Microsoft Audit Experience: What to Expect and What We Learned
One of our clients recently went through a Microsoft audit conducted by PwC and Microsoft. It was an interesting experience and, at times, a stressful one.
During the kickoff discussions, both PwC and Microsoft made it clear that the audit was not triggered by anything the client did. We were told the organization was randomly selected. While that helped ease some concern, the process itself still required significant preparation and attention to detail.
What follows is our real-world experience and guidance based on going through the audit end to end.
Audit Notification and Kickoff
The initial kickoff was requested, and we were given two weeks to respond with available dates. We ultimately negotiated a kickoff date about four weeks out. This was due to scheduling conflicts on their side and the audit falling over the holidays.
That additional time worked in our favor. It gave us room to gather data, validate configurations, and make decisions before anything was formally submitted.
During the kickoff call, PwC outlined the audit schedule and overall process. We also required that a Business Associate Agreement (BAA) be signed before moving forward.
We designated two primary points of contact and made it clear that all communication and data flow would go through them. This helped reduce confusion, limited exposure, and kept the process controlled.
After the kickoff, we moved into the information gathering phase.
Information Gathering Phase
This phase lasted approximately six weeks. All requested data was uploaded to the PwC portal. Aside from occasional status check-ins over email, there was minimal direct interaction during this time.
Everything provided was reviewed internally before submission. Control was critical here.
Information Requested
Software Licensing
- Microsoft Licensing Statement (MLS)
- Connect with your VAR handling your Microsoft account
- SQL licensing where licenses were provided by vendors.
- If your organization purchased software SQL licenses may have been included with the purchase. This is typically missed and adds costs.
- OEM endpoint licensing from Dell
- Windows licenses are typically included with purchases but if you are using Windows Enterprise, Pro is required as a baseline.
General Environment Information
- High-level questions about the organization and environment
Infrastructure and Systems Data
- Active Directory output, including detailed information on computer objects across the environment
- RVTools reports outlining VMware infrastructure details
- SCCM reports, including
- Installed applications (approximately 40MB of data)
- SQL Server instances
- Server and hardware inventory
- Hypervisor Environment (Hyper-V, ESXi, XenServer, other solutions)
- Require a vMotion history using scripts to identify VM movement across hosts
Windows VDA vs Remote Desktop Sessions
Microsoft licensing makes a clear distinction between virtual desktops and session-based desktops, and the licensing requirements are different.
When Windows VDA is required
Microsoft requires a Windows VDA license for any user who accesses a Windows desktop operating system in a virtual or remote manner.
This applies when a user connects to a virtual desktop running
- Windows 10
- Windows 11
It does not matter if the user connects from
- A thin client or zero client
- A Linux based device
- Another Windows device
- A personal or home computer
If the operating system being accessed is Windows desktop, a Windows VDA license is required unless the user already has entitlement through Microsoft 365 E3 or E5.
When Windows VDA is not required
Windows VDA is not required for Remote Desktop Sessions or Published Desktops that run on Windows Server.
This includes multi-user desktops hosted on
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025
In these scenarios, users are accessing a server operating system, not a desktop operating system.
Instead of Windows VDA, Microsoft requires
- A licensed Windows Server host
- Remote Desktop Services CALs (per user or per device)
- RDSH licenses are backwards compatible but not forward compatible.
Why this matters for Virtual Desktops versus Windows RDSH
This difference is often misunderstood during audits.
A Windows 11 virtual desktop and a published desktop running on Windows Server may look the same to the end user, but they are licensed very differently.
Licensing follows the operating system, not the user experience.
SQL Server Licensing: Where We Spent the Most Time
Between the audit notification and the final data submission, a significant amount of effort was spent reviewing SQL Server usage and licensing.
We made the decision to stand up a separate SQL cluster and move all SQL virtual machines into it. This was a defensive move. It allowed us to better control licensing scope and reduced risk if negotiations were required.
It may have been conservative, but the priority was limiting exposure. In an audit, it’s reasonable to assume the goal is to find discrepancies. We didn’t want to introduce additional risk by over-sharing or leaving licensing open to interpretation.
SQL Server Licensing Models Explained
Microsoft SQL Server licensing can be confusing, especially in virtualized environments. Below is a simplified breakdown based on Microsoft guidance.
SQL Server Standard Edition
-
Minimum core licensing is 4 vCPUs per VM
-
Licensing can be per core or Server plus CAL
Example
If you run a single SQL Server Standard VM with 4 vCPUs, you must license 4 SQL Server Standard cores.
With Software Assurance (SA):
-
The license is assigned to the virtual machine
-
The VM can move freely across hosts in the same server farm. Without being out of compliance from Micrsoft perspective.
-
The 90-day reassignment rule does not apply
Without Software Assurance:
-
Licenses are subject to the 90-day reassignment rule.
-
If a VM moves between hosts and may run on multiple hosts during that period, each host must be licensed
-
This often results in additional licensing requirements, commonly referred to by Microsoft as license stacking
SQL Server Enterprise Edition
As environments grow and SQL demand increases, Enterprise can become more cost-effective at scale.
