Editorial photograph of a data center server aisle representing SQL Server infrastructure
Microsoft Practice

SQL Server audit defense. The buyer side guide.

SQL Server is the single richest source of findings in a Microsoft audit. Per core minimums, virtualization rules, and edition feature use are where the claims are built, and where a prepared buyer protects the most value.

Contact Us Microsoft Practice
500+Enterprise clients
$2B+Under advisory
Industry Recognized
500+ Enterprise Clients
$2B+ Under Advisory
11 Vendor Practices
100% Buyer Side Independent

SQL Server is the single richest source of findings in a Microsoft audit. Per core minimums, virtualization rules, and edition feature use are where the claims are built, and where a prepared buyer protects the most value.

Key takeaways

  • SQL Server is licensed per core with a four core minimum per instance, and core counts are the first place auditors look.
  • Enterprise edition features running on a Standard license is one of the most expensive findings.
  • Virtualization without licensing the full physical host, or without Software Assurance, drives large claims.
  • License Mobility through Software Assurance is what allows licenses to move across servers and into the cloud.
  • Passive failover rights are real but conditional, and the conditions are frequently breached.
  • The defensible position is an entitlement record reconciled to deployment before any review begins.
  • Most SQL Server claims shrink once editions, cores, and Software Assurance status are matched correctly.

SQL Server licensing is complex by design. The per core metric, the edition split, and the virtualization rules combine into a surface where small misreadings become large numbers.

This guide covers the core rules, the virtualization trap, mobility and failover, and the buyer side moves that hold the line in a SQL Server audit.

How does SQL Server core licensing actually work?

SQL Server is licensed per physical core on the server, or per virtual core in a virtual machine, with a minimum of four cores per licensed instance.

Counting cores

You license all physical cores in the server when licensing at the host level. Confirm the current rules against the SQL Server 2022 pricing and licensing page.

Standard versus Enterprise

Standard and Enterprise carry different rights and very different prices. Enterprise unlocks features that Standard does not. Running those features on a Standard license is a finding waiting to happen. See the edition and feature documentation.

The four core minimum

Every licensed instance requires at least four core licenses, even on smaller hardware. The detail sits in the Microsoft Product Terms. Small servers do not reduce below this floor.

Where SQL Server findings come from

Finding Root cause Buyer side fix
Edition mismatchEnterprise features on StandardDisable the feature or true up to Enterprise
Core shortfallPhysical cores exceed licensed coresReconcile cores per host before review
Virtualization gapVM movement without host licensingLicense the cluster or pin with Software Assurance
Failover breachPassive node used activelyConfirm Software Assurance and passive use

Why is virtualization the most dangerous SQL Server trap?

Because virtual machines move, and licensing assumes they do not unless you have the right to move them. That right comes from Software Assurance.

Host level licensing

Licensing all physical cores on a host with Enterprise edition and Software Assurance allows unlimited SQL Server virtual machines on that host. Without it, you license each virtual machine.

License Mobility

License Mobility through Software Assurance lets you move SQL Server licenses across servers more often than every ninety days, and into authorized cloud environments. Without Software Assurance, the ninety day reassignment rule applies.

The cluster problem

A virtual machine that can migrate across an unlicensed cluster exposes every host it could land on. Auditors price the worst case. Pin the workload or license the cluster.

Where the common advice on SQL Server licensing is wrong

The standard advice is to license conservatively at the host with Enterprise edition and Software Assurance everywhere, so you never face a finding. We disagree. In our engagements that approach routinely overlicensed estates by a wide margin, because much of the workload ran fine on Standard or sat on hosts that never needed cluster wide rights. The buyer side move is to map each workload to the edition and mobility right it actually uses, license the host fully only where virtual machines truly roam, and treat blanket Enterprise plus Software Assurance as a decision to justify, not a default.

Database administrators mapping SQL Server instances across a virtualized host cluster on a shared screen
A single migrating virtual machine can put every host in a cluster into scope. Auditors price the worst case, so the cheapest control is often pinning the workload rather than licensing the whole cluster.
40
SQL Server engagements 2024 to 2025
40%
Median claim reduction after reconciliation
50%
Estates with edition mismatch

Source: Redress Compliance advisory engagement file, 2024 to 2025.

