Why the First 72 Hours Are the Most Consequential
When a Microsoft audit letter arrives — whether from Microsoft directly, from a SAM partner, or through your enterprise agreement account team — the decisions made in the first 72 hours shape the entire subsequent process. The initial response establishes the scope of the audit, the data the auditors will access, the legal framework governing your participation, and critically, whether you are responding from a position of preparation or from a position of reactive cooperation.
Most organisations respond too quickly and too broadly. IT teams, wanting to appear cooperative and non-suspicious, provide immediate access to systems and inventory data before the organisation has assessed what the data contains. Legal teams, unfamiliar with software licensing, miss scope and consent provisions in engagement letters that are difficult to limit after signature. Procurement teams, under pressure from Microsoft account teams to resolve the audit quickly alongside renewal discussions, conflate the two commercial processes in ways that benefit Microsoft.
None of this is accidental. Microsoft's audit process — and the SAM partner engagement model that initiates most reviews — is designed to move quickly to data collection before the organisation has established its position. Slowing down, establishing your position, and engaging with the process on your terms rather than Microsoft's is the foundational principle of effective audit defense.
Do not forward the audit letter to your IT team and ask them to pull an inventory. Do not call your Microsoft account manager to discuss the audit before you have legal and independent licensing advice. Do not sign any SAM engagement letter, audit cooperation agreement, or data sharing consent without independent review. Each of these actions, taken before you have established your position, narrows your options for the remainder of the process.
Identify What Type of Letter You Have Received
Before taking any action, establish exactly what document you have received. The response, obligations, and timeline differ significantly depending on the letter type.
| Letter Type | Sender | Contractual Obligation? | Correct Initial Response |
|---|---|---|---|
| SAM Engagement Offer | Microsoft SAM Partner (third party) | No obligation — review EA first | Review EA audit clause before responding. Determine if SAM engagement clause exists. Do not commit to participation without independent advice. |
| Formal Audit Notice | Microsoft Corporation directly | Yes — EA Section 6 or equivalent | Acknowledge receipt in writing. Engage legal and independent licensing adviser. Do not provide any data until scope is negotiated. |
| True-Up Review Request | Microsoft account team | Self-reporting obligation | This is a true-up, not a formal audit. Manage as a compliance exercise with independent validation. Do not treat as a formal audit unless Microsoft cites audit clause language. |
| SAM Partner "Compliance Check" | Microsoft-aligned reseller or partner | No contractual obligation | Do not participate without reviewing your EA. Reseller-initiated "compliance checks" have no contractual basis and are commercially motivated reviews. |
The 72-Hour Response Plan
Negotiating Audit Scope: Your First Line of Defense
After the initial 72-hour stabilisation, your first substantive engagement with Microsoft or their auditors is scope negotiation. The audit scope defines which products will be inventoried, which time period the audit covers, which environments are included, and which methodology will be used for data collection and ELP calculation. Every element of scope has a direct relationship to your potential liability — narrower scope means lower maximum exposure.
Scope negotiation positions to take: First, push to exclude products for which you have clean purchase documentation and minimal deployment risk. Audit effort should focus on products with genuine compliance uncertainty. Second, resist multi-period audit scope where Microsoft seeks to examine compliance going back more than 12 months for currently in-scope products. Your EA term defines the compliance period, and you should negotiate the shortest defensible audit window. Third, agree the inventory methodology in writing before data collection begins, including which tool will be used, how the results will be normalised, and how virtualisation environments will be counted. A verbal or informal methodology agreement gives the auditor discretion to change approach when it produces results unfavourable to Microsoft's initial position.
Documentation You Need Ready
Effective audit defense requires organised, accessible documentation. The categories of documentation that most frequently determine audit outcomes are:
VLSC purchase history exports covering all licence transactions for the audit period — not just summary reports, but transaction-level detail showing product, quantity, purchase date, and SA status. Download this directly from VLSC and maintain independent copies not dependent on Microsoft's portal availability.
SA benefit documentation including step-up rights exercised, licence mobility deployments, disaster recovery passive instance records, and any Planning Services activations. SA benefits directly reduce the gross licence requirement in the ELP calculation and are frequently omitted from auditor calculations.
Virtualisation environment documentation covering host-level processor and core counts, VM mapping to physical hosts, and the specific Microsoft licence model applied (per-VM vs. per-host). SQL Server and Windows Server virtualisation rules produce dramatically different licence counts depending on counting methodology, and the documentation justifying your chosen approach must be explicit.
Test and development environment records demonstrating which servers and workstations are exclusively used for test/dev purposes and therefore subject to reduced-cost or zero-cost licensing under SA or MSDN/Visual Studio entitlements.
For the complete documentation checklist and ongoing compliance programme framework, see the Microsoft licence compliance programme guide. For understanding what the auditors are specifically looking for in each product category, the how Microsoft audits work process guide provides the full methodology context. And if your audit has reached the settlement stage, the negotiation during a Microsoft audit guide covers the commercial negotiation framework applicable to reaching a fair resolution.
Your Microsoft reseller will often offer to "help" manage the audit. Be cautious. The reseller's revenue depends on Microsoft licence transactions — an audit that identifies a gap and results in additional purchases generates reseller margin. Their commercial interest is aligned with Microsoft finding a payable gap, not with you minimising your liability. For a clear framework on evaluating adviser alignment, see the independent vs. aligned adviser guide.