How a Microsoft audit starts, where the findings get inflated, and what to do in the first thirty days — written for organisations in Switzerland and Europe.
Microsoft audit defense is the practice of making sure a licence audit is settled on your data, your contractual entitlements and your reading of the terms, rather than on the auditor's assumptions. Microsoft volume licensing agreements grant a right to verify compliance, so the question is rarely whether a review happens — it is whether the resulting number is built from evidence or from worst-case interpretation of the grey areas.
Updated
Most licence exposure does not arrive in an envelope marked audit. It arrives as a free service.
Offered as a free service: a partner maps your estate and hands you a report. It is not a formal audit and carries no legal notice period, but the resulting numbers land with Microsoft and become the starting position at your next renewal.
Framed as migration planning. It inventories what you run on-premises, including workloads whose licensing position nobody has checked in years. The inventory is the same inventory an audit would build.
The real thing, sent under the verification clause of your volume licensing agreement. It names an independent auditor, typically one of the Big Four, working under a non-disclosure agreement.
Licensing terms leave room for interpretation. An auditor filling that room with worst-case assumptions is not making an error — they are making a choice you are entitled to contest.
Windows Server and SQL Server are licensed by physical cores on the host, not by the virtual machine. An auditor who counts a cluster as fully licensable — because a VM could in principle move anywhere in it — produces a far larger number than one who counts where workloads actually run and what your affinity rules permit.
A person who never opens a Microsoft interface can still require a CAL if an intermediate application passes their request through to a licensed server. Where the boundary sits is a reading of your architecture, not a fact the tooling reports.
A leaver whose account was disabled but never unlicensed is not a compliance gap. It is waste, and it belongs in the cost conversation rather than in the finding. Reports that do not separate the two inflate both numbers at once.
Non-production rights differ sharply by product and by subscription. Counting a test estate at production rates is one of the most common single sources of an inflated position.
The common thread is that none of these are readable off a tool. Each one is a question about your architecture, your contracts or your actual usage — and each is answerable with evidence you control.
The order carries the information. What you concede in week one is hard to reclaim in month four.
Acknowledge, do not agree
Confirm receipt and the contractual basis. Do not accept a scope, a tool or a timeline in the same reply. Everything after this is easier if the scope is negotiated rather than inherited.
Read your own agreement first
The verification clause sets the notice period, who may audit, under what confidentiality, and what you actually owe them. Entitlements from acquisitions, transfers and prior agreements live in documents the auditor does not have.
Build your own position before you hand over data
An effective licence position you produced yourself is the only way to check theirs. Going in without one means the first number on the table is the auditor's, and every later discussion is a negotiation down from it.
Control what leaves the building
Scripts and inventory exports carry more than licence metadata. For a Swiss organisation, sending identifiable employee data to an auditor abroad is a data-protection question in its own right, and one worth settling before the export runs, not after.
We build the licence position first, so the conversation starts from your numbers.