Microsoft SPLA: everything you need to know

In simpler terms, Microsoft SPLA means that you can deliver tailored IT services to customers without upfront costs, making it a beneficial license program. Providers pay only for products made available to customers and usage is reported monthly.

What are the disadvantages of Microsoft SPLA?

While Microsoft SPLA is a useful agreement for many Microsoft solution providers, it can be difficult to maintain and remain compliant. Service providers must report the quantity of SPLA licenses their customers used in total each month. Depending on the total costs, customers may need to provide further details.

There’s also required agreements for certain scenarios such as when using software services resellers or outsourcing.

Audit firms conduct SPLA audits on behalf of Microsoft, and these audits look back over several months or even years, meaning that even small non-compliance issues escalate quickly and pose significant risk. Additional license purchases come at a list price of 125%.

The most common issues found in these audits include:

• Windows server: as mentioned above, the biggest risk in audits is that any shortfalls are multiplied across multiple months, which can be particularly costly when it comes to Windows Server. Licensing Windows Server through SPLA has some differences to the rules in volume licensing, which makes it a higher risk
• Access restrictions: providers must maintain robust controls around which users are provisioned to access applications. User licensing in Microsoft is based on users who can access software, not just those who actually do, so ensuring this is managed correctly is important
• Active directory hygiene: if user access is not restricted, all of the users in active directory (with the exception of system/ generic accounts) will be assigned User SAL requirements. Keeping the active directory up to date by disabling users who are no longer active will reduce this impact
• End user installations by customers: as an SPLA provider, you are responsible for software identified, even if this has been installed by end customers. It’s important that the correct controls are in place to prevent, or at least be aware of what end customers install so the correct licensing can be reported
• Understanding the SPUR (Services Provider Use Rights): the SPUR details how products are allowed to be utilized, so it’s crucial to read and understand the relevant SPUR to ensure proper reporting