With Software Assurance:
-
You must license all physical cores on the host
-
Example: Two physical hosts with single-socket 24-core CPUs require licensing for 48 cores total
-
Enterprise licensing is expensive, roughly 15k MSRP per 2-core pack.
-
Once licensed, you can run unlimited SQL Server Enterprise VMs on those hosts.
- From our baseline validation and experience a 6:1 VM to Physical Core ratio is acceptable without any impact to user experience or performance.
- Memory will come at a premium especially in today’s market due to A.I demand causing prices to skyrocket.
Without Software Assurance:
-
Unlimited VMs are not allowed
-
Each VM or host must be licensed individually
Software Assurance: Why It Matters
Software Assurance is Microsoft’s annual maintenance and benefits program. It is not a perpetual license, but it provides flexibility.
Key differences:
-
Perpetual license means you own the version you purchased
-
Software Assurance keeps licenses current and allows version upgrades
-
SA must be purchased at the time of license acquisition and cannot be added later
With SA on Standard Edition:
-
SQL VMs can move freely within a hypervisor cluster for high availability
Without SA on Standard Edition:
-
Only one VM migration is allowed every 90 days
-
Exceeding this puts you out of compliance unless you can prove the VM stayed on a single host
Microsoft is fully aware that most virtual environments rely on vMotion for high availability and maintenance. Without SA, you may be required to provide proof such as affinity rules, VM movement history, and host assignment records.
Why This Matters
In large environments, SQL sprawl happens quickly. When an audit occurs, the cost of non-compliance can be significant, including back-licensing and penalties.
This is where our expertise helps. We help organizations understand their current position, identify risks, outline options, estimate costs, and avoid surprises. Our goal is to be a partner, not just point out problems.
Windows Server licensing in virtual environments
Windows Server licensing in a virtual environment often confuses people because it behaves similarly to SQL Server, but not exactly the same. The key idea to understand is that licensing is tied to the physical hosts that could run the virtual machines, not just where the VM happens to live today.
Windows Server Standard edition
Windows Server Standard is licensed per physical host, based on the number of physical cores in that host.
Each fully licensed Standard server grants rights for two Windows Server virtual machines on that host.
This is where stacking comes in.
If a host needs to run more than two Windows Server VMs, you must license the host again.
Example
If a physical host has 16 cores and is licensed once with Standard
- You can run up to 2 Windows Server VMs
If that same host needs to run 6 Windows Server VMs
- You must license the host three times
- Each license covers the same physical cores
In a clustered or highly available environment, Microsoft expects you to license every host that a VM could potentially run on, not just where it currently runs.
If a VM can vMotion to another host, that host must also be fully licensed for Windows Server.
This is why Standard edition can get expensive in large clusters with many VMs.
Windows Server Datacenter edition
Windows Server Datacenter uses a different and simpler model.
Datacenter is also licensed per physical host, based on physical cores, but once a host is licensed, it includes unlimited Windows Server virtual machines on that host.
There is no stacking.
Once the host is licensed, you do not need to count or track how many Windows Server VMs are running there.
This is why Datacenter is often preferred in environments with
- Large virtualization clusters
- High VM density
- Frequent VM migrations
- High Availability (HA)
- Administration & Maintenance
It makes it easier from a licensing perspective and audit risk.
How this compares to SQL Server licensing
The logic is similar to SQL Server Standard versus Enterprise.
With Standard, licensing is tied closely to where workloads run and how often they move. If you run a small number of Windows Server VMs, with minimal VM migrations, and few hosts Standard Edition is the perfect choice.
With Enterprise, you license the underlying physical infrastructure and gain flexibility, high-availability, and simplicity.
Windows Server Datacenter plays the same role for operating system licensing that SQL Enterprise plays for database workloads.
Conclusion
Microsoft audits are stressful. Even when you’re told it’s random, there’s still a lot riding on how prepared you are and how clean your data is.
What we learned is that audits go much smoother when you understand your environment ahead of time. Knowing what servers you have, where they run, how they move, and how they’re licensed makes a big difference. The biggest problems usually aren’t intentional misuse, they’re things that grew over time and were never revisited.
The earlier you get clarity on licensing and infrastructure, the fewer surprises you’ll face when an audit starts. Waiting until Microsoft is already asking questions is usually the hardest and most expensive way to deal with it. I’m Marc Leger, and if you have any questions, my team and I are just a click away and happy to help.
Key Licensing Terms
-
Per Core Licensing
Available for both Standard and Enterprise. Licenses are based on cores used by the VM or host. No CALs required. -
Server plus CAL
Available only for Standard Edition. Requires a server license and CALs for each user or device accessing SQL Server. -
Software Assurance (SA)
A supplemental program that provides upgrade rights and licensing flexibility. Can only be added at purchase time. -
Software Subscription Licenses
Term-based licenses (1-year or 3-year) acquired through CSP partners. Includes benefits similar to SA. -
Operating System Environments (OSEs)
Refers to physical or virtual environments where SQL Server runs.
