K. See our M365 E3 vs E5 vs F3 Comparison.

Inactive licence recovery. Run sign-in activity reports from the M365 Admin Centre. Users who have not signed in for 90+ days should be reviewed for licence removal or reassignment. Common causes include departed employees whose accounts were disabled but whose licences were never reclaimed, service accounts incorrectly assigned user licences, and shared mailboxes that do not require full licences. Ghost licences typically represent 5 to 10% of the user population. At E3 pricing ($36/user/month), 500 ghost licences cost $216K per year in pure waste.

Server licence consolidation. For SQL Server and Windows Server, the optimisation lever is matching edition to workload. SQL Server Standard at approximately $3,945 per 2-core pack versus Enterprise at approximately $15,123 per 2-core pack means a single unnecessary Enterprise deployment on a 16-core host costs an extra $89K or more. Review every Enterprise instance for features that actually require that edition. Always On Availability Groups, In-Memory OLTP, and TDE are Enterprise-only features. If the workload does not use any of these, Standard is sufficient and costs 3 to 4 times less per core. See our SQL Server Licensing Guide.

Azure Hybrid Benefit and Reserved Instances. Organisations with SA-covered Windows Server and SQL Server licences can apply Azure Hybrid Benefit for 40 to 50% savings on Azure VM compute costs. Committing to 1-year or 3-year Reserved Instances delivers another 30 to 60% versus pay-as-you-go. Combined, AHB plus RI can cut Azure compute costs by 60 to 75%. Track utilisation monthly to ensure coverage does not lapse and that every eligible VM has AHB applied. See Negotiating Azure Commitments.

EA BOM optimisation. Before every EA renewal, rebuild the Bill of Materials from scratch using your ELP data. Never accept Microsoft's renewal BOM at face value. Common BOM optimisation tactics include removing products no longer in use, converting per-device to per-user (or vice versa) based on current usage ratios, leveraging step-up licences instead of full new purchases, and negotiating volume-based tier discounts using consolidated quantities. The verified BOM becomes your negotiation anchor, replacing Microsoft's narrative with your own data.

Microsoft uses two primary mechanisms to verify compliance. Understanding the distinction between them is critical for managing risk and controlling the process.

SAM engagements are positioned as "helpful" reviews, often conducted by third-party SAM partners (such as Deloitte or a regional SAM firm). Microsoft frames these as a free service to help you understand your licensing position. In reality, the findings feed directly into Microsoft's commercial strategy. The SAM partner produces an ELP report that identifies shortfalls, and Microsoft uses those findings to push licence purchases at renewal. SAM engagements are technically voluntary, but declining may escalate to a formal audit.

Formal audits are triggered by contractual audit rights in your EA or Open agreement. These are conducted by independent auditors (Deloitte, EY, or similar firms) and result in compliance findings with financial settlements. Formal audits are contractually required, and non-cooperation can trigger breach provisions.

SAM Engagement vs Formal Audit

Audit Defence Best Practices

Maintain a current ELP. If your ELP is less than 6 months old and verified by an independent party, you can present it as your compliance position. This reduces the auditor's ability to impose their own methodology and numbers. A current ELP is the single best audit defence tool.

Challenge the methodology. Auditors often overcount by including inactive installations, test environments, development servers, or incorrectly categorised editions. Line-by-line review of the auditor's findings frequently reduces claims by 40 to 60%. Never accept the first set of findings without detailed scrutiny.

Separate audit from renewal. Microsoft may link audit findings to a "discounted" renewal offer. This conflates compliance resolution with commercial negotiation. These are two separate conversations that should be handled independently. Combining them always favours Microsoft because the urgency of resolving compliance findings weakens your negotiating position on commercial terms.

Engage independent advisors. An independent licensing advisor brings audit experience, benchmarking data, and negotiation leverage that internal teams typically lack. Independent advisors routinely reduce audit claims by 50 to 80% through methodical review of the auditor's assumptions, counting rules, and product classifications. See our Microsoft Audits: CIO's Playbook.

SAM is not a one-time project. It is an ongoing discipline. Without continuous governance, the ELP degrades within 3 to 6 months as new hires, departures, server deployments, and cloud consumption shift the landscape. The organisations that achieve Stage 3 and Stage 4 SAM maturity are the ones that embed licence management into operational cadences.

Quarterly SAM Cadence

Change control and approval gates. Implement approval workflows for any action that creates a new Microsoft licensing obligation. New server deployments (especially SQL Server Enterprise), Azure subscription creation, M365 licence upgrades (E3 to E5), VDI or RDS deployments, and Power Platform premium connector usage all create licensing obligations that may not be immediately visible. Without gates, shadow IT and well-intentioned deployments create compliance gaps that only surface during audits.

