Microsoft License Audit: A Checklist for Companies

An audit letter from Microsoft rarely arrives at a convenient moment. The company usually has a few weeks to respond, a server list that is only partly up to date, and purchase records scattered across several departments. Not all companies that pass through an audit without incident are the same as those with spotless licensing. It's them who can demonstrate what they run, what they purchased, and why the two are the same.

To sum up, a Microsoft license audit involves the analysis of the number of licenses that are deployed in your company against the number of licenses that you can use. It may begin as a friendly review and evolve into a formal check performed by a separate auditor. Accurate inventory, proof of purchase, and a clear number of users, devices, and processor cores are the best preparation.

These Four Points should be taken into consideration

• An audit compares the deployment with entitlement, and gaps are typically addressed through licensing for missing entitlements.

• It is up to your own contract to determine these things: The notice period, scope, and who will cover the audit. Read it first.

• Common places are CAL counts, server cores, virtual machines, and systems that nobody is responsible for.

• An annual self-review is much less expensive than a quick answer to a letter.

What is a Microsoft License Audit?

A software audit, also known as a Microsoft license audit, is an examination of the use of Microsoft products by a company. The reviewer wishes to verify that all installed and used products have a valid license. Microsoft explains its general rules on its licensing site, but the binding terms are in your agreement and in the product terms that apply to that agreement.

There are two types of audits. The first type is generally referred to as a Software Asset Management (SAM) engagement: you go through your software assets with the reviewer. The formal one is conducted under a clause in your contract, typically with an independent auditor, and goes through a pre-established process. The second form is much more stringent, and even if the tone is friendly, it should be given a close read. 

Why Companies Get Audited?

Nobody outside Microsoft knows the exact trigger for a given company. The reasons people commonly cite include a wide gap between purchases and deployment, Enterprise Agreement (EA) renewal, a corporate structural change, a merger, a move to the cloud, and a long stretch without any true-up. An audit does not prove wrongdoing. Plenty of reviews end with a short list of corrections and nothing more.

How a Microsoft Audit Works

Details vary by agreement, so read this table as a map and not as a contract.

Many volume agreements allow verification only after advance notice, often given as a number of days. Look up the exact period in your own contract, because it sets the pace for everything else.

What Auditors Look At

The counting rules and the version rule for CALs take up a lot of space on their own. Our pillar guide on Microsoft CALs covers them in full, so this article stays brief on that topic.

The 10-Point Preparation Checklist

1. Read your agreements. Find the audit clause, the notice period, the scope, and the cost rules.

2. Name one owner. IT, procurement, and legal all hold part of the picture, and someone has to pull it together.

3. Build an inventory. List servers, versions, editions, cores, and virtual machines. Include test and backup systems, which people tend to forget.

4. Collect proof of purchase. Put invoices, license keys, and agreement numbers in one folder.

5. Count users and devices. Keep employees, contractors and external users apart.

6. Match CALs to servers. Check type, quantity, and version against every server.

7. Check Remote Desktop access. Every remote connection needs coverage from RDS CALs.

8. Review cloud and subscription plans. Remove unused assignments and confirm what each person really needs.

9. Look for unmanaged systems. Shadow IT, old servers, and departmental purchases belong on the list.

10. Write it down. Record the gaps, the decisions, and the date of each review.

Give step nine more time than the others. Hidden systems cause more surprises than any wrong count, and our post on shadow IT and unmanaged tools explains how they pile up.

Common Gaps and How to Close Them

CAL mismatches

Imagine the company is running an older version of Windows Server and has not migrated to the newer version, but retained its own CALs. Alarms went off, but no one heard them since it was all working fine. If an older CAL is in use, it will not cover access to a newer server; this is a critical gap that is almost always uncovered during an audit review. If you're migrating, here's an introduction to Windows Server 2022, and if you need to check versions, check them for CAL.

Core counts

Windows Server is licensed per processor core. The number you require can vary depending on new hardware, additional processors, or virtual machines that switch hosts. 

Remote access

Home office and contractors push Remote Desktop use up quickly. Each connecting user or device needs coverage, so review access after any change in how people work. Our article on home office for IT teams shows how these setups drift over time.

Outsiders

Customers, suppliers, and partners are not employees. They need their own coverage or an External Connector.

Thin records

Correct licensing still fails an audit if you can’t prove it. Keep purchase records in one searchable place, not in the mailboxes of people who may leave.

What Can a License Audit Cost?

There is no fixed price. When a review finds a shortfall, the usual remedy is to buy the missing licenses. There are also agreements that shift the burden of the audit to the customer if the discrepancy is above a certain percentage, typically five percent. Whether or not this applies to you will depend on your contract, so ask your legal team. Generally speaking, you will spend less money to acquire the right licenses early as part of a plan you have control over than to settle under pressure. Shop channels and terms before a commitment and beware of list prices.

Self-Review or external help?

Self-review is suitable for a small environment where records are easily available. There are many times when it makes sense to bring in outside experts, when you have lots of servers, multiple contracts, both cloud and on-premises, or a formal audit letter on top of the desk. An advisor can organize the information, question the results, and recommend settlement alternatives. The inventory can be automated using software asset management tools.

As background, please read the USU software audit guide and the Redress Compliance audit overview from a guidance perspective. Read them as "guidance" and not "legal advice".

Related Guides in This Cluster

• Microsoft CALs: the pillar guide on counting rules, the version rule, and costs.

• Windows Server 2022: Background of the server platform.

• IT consulting for B2B companies: How external guidance plays into IT planning.

• IT support trends: Support and licensing converge. 

Conclusion

Once you have an inventory, a proof of purchase, and an owner, an audit becomes manageable. The harder-to-do companies begin collecting data after they receive the letter. Revisit the environment annually, close CAL and core gaps early, and maintain records in one location. This article provides general information and is not legal advice; if an audit is announced, have a qualified legal professional review your agreement.

TechNow reviews server environments and license positions before an audit begins. Learn more about our IT consulting and IT support services.

FAQs

What exactly is a Microsoft license audit?

A review that contrasts the Microsoft products you use with the Microsoft licenses you have. This may be an informal check or a formal check by an independent auditor.

What is the time when I need to answer the audit notification?

This depends entirely on your specific agreement. Many contracts specify a strict notice period (e.g., 30 days). Locate this clause in your contract and log the exact date the letter was received. 

What is Microsoft looking for during an audit?

Usually: Windows Server cores and editions, CAL counts and versions, Remote Desktop licensing, SQL Server and cloud subscription assignments.

If I am under-licensed, what happens?

The typical solution is to purchase the missing licenses. Some contracts shift the third-party audit costs to the customer if the shortfall exceeds a specific threshold (typically 5%). 

What can I do to get ready for an audit?

Create an inventory, gather proof of purchase, determine user and device counts, match CALs to servers, and document results. Each of the steps is described in the checklist above.

Is it necessary to have CALs for all servers?

No. If the version of your CAL is the same as or higher than the server version, then a single CAL covers user or device access across multiple Windows Servers within your environment. See our CAL guide.

Is it worth conducting a self-audit?

Yes, once a year, if not more frequently. It is cheaper than responding when a deadline is approaching and indicates gaps before they get too big to close.

Is this legal information?

No. Have your agreement reviewed by a lawyer in relation to a particular audit. 

Sources

• Microsoft: Licensing

• USU: How to prepare for a license audit

• Redress Compliance: Inside a Microsoft license audit