Choose a Microsoft compliance assessment provider on entitlement-reconstruction skill: whether it can rebuild what you actually own from decades of volume agreements, CSP records and acquisition debris, then apply SQL Server and Windows Server rules the way an auditor would. This guide explains what an effective license position (ELP) engagement produces, who sells the work and on what terms, how it is priced and what to ask candidates — it names no firms; see the firms that do this work →
Published 2 March 2026 · Last reviewed 18 March 2026
A compliance assessment answers one question with evidence: what do we own, what have we deployed, and where do the two diverge? The deliverable is an effective license position — entitlements on one side, consumption on the other, reconciled product by product — plus a remediation view that prices the gap several ways rather than one. The work has two halves of very different difficulty. Measuring deployment is the easier half; most estates already hold the raw data in SCCM or Intune, vCenter, Active Directory and the Microsoft 365 admin center. Reconstructing entitlement is the harder half: Select and Open agreements from past decades, Enterprise Agreement true-ups, CSP purchases scattered across resellers, OEM and retail fragments, Software Assurance lapses that quietly extinguished upgrade and failover rights, and licenses inherited through mergers that nobody mapped to the surviving legal entity.
Where the divergence concentrates is well known by now. Microsoft 365 and Azure are metered at source, so an assessment earns its fee almost entirely on the on-premises remainder: SQL Server per-core positions under virtualization, where host-level licensing and cluster mobility rules decide six-figure swings; Windows Server and the CAL estate; failover rights that exist only with active Software Assurance; Azure Hybrid Benefit claims that need an evidence trail, not a recollection; and developer-subscription use that drifted into production. A provider that cannot name these concentrations unprompted is reciting a methodology, not bringing experience.
Timing gives the work its leverage. Since the volume-licensing reshape — new Enterprise Agreements wound down through 2025 and MACC-holding EA customers moved to MCA-E at renewal from March 2026 — the annual true-up that used to absorb quiet over-deployment is gone for migrated customers. Under MCA-E you buy what you consume when you consume it, which makes a verified position before the migration or renewal the single cheapest moment to fix a gap. The same logic applies ahead of M&A due diligence and datacenter moves: every one of those events freezes your estate in someone else’s spotlight.
This guide is general information about selecting a compliance assessment provider for a Microsoft estate, not advice on your contracts. Compliance assessment is one of seven services in this directory. The Microsoft firm directory lists providers with balanced pros and cons — listed, not ranked.
Read the commercial structure before the methodology slides, because the structure tells you what the provider is optimizing for. A fixed-fee, scoped assessment — defined product set, defined estate boundary, defined deliverable — rewards finishing accurately and is the default shape for a first ELP. Day-rate arrangements suit messy estates where the entitlement archaeology cannot be sized in advance; insist on a cap and a mid-point checkpoint. A subscription or annual re-baseline model keeps the position current and suits estates with steady change, but check what the renewal year actually includes beyond a refreshed spreadsheet. Be slowest to sign contingency structures priced on “risk found” or “savings identified”: a provider paid on the size of the gap has an interest in the most aggressive compliant-or-not interpretation available, which is precisely the judgment you are paying it to make soberly. The fee models guide dissects all four shapes; we publish no prices anywhere on this site.
One structural question matters more than the rest: does the assessor profit from the remediation? If the firm that sizes your gap also sells the licenses that close it, or the migration that absorbs it, the assessment is the front end of a sales motion. That does not make the finding wrong — it makes independent verification of the finding worth its cost.
Five provider types sell Microsoft compliance assessments. Capability and conflict are separate questions; the table states both factually.
| PROVIDER TYPE | WHAT IT BRINGS TO AN ELP | THE TRADE-OFF TO WEIGH |
|---|---|---|
| Independent licensing boutique | ELP construction is core trade; no Microsoft revenue; findings built to survive auditor scrutiny because the same team defends audits | Smaller benches — confirm capacity for your estate size, geographic coverage and who personally runs the reconciliation |
| Big 4 / large advisory practice | Audit-grade process discipline, global reach, board-credible reporting, comfortable alongside M&A due diligence | The same firms deliver vendor-commissioned reviews elsewhere — ask about Microsoft audit work and information barriers |
| Reseller / LSP advisory arm | Holds your transaction history, which shortcuts entitlement reconstruction; commercially fluent on remediation options | Margin and incentives depend on Microsoft, and the remediation it proposes may be the product it sells |
| Microsoft partner delivering SAM engagements | Polished tooling and methodology; sometimes offered at no charge because Microsoft funds the program | The engagement exists inside Microsoft’s compliance program — outputs and methodology serve the funder, and your data travels |
| SAM tooling services arm | Instrumented discovery at speed; strong inventory accuracy across hybrid estates; continuous-monitoring options | Inventory is not entitlement — check who performs the contract archaeology and metric interpretation, and whether the assessment requires the platform |
The cross-vendor view of this landscape sits in the managed SAM provider guide — an ELP is a point-in-time snapshot of what a SAM program maintains continuously. To see who covers this cell, filter the directory to Microsoft.
Auditor-grade method, buyer-side loyalty. The useful question is not “have you done ELPs” but “would your ELP survive the other side’s review.” Providers whose staff have sat on vendor-commissioned reviews know what evidence standards findings are held to; providers who also defend audits know which interpretations bend. You want the method of the former with the loyalties of the latter — run the independence test to establish which you are buying.
