A SAM Veteran's Guide to Microsoft Audit Readiness
Microsoft audits are an unwelcome reality for service providers in the hosting, data centre, and SaaS space. However, with the right approach, these audits can be successfully managed and potentially even prevented altogether. After over 20 years of experience in Microsoft vendor management and audit defence, I can confidently say that it's not about blind luck but building a fortress of compliance.
Service providers often find themselves scrambling, unsure why they're being audited, struggling to gather data, and bewildered by the seemingly arbitrary rules and penalties. But it doesn't have to be this way. This guide isn't a theoretical textbook exercise; it's a battle-tested system refined through countless audits and real-world implementations.
Step 1: Understand Your Own Business
The cornerstone of audit readiness is a deep understanding of your service offerings. It may seem elementary, but many providers lack this granular knowledge. Don't take it personally—hosting and SaaS companies excel at developing, supporting, and selling services, but the behind-the-scenes details often get overlooked. That is where the compliance gaps emerge, particularly with new or customised offerings.
Before diving into data, tools, or scripts, meticulously categorise your services. It is more nuanced than it sounds.
Dedicated Hosting: Colocation, single-tenant, or private cloud—each with variations based on hardware, license providers, and license types. Treat each variation as a distinct service.
Shared Hosting: Managed vs. unmanaged clients, with further distinctions based on the level of management and access you provide. Document each variation separately.
SaaS Hosting: If you're hosting your own app in your own data centre, you might not even need SPLA. Using eligible alternative licenses not only removes it from the scope of an SPLA audit but also provides financial benefits. Licensing someone else's app? SPLA is your path. Hosting for other SaaS providers? Different rules apply. Distinguish these scenarios, as they have unique compliance requirements.
Business Process Outsourcing (BPO): BPO services, like a fully dedicated call centre service, where the end client has limited or no access to the systems. BPOs on dedicated hardware or in public cloud environments are distinct and require different licensing approaches.
CSP Hosting: This service has distinct licensing, billing, and management requirements compared to other hosting options.
This list isn't static. Review it regularly—at least annually or quarterly if your business is constantly evolving.
Step 2: Diagram Your Infrastructure
Once you've mastered your service catalogue, it's time to map your entire infrastructure. Every server, every cluster, every environment, and every data centre needs to be accounted for. This meticulous documentation is the blueprint of your Microsoft compliance fortress.
Instruct your IT department to provide a comprehensive list of all infrastructure components. For each cluster, specify the exact service types it supports. If it's a dedicated cluster, name the client. Ownership must be crystal clear. Be as granular as possible: "Dedicated cluster for Client X, BYOL except for operating systems" is the level of detail you aim for.
It isn't a one-and-done task. Repeat this process quarterly or even monthly if your setup changes frequently. New cluster? Add it immediately. Maintaining an accurate and up-to-date infrastructure map is critical for identifying and addressing compliance vulnerabilities.
Step 3: Know Your Clients
Your CRM or client management system is essential for audit readiness. Meticulously record compliance-related details for each client, including:
Agreement Type: Online terms and conditions, custom contract, etc.
Service Start Date: This helps determine which version of your terms and conditions they signed.
Managed/Unmanaged Status: This distinction significantly impacts your responsibilities.
Key Milestones: Service start and end dates, demo and trial periods, and go-live dates.
Specific Licenses Provided: Keep track of what you're responsible for.
Evidence of Client Responsibility: Secure documentation that clients acknowledge their responsibility for licenses you don't provide.
This detailed record will streamline the audit process and save you time and frustration in the long run.
Contractual Compliance
SPLA and CSP hosting have contractual nuances that extend beyond mere licensing:
End User License Terms (EULT): Microsoft provides a PDF EULT with your SPLA agreement. Include it verbatim in your Terms of Service. This crucial document places the onus of legal Microsoft software use on your clients and ensures their cooperation in an audit.
SPLA Reporting: You must report details of end clients whose consumption exceeds $1,000 per month. While granular breakdowns may no longer be required (depending on your SPLA version), reporting high-consumption clients remains mandatory.
Demo and Trial Tracking: SPLA requires tracking details of all demos and unpaid trial access provided to end clients. This documentation is essential to prove that these licenses are free of charge from an SPLA perspective.
License Mobility Partnership: If you're in this outdated program, follow the guidelines meticulously. Even if you have not renewed your participation, be prepared to provide license verification forms in an audit.
CSP Hoster Requirements: If you're a CSP hoster, verify end-client licenses and report CSP-hosted Microsoft products quarterly.
BYOL and the No-Access Challenge
Bring Your Own License (BYOL) is a frequent pain point in compliance. Even if you don't officially allow it, it happens, especially when system administrators aren't fully versed in the intricacies of licensing rules. Microsoft, however, holds you responsible for all their software in your environment.
No Access to Virtual Machines?
If you can't access a client's virtual machines, it's a major audit hurdle. Microsoft, and by extension, their auditors, will demand a scan of all machines, regardless of your contract terms with the client. While there are rumours of Microsoft softening its stance on this, it's best to assume the worst and be prepared to scan.
