Summary
You’re three months into the CFO role. Quarterly risk review with IT and Procurement. You run through the standard questions about vendor exposure and audit risks.
Your IT director mentions Oracle, AWS, Salesforce. Gets to Microsoft: “We’re covered. Got a tool that tracks it. We check it regularly. Everything’s green.”
You ask what that actually means. He shows you the dashboard. Traffic lights. Green across the board. Numbers that mean nothing to you but look official enough. You move on. You’ve got 50 other risks to review.
Six months later, the audit letter arrives.
Three months after that, you’re sitting in a conference room with Microsoft’s auditor. They’ve produced a report showing $4.2M in non-compliance. Your IT director keeps saying “but the tool shows we’re compliant.” The auditor doesn’t care what your tool shows.
Green dashboards don’t defend you: auditors use their own data, rules, and calculations.
They have their own data, their own discovery methods, their own calculations. None of it matches yours. You pull out your compliance reports, the ones from the tool, the green dashboard screenshots you thought would protect you.
The auditor questions the numbers.
“Your tool calculated 64 SQL Server core licences needed. Our calculation shows 256”.
“Your tool tracked your cloud licences. But they don’t have active Software Assurance. They’re invalid”.
Every defensive position you prepared from the tool data crumbles. The auditor isn’t accepting it. Your numbers don’t match theirs. You can’t explain why. You spent $180K on protection that isn’t protecting you.
This isn’t only your company. This is dozens of companies we’ve seen in recent years. Different industries, different sizes, different tools. Same story. They bought audit defence. They got a compliance calculator. They didn’t know there was a difference until Microsoft audited them.
The Pitch Was Compelling
You made a reasonable decision based on persuasive information.
The features list was impressive: “Automated compliance monitoring across your entire Microsoft estate. Real-time visibility into licence deployment. Audit-ready reports at the click of a button. Protection from non-compliance risk”. The dashboard looked professional, with its traffic light reporting system where green means compliant and red means buy licences. Clear, simple, actionable.
The ROI calculations showed savings. Avoid over-licensing, prevent audit penalties, optimise spend. The business case wrote itself. When vendor risks came up in board discussions, you pointed to the tool. Microsoft compliance was covered. One less thing to worry about.
But was it? One in three organisations now question whether their SAM tool was worth it. That’s from Gartner research. 36% of stakeholders in sourcing, procurement and vendor management question the success of their SAM tool.
I’ve worked with almost all major SAM tools for over 15 years. I have never seen a single implementation where Microsoft compliance was calculated correctly by the tool. Not once. It’s always workarounds. “Good enough for now”. “We download the data and analyse it in Excel”. “We have people who can interpret it