A Microsoft license audit starts with inventory

A review should not be the first time a company tries to understand what Microsoft software it has installed and why it has the right to use it. Good preparation starts with a reproducible snapshot of the environment, a register of acquired rights, and a written calculation of demand. If those three parts cannot be linked row by row, a folder full of invoices will not save you.

The most dangerous habit is treating an activated product as a licensed product. Activation confirms that the software accepted a key or digital entitlement. It does not prove that the organization bought the required number of licenses, assigned them correctly to devices or users, or followed virtualization terms. Before a vendor contacts you, you need to find these exact breaks, correct them, and retain the record of each decision.

Fix the scope and snapshot date

An internal review must describe the environment at a specific date, or data gathered in different weeks will contradict itself. Set a cutoff date, appoint the owner of the review, and list the legal entities, sites, cloud tenants, and domains in scope. Record every exclusion and the reason for it separately.

A manager who can obtain data from procurement, HR, finance, security, and service owners should own the scope, not a system administrator working alone. The administrator knows the current configuration but often cannot see an invoice held by a subsidiary, an outsourcing contract, or a subscription that a department bought on a corporate card. Name one owner for the technical fact, one for the entitlement, and one for the business decision so a dispute does not stall between departments.

Review organizational changes during the period in question. A merger, a legal entity split, an employee transfer, leased equipment, or a service handed to a contractor changes the party that uses the software and must prove its entitlement, even when the files on disk stay the same. A license bought by one group company does not automatically become a group-wide license. An affiliate's basis for use must come from the agreement, not from common ownership of the businesses.

The scope normally includes corporate desktops, laptops, physical servers, virtual machines, cloud subscriptions, remote desktops, labs, recovery nodes, and branch devices. Do not forget assets managed by a contractor when the organization retains the right to use the software or controls the server. An employee's personal laptop also needs a decision when corporate applications are installed on it or it connects to a licensed server service.

Create a snapshot record with five fields:

• cutoff date and exact time;
• legal entities and departments in scope;
• sources of technical and procurement data;
• people responsible for exports and calculations;
• known gaps and the date each will be closed.

Do not alter source exports after receiving them. Keep them in a read-only directory, calculate checksums, and work from copies. A month later, you can then prove which data produced the result instead of reconstructing yesterday's spreadsheet from email threads.

Installation, activation, and the right to use are different

Installation shows that files are present, activation shows a technical state, and the right to use comes from the agreement, order, and applicable product terms. Teams often compress these concepts into a single column called "licensed," making a proper reconciliation impossible.

Microsoft Product Terms states that a customer needs a license for each product and separately licensed function it uses unless the agreement grants another right. It also describes rights to prior versions and lower editions: having such a right does not turn the installed older version into another acquired license. A row that says "Windows Server 2019 activated with a portal key" therefore says nothing about the number of covered physical cores, the edition purchased, or reassignment rights.

A product key is not a reserve of licenses either. Microsoft's documentation for downloading volume licensing products warns that access to a file or key in the catalog does not by itself grant a right to install the latest version under every agreement. A single MAK key may permit many activations, but that is a technical limit, not the number of rights purchased.

Keep separate attributes for every discovered installation: product, version, edition, channel, activation state, assigned user or device, licensing metric, and evidence of entitlement. If the evidence has not been found yet, use the status "unconfirmed," not "unlicensed." The latter conclusion requires an analysis of the terms; the former honestly describes the quality of the evidence.

Make the same distinction between acquisition and assignment. An invoice proves a purchase, but it does not show how the right was assigned to a device, user, or server. A record in an admin portal shows the current assignment of a subscription, but it does not replace the order or prove a right in an earlier period. A defensible license position appears only when these pieces of evidence are connected.

Do not use the installation date as the start date of a breach without further checking. An image may have been placed on a disk before it was run, the device may have stayed in storage, or an earlier agreement may have provided the right. Conversely, removing an entry from the software list does not prove that access ended: the service may run remotely, a component may remain on a server, or a user may still be able to start a VM.

Build the entitlement register from primary records

The acquired rights register should begin with agreements and orders, not the current list of keys. Gather agreements, order confirmations, invoices, acceptance documents, CSP records, OEM certificates, and retail purchase records. For subscriptions, record start and end dates, seat count, tenant, and change history. For perpetual licenses, record version, edition, quantity, purchase program, and Software Assurance status on the relevant date.