Entitlement archaeology, demonstrated. Ask candidates to walk through a past reconstruction: how they handled a lapsed Software Assurance chain, a merged entity’s Select-era licenses, or CSP purchases across three resellers. Listen for process — license statements requested from Microsoft, reseller records cross-checked, entity mapping documented — rather than “our tool handles it.” No tool reads a 2009 agreement amendment.
Virtualization fluency you can test in the room. Put your cluster architecture on a whiteboard and ask where the SQL Server findings would land, what evidence Azure Hybrid Benefit needs, and which failover scenarios are actually covered. The first ten minutes of that answer are hard to fake and cheap to test.
Remediation options, plural. A finished position should price the gap as license purchase, as architectural change (re-hosting, consolidating, hybrid-benefit reassignment), and as a negotiation position for the next renewal conversation — with the July 2026 suite repackaging and seat-tier changes factored in, not discovered later. One number with one fix is a sales document.
The free assessment with quiet funding. If the work costs you nothing, establish who is paying before you accept — Microsoft-funded SAM engagements are a compliance channel, and the currency is your deployment data.
Tool purchase as a precondition. A provider that cannot start without selling you a platform subscription is selling the platform. Tooling can serve the assessment; the assessment should never exist to justify the tooling.
Findings sized before evidence. A candidate who estimates your exposure on the first call — particularly a dramatic one — is marketing, not measuring. Exposure claims precede gain-share proposals suspiciously often.
No position on data custody. Ask where your deployment data sits, who can see it, and what happens to it after the engagement. An assessor without a firm answer has not thought about the scenario where Microsoft asks for it.
Entitlement treated as an import job. If the proposal allocates a week to entitlement and a month to deployment scanning, the hard half of your position will be guessed. The ratio should run the other way in any estate with history.
1. Walk us through the last Microsoft ELP you built for an estate like ours — what did entitlement reconstruction involve, and what could you not resolve?
2. Does your firm or any affiliate earn Microsoft reseller margin or partner incentives, or deliver Microsoft-funded SAM engagements? Who, exactly, pays for this assessment?
3. Looking at our architecture, where do you expect the gaps to concentrate — and where do you expect to find shelfware we can harvest?
4. What data do you collect, with what tooling, where is it stored, and what is your protocol if Microsoft or an appointed auditor later requests it?
5. Will the deliverable price remediation more than one way — purchase, re-architecture, renewal leverage — and will your team stand behind the position if it is later challenged in a review?
6. If we migrate from EA to MCA-E at the next renewal, how does that change what you would fix before signature versus after?
The broader interview script, applicable to any licensing engagement, is the foundation guide 20 questions to ask; on timing, when to bring in help makes the case for baselining before the contract event, not during it.
Firm-agnostic guides — when you are ready to compare actual firms, the Microsoft directory lists them with balanced pros and cons.
When the review is already running →
Keeping the position current year-round →
Why the pre-migration baseline matters →
Per-core vs Server+CAL, decided properly →
See the firms that do this work →
Every field guide on the site →
A compliance assessment is work you commission on your own clock: a provider builds your effective license position, finds the gaps and surpluses, and gives you remediation options before Microsoft is involved. Audit defense starts after Microsoft or its appointed reviewer has opened a review and the timetable is no longer yours. The same skills underpin both — which is why a strong assessment provider is often the firm you would also want in a defense.
Understand what it is first: partner-delivered SAM engagements are typically funded by Microsoft, and the methodology and outputs serve Microsoft’s compliance program. The price is your deployment data. Some buyers accept one deliberately with an independent review running alongside; accepting one casually, without controlling what is collected and disclosed, hands over the exact evidence a later commercial discussion will be built on.
The common pattern is a full effective license position ahead of each major contract event — a renewal, an EA-to-MCA-E migration, a merger or divestiture, a datacenter or cloud move — with lighter refreshes annually or when the estate changes materially. A position built three years ago describes an estate that no longer exists.
No. A capable provider works from the instrumentation you already have — SCCM or Intune inventory, vCenter or Hyper-V configuration exports, Active Directory and Microsoft 365 admin-center data — supplemented by its own collection where coverage is thin. If a proposal makes a tool purchase a precondition of the assessment, you are being sold a platform, not a position.
An internal license position is your work product and is not handed to Microsoft, but it is discoverable in a later dispute unless structured otherwise. Where the estate is sensitive, buyers sometimes commission the work through legal counsel so privilege can attach — the lawyer vs consultant guide covers when that is worth doing. Discuss disclosure handling and document custody with candidates before work starts.
This guide is firm-agnostic: it explains how to evaluate candidates and names no providers. The Microsoft compliance assessment page lists the firms that actually do this work, each with balanced pros and cons, in neutral alphabetical order — listed, not ranked.
Tell us what is driving the assessment — a renewal date, an MCA-E migration, a transaction, or plain uncertainty — and we will route your brief to firms with genuine Microsoft ELP practices. The directory and matching are free for buyers, no vendor ever sees your brief, and we add no markup.
Our weekly dispatch on vendor audit programs, regional developments and one buyer move. Subscribe to The Licensing Radar.