Virtual core counting is where many Microsoft audit findings begin. Here is exactly how auditors count virtual cores, the assumptions they apply when data is thin, and how to defend the count.
Core counting sounds mechanical, and for physical servers it nearly is. Virtual cores are where it gets contested, because the number depends on how the workload is licensed, how the host is configured, and what the auditor assumes when your records do not settle the question. The auditor's count is the basis of your Effective License Position, and a count built on conservative assumptions runs high. Knowing how the count is made is the first step to defending it.
When a formal audit reconstructs your position, it counts cores because most server products are licensed per core. For a virtual machine, the count begins with the virtual cores assigned to it, subject to a per virtual machine minimum that applies even to small instances. The auditor draws this from Microsoft's own counting methodology and data from Azure, Microsoft 365, and management tooling, cross checked against whatever you provide. The number that lands in your position is the auditor's reconstruction, not your intention, and the auditor's number governs unless you challenge it.
The auditor counts what the data shows and fills the gaps with assumptions. Where your records are thin, the assumptions are conservative, and conservative assumptions always run in Microsoft's favor.
Whether you license by virtual core or by physical core changes the count entirely. Licensing per virtual machine counts the virtual cores assigned to each instance, with the minimum applied. Licensing the full physical host instead can cover all the virtual machines on it, which is often cheaper at high density. The auditor will count whichever basis your licensing actually supports, and if the basis is unclear, it defaults to the count that produces the larger licensing requirement. Establishing the correct basis for each workload is therefore not a detail. It is the difference between a fair count and an inflated one.
| Counting question | Conservative default the auditor applies | The evidence that corrects it |
|---|---|---|
| Virtual cores per instance | Counted at assigned cores or the minimum, whichever is higher | Configuration data showing actual core allocation |
| Licensing basis | The basis that requires more licenses | Proof of how the workload is licensed |
| Host coverage | Per instance unless full host licensing is shown | Evidence the physical host is fully licensed |
| Transient instances | Counted if seen in telemetry | Records showing the instance was short lived and decommissioned |
The examples are indicative in concept and show how the count behaves, not real client data.
The count inflates for predictable reasons, and almost all of them come back to evidence. When the auditor cannot see how a workload is licensed, it assumes the basis that needs the most licenses. When a transient instance appears in telemetry but no record shows it was decommissioned, it stays in the count. When core allocation is not documented, the minimum or the assigned cores apply, never the lower of the two. None of this is the auditor acting in bad faith. It is the auditor following a methodology that resolves uncertainty against you, which is exactly why thin records produce high counts.
Virtual core counting matters because it feeds the threshold that drives the whole settlement. When a formal audit finds unlicensed use at 5 percent or more of total use, you reimburse the verification cost and acquire the missing licenses at 125 percent of price. Because virtual cores can be counted many times across a dense estate, a counting assumption applied across many hosts moves the unlicensed total quickly. Correcting the count is one of the most direct ways to keep a position under the 5 percent line, and it is won with evidence, not argument.
Virtual core counting is where a defensible position is made or lost, because the auditor resolves every uncertainty against you unless you supply the evidence. The Effective License Position guide shows how core counting fits the full reconciliation, and the related articles below cover the SQL Server pitfalls and the edition math that sit on top of the same cores. Get a quote and we will rebuild the virtual core count with the evidence the auditor will accept.
If an auditor is already asking questions, our Microsoft audit defense team manages every exchange with the auditor on your behalf.
Get a quote and we will rebuild your virtual core count the way the auditor will accept. Fixed Fee from $18,000 or Gainshare, both backed by our guarantee.
Get a QuoteWeekly intelligence on Microsoft and SPLA audit moves and the buyer side defenses that work.