Volume licenses are now administered through the Microsoft 365 admin center. Microsoft says the former Volume Licensing Service Center was retired in April 2024. Access to the data depends on a role for the specific License ID, and a tenant Global Administrator does not automatically receive rights to volume agreements. If an agreement is "missing," check the roles and organizational association before concluding that there are no licenses.

A minimum entitlement-register row contains these fields:

• rights holder and License ID or order number;
• exact product name, version, and edition;
• metric and number of acquired units;
• acquisition date, subscription term, and Software Assurance status;
• evidence source and document owner.

Do not combine purchases with different terms into one row. For example, an OEM Windows license, a perpetual volume license, and a subscription may produce a similar installed product, but they differ in reassignment rights, term, and assignment method. Reconciling only a total number called "Windows Pro" hides risk instead of measuring it.

Keep the applicable edition of Product Terms and any special terms for the calculation date. The current page is useful for today's position, but an older deployment may rely on rights that applied at purchase or were written into a specific agreement. An archive of the terms beside the calculation prevents later arguments about which document the analyst used.

Give each piece of evidence a stable identifier, such as ENT-2025-0042, and reference that identifier from the matrix instead of a filename such as scan_final2.pdf. In the evidence record, capture the path to the original, legal entity, seller, order number, line items, and reviewer. If one invoice covers several products, split it into rows but retain one link to the original record.

A partner's summary spreadsheet helps with discovery, but it is secondary evidence. Compare it with primary orders and portal data, then ask about discrepancies in writing. Check returns, quantity corrections, SKU substitutions, renewals with a changed plan, and purchases made under another organization name especially closely. These details explain why the financial total balances while the right cannot be connected to the intended asset.

Inventory must use several sources

A single management tool almost always has blind spots. A device directory does not see a powered-off server, the management agent may be absent from a lab, and a Microsoft 365 list shows assigned cloud licenses but not the full set of local installations. Combine at least directory, endpoint management, hypervisor, cloud, and network discovery data.

On Windows, you can obtain a basic installed-software list from registry locations without calling Win32_Product. The latter initiates a consistency check of installed MSI packages and can trigger repairs, so I do not recommend it for a fleet-wide query. This PowerShell fragment produces a usable input for normalization:

$paths = @(
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
Get-ItemProperty $paths -ErrorAction SilentlyContinue |
  Where-Object DisplayName |
  Select-Object @{n='Computer';e={$env:COMPUTERNAME}}, DisplayName, DisplayVersion, Publisher, InstallDate |
  Export-Csv '.\installed-software.csv' -NoTypeInformation -Encoding UTF8

This export does not detect every portable application, component without a correct uninstall record, or server feature. Add operating system and hardware data because a server calculation needs physical processor and core counts:

Get-CimInstance Win32_OperatingSystem |
  Select-Object CSName, Caption, Version, OperatingSystemSKU
Get-CimInstance Win32_ComputerSystem |
  Select-Object Name, Manufacturer, Model, NumberOfProcessors
Get-CimInstance Win32_Processor |
  Select-Object SystemName, SocketDesignation, NumberOfCores

For a virtual environment, export more than the current VM list. You need the host, cluster, migration rules, guest OS edition, virtual core count, and every possible node on which it can run. If a VM can move across the cluster, its present placement does not describe the complete licensing scenario.

Collect cloud data separately. In the Microsoft 365 admin center, Billing > Licenses shows assigned and available licenses, while Users > Active users helps identify licensed and unlicensed users. Usage reports answer a different question: whether a person used the service. Zero activity does not cancel an assignment, while activity data helps find shared accounts, former employees, and an incorrectly selected plan.

Capture the last-seen date and origin of every device record as well. Two objects with the same name may be a rebuilt computer and its stale record, while one physical server may appear in the directory, monitoring system, and hypervisor console. Use a persistent identifier, serial number, or UUID and retain the deduplication rule. Simply deleting duplicates by name can quietly discard real branch-office nodes.

Server products need separate discovery methods. Check services, OS roles, database instances, executable editions, containers, and attached management components. Compare these results with network connections and application configuration. An empty agent list does not prove that SQL Server is absent when a business application constantly connects to an unknown address. For remote access, you need user and device lists, not only the installed Remote Desktop Services role.

Measure coverage. If the directory has 1,200 devices, the agent reports 1,050, and 80 records are confirmed as retired, 70 objects remain unexplained. They cannot disappear into a note saying "some computers are offline." Assign an owner to each exception group and obtain either a technical inventory or confirmed disposal.

Normalization turns a software list into license demand

Raw names cannot be compared directly with orders because one product may appear under dozens of labels. First map publisher, family, release, edition, and component to a controlled catalog. "Microsoft 365 Apps for enterprise," "Office 16 Click-to-Run," and a separate language-pack entry should not become three independent requirements.

