The true up is a self report, and most estates over report by 10 to 20 percent

Microsoft does not count your users; you do. The annual true up order is extracted from your own directory, built by a partner paid on volume, and submitted against a contract with no true down. In the estates we reviewed, the raw count carried 10 to 20 percent of phantom identities: leavers, double counted contractors, and stale devices, all billed as if they worked here.

Prepared by Redress Compliance · August 15, 2026 · Microsoft advisory. 30 to 40 EA true ups reviewed, 2024 to 2026.

• Own the extraction: pull the counts yourself from Entra ID and the device tooling, on your schedule, rather than accepting whatever the partner's collection produces.
• Run the identity cleanup 60 days out: disable leavers, net contractors across tenants, filter service accounts by UPN rules, and document each removal.
• Sweep the device records in the same pass, because SCCM and Intune retain machines that were recycled years ago, and device metered SKUs bill them anyway.
• Submit your documented count, not the partner draft, with the methodology attached, so the order is built from your number and defensible if questioned.
• Never miss the window: the sixty day deadline is real, late orders price at penalty rates, and a rushed order is an uncleaned one.
• Feed the clean count into the renewal baseline, since the true up discipline and the renewal count reset are the same project a year apart.

The most consequential fact about the Microsoft true up is the one buyers find hardest to internalize: there is no auditor. Microsoft does not arrive on site, does not scan your network, does not count anything. The entire annual reconciliation rests on numbers your own systems produce and your own team submits. In any other commercial context, being the sole source of the invoice's inputs would be recognized as an advantage. In the true up, most estates experience it as a liability, because they submit raw directory exports as if they were facts.

A directory is not a fact; it is a sediment. It records every arrival promptly, because arrivals need accounts to work, and it records departures only when someone remembers, because departures need nothing. Contractors get accounts in every tenant they touch and keep them in each. Service accounts accumulate wherever automation was easier with a user object. Device registries retain hardware that went to recycling during a previous agreement. None of this is negligence; it is the natural state of any identity system not actively gardened, and the true up prices the garden, weeds included, at 10 to 20 percent above the real population.

The submission chain then does exactly nothing to correct it, and the incentives explain why. The partner who builds the order earns on its volume and holds no mandate to challenge your inputs. Microsoft's interest in a lower count is zero. Your own IT team, the only party who could shrink the number, experiences the true up as an administrative deadline rather than a purchasing decision. So the inflated count flows through, and the contract's one way ratchet does the rest: no true down means the phantom seats reported this September bill until the term ends, and at the third anniversary they walk straight into the renewal baseline as if they were demand.

Seen this way, the fix is almost embarrassingly cheap. Sixty days before the anniversary, run the cleanup: a script against Entra ID for leavers and stale sign ins, a cross tenant netting for contractors, a UPN rule set for service accounts, a clean sweep of the device registries. Document each removal, extract fresh counts, and have the partner build the order from your number with the methodology attached. In the estates we reviewed this was two to three weeks of mechanical work, it cut the reportable count 10 to 20 percent, and unlike a negotiated discount it repeats every year, because you are the auditor whether you act like one or not.

The stance pairs with the negotiation side of the same event: the true up guide covers the invoice and the first use trap, the renewals brief covers the count reset the clean data feeds, and the wider structure sits in the EA pillar and the Microsoft practice.

Watch the briefing · 4:02The Microsoft EA Preparation Playbook: The Work That Wins the RenewalThe directory discipline, the baseline, and the preparation that decides the order before it is built.

Across the 30 to 40 Enterprise Agreement true ups reviewed, the inflation was consistent enough to treat as a planning number:

The pattern behind the numbers: in roughly 30 of the 40 reviews, nobody had cleaned the directory before the order, the partner draft went through unchallenged, and the inflation compounded at every anniversary because the ratchet never let it back out.

The buyer side move is to run the audit no one else will. The wider library sits in the Microsoft practice.

What is the Microsoft EA true up?

The annual self reported order that captures the increase in licensed users and devices over the prior year on an Enterprise Agreement. It covers on prem desktop bundles, server licenses, and legacy SKUs still on the EA; cloud subscriptions like M365 E3 and E5 reconcile monthly instead. It is not an audit: you extract the counts, and you submit the order.

Is there a true down?

No. License counts only increase across the EA term, even if usage falls to zero. Every user or device you report is paid for until the renewal, which is why the accuracy of the self reported count matters more than any discount attached to it.

When is the true up order due?

Roughly sixty days from each EA anniversary, with the third anniversary closing into the renewal cycle. Late submissions trigger penalty pricing and partner escalation, so the cleanup work has to happen in the 30 to 60 days before the window, not inside it.

Where does true up over reporting come from?

Phantom identities. Leavers still active in Entra ID inflated seat counts 5 to 15 percent on the median estate, contractors holding accounts in two tenants were billed twice on 3 to 8 percent of seats, shadow service accounts added 2 to 5 percent, and stale device records in SCCM or Intune added 5 to 10 percent to device metered SKUs.

Why does the partner draft over count?

Not malice, incentives. The LSP builds the order from the raw counts you hand over, earns on the volume, and has no mandate to challenge inflation. Nobody in the submission chain is paid to make the number smaller, which is why the independent cleanup has to happen on your side, before the counts leave the building.

How much does a pre true up cleanup save?

In the 30 to 40 true ups we reviewed, an independent identity and device cleanup cut the reportable count by 10 to 20 percent. The work is mechanical: disable leavers, net contractors across tenants, filter service accounts, and sweep stale device records, all in the 60 days before the anniversary.

Should we submit the partner's draft order?

Submit your own documented count instead. Run the cleanup, extract fresh counts from Entra ID and your device management tooling, document the methodology, and have the partner build the order from that. The true up is a self report you control; the draft is a convenience that prices against you.