A formal Microsoft audit usually runs several months from letter to settlement, and the timeline is a lever, not a fixed schedule. Used well, time works for the buyer.
One of the first questions leadership asks when an audit letter lands is how long this will take. The honest answer is that it depends, but the range is predictable and the timeline itself is one of your most useful tools. An audit is not a fixed schedule imposed on you. It is a sequence of stages, and at each stage the pace is partly yours to set.
A formal audit under the Microsoft Business and Services Agreement, run through a third party accounting firm, typically moves through these stages. Treat the durations as indicative, because every estate and every auditor is different.
| Stage | Indicative duration |
|---|---|
| Notice and scoping | 2 to 6 weeks |
| Data collection | 4 to 12 weeks |
| Auditor analysis and draft ELP | 4 to 8 weeks |
| Review and negotiation | 4 to 16 weeks |
| Settlement | 2 to 8 weeks |
Add it up and a typical formal audit runs somewhere between four and nine months. Complex estates, global footprints, and disputed findings push it longer. A clean, well prepared position can shorten it.
A self verification can move faster, because you are producing the assessment yourself, but moving fast is rarely in your interest. A SAM engagement has no fixed clock at all, since it is voluntary, which is exactly why you control its pace or decline it. A SPLA audit for hosters is its own animal, because it reconstructs every monthly reporting cycle across a 36 month lookback, and the data collection stage alone can be substantial.
Most of the elapsed time, and most of the leverage, sits in data collection. This is where the auditor asks for deployment records, configuration data, and usage information, and where your own Effective License Position should be taking shape in parallel. If you arrive at the draft ELP without your own number, the auditor's figure is the only one on the table and the negotiation starts from their high opening position.
Use the time you are given. The weeks of data collection are not dead time. They are the window in which you build the evidence that brings the final number down. Spend them.
Expect a formal audit to run for months, not weeks, and treat that as an advantage rather than a burden. The time exists to be used. A prepared buyer side position, built while the auditor collects data, is what turns a long timeline into a lower number. For the full sequence and a first response checklist, download the survival guide.
If this is live on your desk right now, we take over the process through our Microsoft audit defense engagement.
The survival guide maps every stage and shows where to push. Fixed fee or gainshare, both backed by our guarantee.
Download guideWeekly intelligence on Microsoft and SPLA audit moves and the buyer side defenses that work.