Add the licensing model and count unit to each normalized row: user, device, physical core, virtual core, server, or access right. Then apply the terms for the exact product and agreement covering the deployment. There is no universal formula of "installations minus purchases."

For Windows Server licensed by physical host, you need the number of physical cores and the minimums set by the product terms. After all host cores are licensed, Standard grants limited virtualization rights, while Datacenter covers more virtual instances on the fully licensed host. In a cluster, the calculation must account for every host where the workload can run. A purchase described as "16 Core" also needs interpretation: it may be one 16-core pack or a number of line items with a different pack size.

Count user cloud subscriptions by unique people and the rules of the specific plan, not by device count. Count server CALs separately from the server license and make a deliberate choice between the User and Device metric. External access, multiplexing, guest users, and service accounts cannot automatically be treated as free or chargeable. Record the decision after reading the product terms.

For subscriptions, compare the position at least at the cutoff date and at renewal boundaries. Today's pool of unassigned seats does not answer whether coverage existed three months ago, before a workforce reduction or plan change. Keep order and assignment exports by period; when history is unavailable, state that limitation directly in the report.

Do not confuse technical product discovery with the final SKU. The installed edition helps select the calculation branch, but the entitlement may come from a suite, subscription, prior-version right, or migration offer. Determine demand independently first, then apply an eligible right, and only then calculate the balance. Otherwise the analyst quietly bends installation classification to fit available purchases.

For every formula, record input values, the rule, the source of that rule, and the result. A calculation that says "96 cores required" cannot be reviewed without a host list and arithmetic. A good working row reads 3 hosts × 2 processors × 16 physical cores = 96 licensable cores, followed by separate entries for edition, virtualization rights, and acquired coverage.

Typical discrepancies appear between processes

Most shortages arise where procurement, HR records, and operations change the environment independently, not from a pirated installation. That is not an excuse. It tells you where to look first.

Former employees often retain assigned subscriptions, while new employees receive another plan manually even though a group should have assigned it automatically. Microsoft 365 can assign licenses to users and groups, so export both the assignment method and group-processing errors. Removing a license requires a separate decision about access to mail and data; do not do it merely to make the report look better.

Different gaps occur more often on servers:

• a virtual machine gained permission to migrate to an uncovered node;
• a host was replaced with a higher-core model but the entitlement register was not recalculated;
• Standard was deployed repeatedly without relicensing the cores for additional VMs;
• an OEM license was treated as transferable after hardware replacement;
• rights for a test or development environment were assumed without a supporting subscription and terms.

Prior-version rights create another source of error. They may permit an older release to run in place of the acquired version, but the calculation still rests on the license that granted that right. You cannot count one unit both as coverage for the current release and as a separate additional license for the old one.

Check trials and self-service purchases. A user may start a trial service or make a purchase that central procurement does not see immediately. That account creates both a technical and contractual question: who accepted the terms, who owns the data, and which plan takes effect after the trial. A policy prohibition does not remove an existing subscription; you need to find it and record a decision.

Shared and service accounts cannot all be counted as ordinary employees under one template. For each one, record the owner, assigned products, sign-in method, and actual purpose. If a license is assigned to an account only because an application cannot operate another way, it remains an assignment that requires a terms review. Conversely, when staff use a shared login, the account count may understate the number of people with access.

Review SQL Server, Remote Desktop Services, Project, Visio, and developer tools separately. They are often lost behind the general label "Microsoft" even though they use different metrics and additional access rights. If the team cannot interpret a scenario confidently, flag it for specialist review and attach the architecture diagram and facts instead of asking the vague question, "Are we compliant?"

The reconciliation matrix must show evidence and shortage

The final matrix connects actual use with entitlements and shows how the balance was calculated. One row per product family works only when version, edition, metric, and terms are the same. Otherwise split the position until the conclusion is no longer ambiguous.

Use these columns: Asset, Product, Version, Edition, Metric, Demand, Acquired, Applied right, Shortage/surplus, Evidence, Owner, Action, Due date. The Applied right field is especially important for downgrade rights, Software Assurance, hybrid benefits, and other exceptions. Without it, a positive balance may rest on a guess.

Classify findings separately:

1. confirmed shortage, where facts and terms are clear;
2. documentary gap, where a purchase is likely but primary evidence is missing;
3. technical uncertainty, where deployment details are incomplete;
4. disputed interpretation requiring a written opinion;
5. surplus or unused assignment that can be optimized.

