A license audit conducted by SAP, Oracle, or Microsoft is not a neutral compliance check. It is a structured commercial operation run by specialist teams whose objective is to convert a counting discrepancy into an additional purchase order. Understanding that mechanism fundamentally changes how you prepare for it.
Industry data makes the point clearly. According to an ITAM 2026 study published by Virima across 500 organizations, 48% of companies experienced at least one software audit in the past year (Virima, 2026). Microsoft leads the field, with 64% of respondents audited over three years, followed by Oracle (38%) and other vendors. On the cost side, 44% of organizations spent more than one million dollars on software audits over a three-year period (Virima, 2026).
This article does not cover ERP license audits in general terms. It focuses on the three vendors that generate the most claims in enterprise ERP portfolios: SAP, Oracle, and Microsoft. For each vendor, the trigger mechanisms, exposure zones, and defense levers are different. The ITAM/SAM (IT Asset Management / Software Asset Management) methodology provides the common backbone for preparing before the notification letter arrives.
SAP: Indirect Access and RISE Conversion as the Main Audit Drivers
Why SAP Audits More in 2026
SAP’s Global Licence Auditing (GLA) unit has significantly increased its audit volume since 2024. In 2026, one trigger dominates all others: conversion to RISE with SAP. According to Redress Compliance, a firm specializing in SAP license optimization, 70% of companies facing a major SAP audit receive a RISE commercial proposal within 90 days of notification (Redress Compliance, 2026). The audit serves as a negotiation lever to accelerate migration to the cloud model.
Indirect Access: 40–70% of Total Exposure
Indirect access refers to any use of an SAP system initiated by an unlicensed third party — whether an e-commerce application, a supplier portal, an external CRM, or an integration tool. In high-order-volume organizations, indirect access accounts for 40–70% of total exposure calculated during an audit (Redress Compliance, 2026). SAP has generated more than one billion dollars in additional revenue through this category since 2017.
The Digital Access model introduced with S/4HANA charges per processed document unit (purchase orders, invoices, delivery notes), with a weighting factor by document type: material documents count as 0.2, others as 1.0 in the taxable base calculation. An estate that creates 40 million documents per year can face a claim of several million euros if third-party integrations were not accounted for in the contract.
The Five Phases of an SAP Audit
A SAP audit typically runs eight to sixteen weeks across five stages:
- Notification: official letter with a 30-day response deadline.
- Measurement: execution of the USMM (User Measurement Monitor), SAP’s native counting tool.
- Results review: SAP submits its analysis with an initial claim.
- Negotiation: discussion phase based on submitted data.
- Settlement: closure via additional license purchase or contract adjustment.
The critical point is the measurement phase. Companies that submit the raw USMM output without prior validation pay a median 30–50% more than those that perform an internal reconciliation before responding (Redress Compliance, 2026). Named User reclassification, when contested, is granted in roughly four out of five cases, with a median 42% reduction on that claim line.
What to Do Before the Letter Arrives
- Run the USMM quarterly internally and retain timestamped outputs.
- Map all third-party integrations that read from or write into SAP.
- Verify whether Digital Access rights are covered under current contracts.
- Identify inactive or incorrectly profiled users before any renewal or RISE migration.
Oracle: LMS Traps and Database Options
LMS: A Commercial Division, Not a Neutral Service
Oracle License Management Services (LMS) is a division whose consultants are incentivized by the value of compliance gaps they identify (Oracle Licensing Experts, 2026). This structure creates a systematic information asymmetry in Oracle’s favor. Audited companies face teams that already know the key exposure zones before the first meeting.
Oracle opening claims consistently exceed the defensible amount after independent analysis. According to Oracle Licensing Experts, negotiated settlements with independent assistance come in 60–80% below the initial claim, with verified savings exceeding $500 million across more than 500 engagements.
The Three Main Exposure Areas
Unintentionally activated database options. The CONTROL_MANAGEMENT_PACK_ACCESS parameter defaults to DIAGNOSTIC+TUNING in approximately 40% of Oracle environments (Oracle Licensing Experts, 2026). This activates the Diagnostic Pack and Tuning Pack — two paid options — without DBA teams being aware. These options account for 40–60% of the gap identified in most Oracle audits. Other frequent sources: Real Application Clusters (RAC), Active Data Guard, Partitioning.
VMware virtualization. Oracle requires licenses for all physical cores in the VMware cluster on which its databases could potentially run, not just the cores assigned. On a large VxRail cluster, this multiplies the licensable core count by three or four compared to an intuitive reading of the contract.
Java SE since January 2023. The new Employee Metric model introduced in 2023 requires counting all internal employees, contractors, and temporary workers worldwide. A mid-sized international business with 500 declared Java users can face an obligation covering 5,000 people if subsidiaries and service providers are not contractually excluded.
The Five Phases of an Oracle Audit
An Oracle audit runs 120 to over 180 days:
- Notification (Day 0–14): formal letter with a 30-day response deadline, negotiable with legal representation.
- Scoping (Day 14–30): kickoff meeting. Oracle collects strategic environment information (versions, virtualization, number of instances).
- LMS scripts (Day 30–75): execution of USMM and Review Lite scripts. The company should request and analyze scripts before execution.
- Gap analysis (Day 75–120): Oracle presents its findings as a negotiating position, not a definitive finding.
- Negotiation and settlement (Day 120–180+): claim converted into a purchase proposal, with deadline pressure.