SQL Server is where Microsoft audits are won or lost. Reconcile the editions and the cores before anyone else counts them for you.

How do you defend a SQL Server audit position?

You reconcile editions, cores, and Software Assurance status before the review opens, and you separate genuine shortfall from measurement error.

Reconcile editions to features in use

Map every instance to the features it actually runs. Where Standard is sufficient, document it. Where Enterprise features run, decide to disable or true up.

Confirm Software Assurance status

Software Assurance underpins mobility and failover rights. Confirm coverage per license before relying on either. Lapsed coverage removes the right.

Validate passive failover use

Passive secondaries are licensed only when truly passive and backed by Software Assurance. As set out in the failover cluster documentation, a secondary serving reads or reports is active and must be licensed.

Suggested reading

What should a buyer do next?

  1. Inventory every SQL Server instance with its edition, version, and physical or virtual core count.
  2. Map each instance to the features it actually uses and flag any Enterprise feature on a Standard license.
  3. Confirm Software Assurance status for every license that relies on mobility or failover rights.
  4. Identify any virtual machine that can migrate across an unlicensed cluster.
  5. Reconcile licensed cores against deployed cores per host.
  6. Quantify the defensible gap and separate it from measurement error.
  7. Decide where to disable features, pin workloads, or true up before any settlement.
  8. Engage independent SQL Server audit advisory before accepting any finding.

Frequently asked questions

How is SQL Server licensed?

SQL Server is licensed per core, either per physical core when licensing at the host or per virtual core in a virtual machine, with a minimum of four core licenses per instance. Standard and Enterprise editions carry different rights and prices.

What is the most common SQL Server audit finding?

Running Enterprise edition features on a Standard license is the most expensive common finding, followed by core shortfall where physical cores exceed licensed cores. Together they account for the bulk of SQL Server claims in most reviews.

Why is virtualization risky for SQL Server?

Virtual machines can migrate across hosts. Without licensing the full physical host or holding Software Assurance for mobility, a migrating instance can put every host it could land on into scope, and auditors price the worst case.

What does Software Assurance give me for SQL Server?

Software Assurance enables License Mobility, which allows licenses to move across servers more frequently than every ninety days and into authorized clouds. It also underpins passive failover rights. Without it, the ninety day reassignment rule applies and failover rights are limited.

Do I need to license a passive failover server?

Only if it is truly passive and you hold Software Assurance. A secondary that serves reads, reporting, or backups is considered active and must be licensed. Many estates breach this by using the secondary for reporting.

Can SQL Server claims be negotiated?

Yes. The auditor opening figure reflects list price and the widest reading of deployment. Reconciling editions, core counts, and Software Assurance status typically reduces the defensible claim well below the opening number before any commercial discount.

Does the four core minimum apply to small servers?

Yes. Every licensed SQL Server instance requires at least four core licenses regardless of the hardware. Smaller servers do not allow you to license below that floor.

How do I prepare for a SQL Server audit?

Build an entitlement record reconciled to deployment before any review. Inventory editions, versions, and cores, confirm Software Assurance, validate failover use, and identify migrating virtual machines. A prepared position caps exposure and shortens the review.

Microsoft EA Renewal Playbook

The full microsoft ea renewal playbook from the Microsoft Practice.

Microsoft renewal moves, the EA framework, the M365 SKU framework, the Copilot framework, and the buyer side moves across the full Microsoft estate.

Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.

No spam. We will only email you about this download. Privacy.
Run the Microsoft 365 license optimizer against your estate in under five minutes.
Open the Tool →
4
Core Minimum Per Instance
40%
Median Claim Reduction
50%
Estates With Edition Mismatch
90d
Reassignment Rule
100%
Buyer Side

In nearly every Microsoft review we defend, SQL Server is the largest single line in the claim. It is also the line where preparation recovers the most.

Fredrik Filipsson
Co Founder and Group CEO, Redress Compliance