But can you avoid this altogether? It's an uphill battle, but not impossible. You'll need a rock-solid case backed by indisputable written evidence. Think of it as your ace in the hole. Verbal arguments and vague claims won't cut it.
Your best bet is to present comprehensive documentation, starting with your terms of service. You need to unequivocally demonstrate, in writing, that you have absolutely zero access to those virtual machines—not even a backup admin account. Your end clients must accept full responsibility for what they deploy on those machines and fully indemnify you against any claims. It must include acknowledging in writing that you're not providing additional licenses beyond the operating system, or perhaps not even that if they're using CSP licenses.
This is where the earlier steps of building your client register and having solid agreements and change records come into play. If you've done your homework, you'll have the evidence to present a strong defence.
Managing BYOL
If you're a License Mobility Partner or CSP Hoster, follow Microsoft's specific BYOL guidelines. If not, BYOL isn't mandatory, but you'll still face scrutiny in an audit. You must clearly delineate which licenses you provide and gather evidence that your end clients possess eligible licenses for the rest.
Whether you need to act as a daily auditor for your clients is debatable, but it's wise to politely require them to inform you when they deploy Microsoft software you don't provide. Include this in your terms and conditions and request reasonable proof. It's a simple step that can save you a lot of trouble.
Relevant Records and Documentation
The concept of "relevant records" in SPLA can be nebulous. The agreement doesn't define it precisely, but it provides examples like billing records. Maintaining these records is strongly recommended, especially in case of a dispute. For example, suppose a client who co-manages Active Directory with you deploys additional software or increases the number of authorised users without your knowledge. In that case, your billing records can serve as crucial proof of your compliance.
In such a scenario, your billing records can demonstrate that the client did not pay for the additional licenses, you didn't bill them, you were unaware of the increased usage, and you didn't profit from it. It clearly shows there was no intent to deceive Microsoft. Your records provide a clear link between what the client paid for and what was reported.
Regardless of the maturity of your license management processes, there's one straightforward step every service provider should take: keep your monthly SPLA reports and quarterly CSP hosting reports organised and backed up. This includes maintaining the entire paper trail, starting with the report itself, the purchase order (if applicable), and the invoices from your SPLA reseller. A complete record provides a robust defence against potential discrepancies or misunderstandings.
Inventory and Tools
Dedicated tools for managing SPLA and CSP hosting reports are valuable, but only if you trust them implicitly. They need regular maintenance, and their data must align perfectly with your end-client arrangements. Ideally, your tool should be the definitive source for your end-client billing.
If you're using your own scripts, ensure they're comprehensive and protect you from human error. For instance, if a client has a designated security group for accessing Microsoft Office, your script should check all security groups, not just that one. Mistakes happen, and a comprehensive script will help you avoid underreporting to Microsoft.
Whether you provide data directly from your tool during an audit or run the auditor's scripts, having a dedicated and reliable tool is undeniably beneficial.
Preventing an Audit
So, how does all this meticulous preparation help you avoid an audit? Microsoft audits are investments for them. They pay auditors a hefty sum, and the longer an audit drags on, the higher the cost. They want a return on that investment, not just financially but also in terms of their internal resources and effort.
If Microsoft sees that you're diligently managing your environment, they won't get that return. Telltale signs of a well-managed environment include dynamic reporting that reflects the natural fluctuations in software usage. On the other hand, static reporting is a red flag for Microsoft, suggesting a stagnant environment, which is rarely the case in reality.
While there's no foolproof way to dodge an audit, there are proactive measures you can take:
Dynamic Reporting: Ensure your reporting reflects the dynamic nature of your environment. Avoid static numbers that raise red flags.
Negotiate: If you receive an audit notice, you can try to negotiate. While not always successful, presenting a compelling case, such as mentioning that you work with a reputable partner like SAMexpert to manage your SPLA, might convince Microsoft to reconsider.
Thorough Preparation: Even if an audit proceeds, thorough preparation can minimise penalties. In some cases, penalties can be as low as a thousand euros, leaving Microsoft to foot the bill for the auditor and their wasted time.
Audit Readiness and Your Profitability
Beyond compliance, audit readiness offers a significant business advantage—it helps you get your house in order. It goes beyond mere compliance, which is simply a byproduct of good business practices.
The ultimate goal is to boost profitability. A well-organised environment allows you to identify untapped opportunities, such as unbilled Microsoft software you're providing but not charging for. This is a common discovery during audits, where a comprehensive analysis often reveals discrepancies between software usage, reporting, and billing.
In essence, audit readiness isn't just about mitigating risk; it's about optimising your operations and financial performance. It's a win-win scenario where you ensure compliance while uncovering hidden revenue potential.
Talk to an Expert
SAMexpert is a boutique business management consultancy specialising in Microsoft vendor management, encompassing strategy, cost, compliance, and audit defence. We provide unbiased advice as we do not sell Microsoft licenses or services. Our focus is on your bottom line and top line, helping you optimise your Microsoft investments and achieve sustainable, profitable growth.
If you're interested in learning more about our services or want to request a copy of our SPLA audit readiness checklist, don't hesitate to get in touch with us at ask@samexpert.com or using the form below.