The ideal response from notification onward: engage independent counsel within 72 hours, refuse any disclosure before internal script analysis, and never treat LMS findings as established fact.
Microsoft Dynamics 365: True-Up and the SAM Engagement
A Shift in Posture in 2025–2026
Until recently, Dynamics 365 Finance and Supply Chain Management compliance largely relied on a declarative model. According to Avantiico, a specialized D365 integrator, Microsoft significantly tightened its approach in 2025–2026, moving from an honor-based verification to active telemetry-based validation (Avantiico, 2026). Microsoft now identifies gaps before notifying the company, which shifts the balance of power at first contact.
The Enterprise Agreement True-Up
For customers under an Enterprise Agreement, the annual True-Up is the moment of truth. The company submits a declaration of the number of licenses used at the renewal date. Any volume above the original contract generates an immediate surcharge, calculated at list price with no volume discount on the increment. 31% of Microsoft 365 enterprise licenses are underused or dormant (Cloudnuro, 2026), meaning most organizations overpay — but some also unintentionally under-declare D365 usage in secondary environments or service accounts.
Customers who performed an internal reconciliation before responding to a Microsoft audit reduced the final claim by a median of 28% (Redress Compliance, 2026).
SAM Engagement: Audit as Advisory
Microsoft frames its audits as “SAM Engagements” or “License Verification engagements.” The mechanism is contractually authorized in both the Enterprise Agreement and the Microsoft Customer Agreement. The key difference from SAP or Oracle: Microsoft often positions these exercises as an advisory service, not a hostile review. The financial outcome can be identical, but the initial posture is different.
Key D365-specific watch points:
- Active user counts versus dormant accounts across Finance, Supply Chain, Commerce.
- Distinction between “full user” and “team member” licenses on portals and reporting.
- Access rights for test, sandbox, and training environments: often not covered in the original scope.
- Copilot and AI modules: new pricing lines introduced in 2025–2026, often activated without contract adjustment.
ITAM/SAM: The Cross-Vendor Methodology
Why the Right Tool Is Not Enough
Organizations with a mature ITAM program reduce software spend by an average of 20–30% (Gartner 2024, cited in Virima, 2026). Yet 61% of procurement managers say their license data is “disorganized, inaccurate, or requires major corrections,” according to the Gartner 2026 Market Guide for Software Asset Management Tools (Virima, 2026). The problem is not the tool — it is the governance around the data.
An effective ITAM program rests on three distinct components:
1. The centralized repository. A living inventory of purchased licenses, contractual entitlements, usage conditions by vendor, and audit-clause terms. This repository must be separate from deployment tools (SCCM, Intune, SAP Basis) and regularly reconciled against invoices and contracts. Without it, every audit starts from scratch.
2. Continuous usage measurement. SAM tools (Flexera, Snow Software, ServiceNow SAM, Certero) capture real usage: active connections, modules used, access frequency. That data only has value if it is exported and retained with timestamps, since audits often cover a trailing 12–24-month period.
3. Exception governance. Every deviation from the standard license model must be documented: rationale, scope, owner, expiry date. An exception without an expiry date becomes a hidden rule — invisible during internal reviews but perfectly visible to an LMS or GLA auditor.
Four Governance Rituals to Institutionalize
- Monthly dormant-access review: progressive deactivation with management sign-off.
- Quarterly contract-vs-usage reconciliation: by vendor, by geographic scope.
- Semi-annual renewal preparation: procurement, finance, and IT alignment with verified usage data.
- Annual audit simulation: review known exposure zones (SAP indirect access, Oracle options, D365 accounts) before the vendor does.
Building Your Defense File: CIO/CFO Checklist
Whatever notification you receive, the quality of your response depends on an evidence file assembled in advance. Here are the seven minimum elements:
- Current contracts and amendments: master agreement, license terms by user type, audit and penalty clauses, technical annexes.
- Internal measurement history: USMM exports (SAP), internal Oracle scripts, Microsoft SAM reports — with dates and versions.
- Integration and third-party access map: for SAP, a complete list of systems that call APIs or generate documents in scope.
- Active exception register: with justification, scope, and scheduled review date.
- Signed access reviews: evidence that access rights have been periodically validated by management.
- Pre-identified independent advisor: a specialist in SAP/Oracle/Microsoft licensing, reachable within 72 hours of any notification.
- Single internal point of contact for vendor relations: one briefed individual with the mandate to coordinate without uncontrolled disclosure.
The fundamental rule: never submit raw data without prior analysis. Whether it is the SAP USMM, Oracle LMS scripts, or D365 reporting, raw data overstates exposure and weakens your negotiating position.
What a Mature ITAM Program Changes in Practice
Beyond audit defense, a rigorous ITAM program generates direct benefits across the license lifecycle:
- Renewal cost reduction by eliminating unused licenses.
- Budget reallocation toward business-value modules rather than compliance penalties.
- More favorable negotiation during migrations (SAP ECC to S/4HANA, Oracle to OCI, D365 to Copilot) because consumption baselines are documented.
- Reduced cash-flow risk from provisions for contractual disputes.
Organizations that have built an ITAM practice over two or more years approach audits from a position of strength: they know their gaps before the vendor does, and they can remediate before declaring them.
To go deeper, read our general ERP license audit guide and our checklist of 12 SoD controls to implement before the annual audit. To benchmark your situation across 30 ERP criteria, download our ERP evaluation grid.