Reporting and KPIs. Track key metrics that demonstrate SAM programme value: licence utilisation rate (percentage of assigned licences actively used), cost per user for M365, shelfware percentage (licences assigned but unused for 90+ days), Azure Hybrid Benefit coverage (percentage of eligible VMs with AHB applied), and days-to-audit-readiness (how current is the ELP). Report these quarterly to the governance board and annually to the CFO to maintain executive sponsorship and justify continued SAM investment.

The following recommendations represent the cumulative best practices from hundreds of Microsoft SAM engagements across enterprise clients.

1. Start with the ELP. Before any renewal, right-sizing initiative, or audit response, build a verified Effective Licence Position. This is the foundation of every downstream decision. Allow 60 to 90 days for the initial build. Without an ELP, every other optimisation activity is based on incomplete data. See our Microsoft Licensing Usage Review Template.

2. Right-size M365 suites. Audit E5 assignments against actual feature usage. Downgrade to E3 plus targeted add-ons where appropriate. This single action frequently saves $500K to $2M annually for organisations with 5,000+ users. The savings are immediate, recurring, and require no infrastructure changes.

3. Match server edition to workload. Review every SQL Server Enterprise and Windows Server Datacenter deployment. If the workload does not use edition-specific features, downgrade to Standard. The per-core cost difference is 3 to 4 times and compounds across every host. A single 16-core server downgraded from SQL Enterprise to Standard saves $89K or more.

4. Maximise Azure Hybrid Benefit. Apply AHB to every eligible Azure VM. Combine with Reserved Instances for 60 to 75% savings versus pay-as-you-go. Track utilisation monthly to ensure coverage does not lapse. Every VM running without AHB when eligible SA-covered licences are available represents a direct and avoidable cost.

5. Rebuild the BOM before every renewal. Never accept Microsoft's renewal BOM at face value. Rebuild it from your ELP data, remove shelfware, convert metrics where beneficial, and use the verified position as your negotiation anchor. The BOM you build from your own data will consistently show a lower cost than the BOM Microsoft presents.

6. Separate audit from commercial. If Microsoft combines an audit finding with a renewal offer, insist on resolving compliance separately from commercial terms. Conflating the two always favours Microsoft. Compliance is about bringing your environment into alignment with existing agreements. Commercial terms are about what you will pay going forward. Mixing them creates leverage Microsoft should not have.

7. Implement change control. Require approval gates for any deployment that creates a new Microsoft licensing obligation. SQL Server Enterprise deployments, E5 upgrades, new Azure subscriptions, VDI/RDS, and Power Platform premium connector usage should all require sign-off from the SAM team before implementation. This prevents compliance drift between reconciliation cycles.

8. Engage independent expertise. Microsoft licensing complexity exceeds what most internal teams can manage alone. An independent advisor brings benchmarking data from hundreds of engagements, audit defence experience, and negotiation leverage that delivers 5 to 10 times ROI on advisory fees. The advisor's independence means every recommendation serves your cost position, not Microsoft's revenue targets.

Microsoft licensing is one of the few areas where an independent advisor consistently delivers returns that far exceed the advisory investment. The complexity, the pace of product and licensing changes, and Microsoft's commercial incentives create an information asymmetry that favours Microsoft in every interaction. Independent advisory closes that gap.

ELP and compliance assessment. Redress Compliance builds verified Effective Licence Positions that cover the full Microsoft estate: M365 subscriptions, server products (SQL Server, Windows Server), Azure consumption, Dynamics 365, Power Platform, and all ancillary products. Our ELP methodology identifies both compliance gaps and optimisation opportunities, producing a single document that serves as audit defence, renewal anchor, and optimisation roadmap.

Right-sizing and cost reduction. We analyse feature usage data across the M365 suite, server editions, Power Platform licensing tiers, and Azure consumption to identify every instance of over-licensing and mismatched metrics. Typical engagements identify 15 to 30% cost reduction opportunities that are immediately actionable.

EA renewal negotiation. We negotiate EA renewals using your verified ELP as the foundation. Our benchmarking data from hundreds of enterprise engagements provides market-rate pricing references that Microsoft's account team knows we possess. This knowledge changes the negotiation dynamic fundamentally. See our Microsoft Contract Negotiation Service.

Audit defence. When Microsoft initiates a SAM engagement or formal audit, we manage the process from initial response through final resolution. Our audit defence methodology includes scope management, methodology challenge, line-by-line finding review, and settlement negotiation. Independent advisors routinely reduce audit claims by 50 to 80%. See our Microsoft Audit Defence Service.

"A well-run SAM programme does not just reduce cost. It changes the power dynamic in every interaction with Microsoft. When you know exactly what you own, what you have deployed, and what you need, Microsoft's account team can no longer control the narrative. The ELP puts you in charge of the conversation."

Related Resources