Do not offset a surplus for one product against a shortage for another without an explicit right. Do not reduce demand because an application is "hardly used." Licensing often depends on assignment, installation, access, or the ability to run, not the number of clicks in a month.

Ask a second specialist to repeat the calculation from the source data. If that person does not reach the same result, either an assumption is implicit or a rule is poorly documented. Both problems must be fixed before an external request arrives.

Add a confidence level to every row, but do not use it to replace the balance. High confidence means the technical fact, entitlement, and rule are supported. Low confidence means a document or architecture detail is still needed. "Probably covered" must not automatically produce a zero shortage, or uncertainty will vanish from the overall picture.

Sampling is useful for assessing data quality, but not for calculating the complete license position. If ten of twenty checked laptops are clean, you cannot multiply that result across the fleet. Servers, developers, branches, and executives receive different software, so a sample can hide rare, expensive products. Use sampling to find a process error, then correct the source and rebuild the complete dataset.

Correct the cause, not only the final number

A confirmed shortage needs a lawful resolution, but urgently buying everything shown in red can be an expensive mistake. First check whether you can stop unnecessary use, correct an assignment, restrict VM migration, return a device to an allowed configuration, or apply an existing entitlement missing from the register. Then compare the cost and restrictions of the available purchase programs.

Record every correction as a change with an owner and evidence. For removal, keep the request and a new inventory. For reassignment, retain the old and new states. For a purchase, retain the order, the date on which the right took effect, and its link to the shortage row. Do not rewrite the original snapshot to make it appear that the discrepancy never existed.

Priority does not depend only on the amount. Review use with no identified basis, large server clusters, products with an expired subscription, and scenarios where the environment continues to grow first. A documentary gap can also become serious when the invoice sits with a former partner and the company cannot link it to its legal entity.

Do not remove software, disable accounts, or change migration rules without the service owner. License hygiene does not compensate for stopping accounting operations or losing mailbox access. An approved remediation plan must include a business check, a fallback, and a control snapshot after the change.

Do not ask a supplier to backdate a new order or change logs to conceal an earlier state. A new purchase may cover current demand, but its effect on an earlier period depends on the agreement. A preserved chronology and written legal position are safer than a tidy spreadsheet contradicted by invoices and system events.

Set a control for every resolved gap so it does not recur. It may be a mandatory license check in a new-VM request, automatic removal of an assignment after an approved termination, a migration block for an uncovered host, or a monthly reconciliation of orders with the portal. A control needs an owner, input data, and a record of execution, or it will become a wish within a quarter.

A rehearsal tests the quality of preparation

Before a vendor contacts you, run an internal rehearsal with someone who did not collect the data. Give that person a simulated request letter, a limited deadline, and access only to the prepared data room. They should be able to reconstruct the scope, find evidence for a random row, and repeat the calculation without oral explanations from its author.

Keep agreements and orders, an archive of applicable terms, raw technical exports, the normalization log, reconciliation matrix, opinions on disputed scenarios, and remediation evidence in the data room. Provide personal data and infrastructure details on a need-to-know basis. Counsel should review the contractual response process, confidentiality, and the requester's authority before materials are transferred.

Appoint one coordinator for external communication. Administrators, procurement staff, and branches should not send different spreadsheet versions directly. The coordinator keeps a request log, agrees interpretations with counsel and the licensing specialist, and records which file version was sent and when.

Prepare a request-registration form in advance: sender, contractual basis, scope, period, requested fields, deadline, response owner, and confidentiality limits. If the request is unclear, the coordinator asks written questions before producing a bulk data export. This does not obstruct the review. It prevents disclosure of unnecessary information and avoids spending a week on a spreadsheet that does not answer the question asked.

The rehearsal should include uncomfortable findings. Plant a row with no invoice, a powered-off server, a purchase made by another legal entity, and a disputed virtual machine. The team should not guess an answer. It should register the gap correctly, assign an owner, and demonstrate the resolution path. Behavior under incomplete data separates a controlled review from panic.

If an organization needs Microsoft software procurement and integration together with infrastructure, GSE.kz can assemble a solution around the customer's existing equipment and requirements. A partner cannot replace your primary documents, deployment list, or approved data owners, however. Those elements remain inside the company.

After the rehearsal, close the discovered gaps and approve the baseline snapshot. Then connect reconciliation to employee events, procurement, server commissioning, cluster changes, and subscription renewal. A dated calculation updated after each of those events turns a surprise audit into an ordinary review of records.