Controlling a SAM Engagement If You Participate

Declining a SAM engagement outright and assessing yourself first is a recognized defensive move, but it is not the only valid path. Where the relationship with Microsoft matters, where the estate is genuinely clean, or where a renewal is in play, taking part can be the right decision. The risk is not participation itself. The risk is open ended participation, where you grant broad access, share whatever is asked, and let a voluntary review collect the very data that frames a sale or seeds a formal audit. This article is about how to participate without losing control.

Remember what you are inside

A SAM engagement is voluntary and sales led. That is the source of both its risk and your leverage. Because it is voluntary, you can set conditions that you could not set inside a self verification, which is a contractual demand, or a formal audit, which runs through a third party accounting firm under the audit clause. Participation should be a negotiated act, with terms you define, not an open door.

Scope the data before you share anything

The single most important control is defining, in writing, what data you will provide and what you will not, before any of it moves. Agree the products in scope, the entities in scope, and the time period. Provide curated extracts rather than raw tool access wherever possible. The goal is that everything Microsoft sees is something you chose to show, reconciled against your own records first, not a firehose that an analyst interprets without your context.

Hold tool access

Granting direct access to discovery tooling or to your management environment hands over the counting as well as the data. Microsoft uses its own methodology and its own telemetry from Azure, Microsoft 365, and management tooling, and direct access lets that methodology run unchallenged across your estate. Keep the counting on your side. Run your own assessment, present your own reconciled position, and treat any number the engagement produces as a draft to be checked against yours, never as the result.

Reserve your rights

Put it in writing that participation in a voluntary review is without prejudice and that nothing shared is an admission. This matters because the SAM motion can escalate. If a voluntary review becomes a formal audit, you do not want the cooperative data you shared to be treated as a concession on the count. A clean reservation of rights keeps the review and any later formal process separate. The escalation path itself is set out in from SAM engagement to formal audit.

The controls, in order

A controlled participation follows a sequence. Each step is a gate, not a formality.

• Route the engagement to procurement, licensing, and legal before agreeing to anything
• Run your own internal assessment first so you know your real Effective License Position
• Define the products, entities, and time period in scope in writing
• Provide curated extracts rather than raw tool or environment access
• Reserve your rights so nothing shared is treated as an admission
• Reconcile any engagement number against your own position before you accept any figure

Open versus controlled participation

The difference between the two is the difference between a review and an investigation you funded. The table is indicative.

Indicative comparison of participation styles, not a quoted case.

Where this sits in the playbook

Controlled participation is one branch of the wider response. The decision of whether to participate at all, and the controlled decline option, are covered in the SAM engagement response playbook, and the complete sequence with scripts lives in the SAM Engagement Playbook.

The next step

If you are weighing participation, the playbook gives you the scope letter language, the data sharing controls, and the reservation of rights wording you can adapt. Download the guide and take part on your terms, not theirs.

If an auditor is already asking questions, we manage the engagement through our SAM engagement response work.