The takeaway up front. A SPLA audit is won or lost month by month, so the defense is a faithful reconstruction of what you actually consumed in each reporting cycle across the 36 month lookback. When your records are incomplete, reconstruction is not guesswork, it is a disciplined rebuild from the operational data you do hold.
Why monthly, not a snapshot
SPLA is pay as you consume. You report what you used each month and you pay at the price file rate for that month. Because the obligation is monthly, the auditor verifies every month in scope, normally the full 36 month lookback. A current position that looks clean does not clear the months behind it. That is why an end customer style snapshot is useless here, and why your reconstruction has to be a timeline, not a single number.
The data sources that rebuild a month
Even where formal Subscriber Access License reports are missing, the consumption left a trail. A good reconstruction pulls from several independent sources and reconciles them against each other:
- Authentication and access logs that show active users or devices per product per month.
- Virtualization and hypervisor records that show which hosts ran which Microsoft workloads and for how long.
- Provisioning and billing systems that show when customers were onboarded, suspended, or offboarded.
- Configuration management and patch tooling exports that confirm product versions in production.
- Customer contracts that bound the scope of what each tenant was entitled to consume.
No single source is complete. Together they triangulate a defensible monthly figure. The auditor will build their number from your infrastructure data alone, which tends to read high because it counts capacity rather than licensed consumption. Your reconstruction counts what was actually licensable and used.
A worked reconstruction
Consider a single product, a Subscriber Access License for a productivity workload, over three sample months. The figures below are indicative and shown only to illustrate method.
| Month | Auditor capacity count | Reconstructed active SAL | Basis for the difference |
|---|---|---|---|
| Month 1 | 1,200 | 940 | Suspended tenants still provisioned in infrastructure |
| Month 2 | 1,200 | 910 | Internal administrator accounts excluded from SAL |
| Month 3 | 1,260 | 985 | Disaster recovery instances not in active use |
Across these three months the capacity count overstates licensed consumption by roughly a quarter. Multiply that pattern across 36 months and the gap between the auditor's opening figure and your reconstructed position is often the largest single item in the settlement.
Documenting the difference so it holds
A reconstruction is only as strong as its evidence. Every adjustment you make away from the auditor's capacity count needs a reason and a record. Suspended tenants need to be shown as suspended in the provisioning system for those months. Administrator exclusions need to map to the use rights that permit them. Disaster recovery instances need to match the disaster recovery terms in the rules that govern your products. Where the adjustment is documented, it survives challenge. Where it is asserted, it does not.
When records are genuinely incomplete
Most hosters do not have perfect 36 month records. That is normal and it is not fatal. Where a month has gaps, you reconstruct from the nearest reliable sources and you state your method openly. A transparent, conservative reconstruction with a clear method is far stronger than silence, because silence lets the auditor's capacity count stand unchallenged. The aim is not perfection, it is a defensible, evidenced position that moves the number toward reality.
How this connects to the penalty
Back fees at the price file rate are not negotiable. They follow directly from the reconstructed consumption, so getting that consumption right is the single most valuable thing you can do, because it sets the base on which everything else is calculated. The penalty uplift, which ranges from 25 to 125 percent, is negotiable, and a disciplined reconstruction is exactly the good faith evidence that argues the uplift down.
Your next step
If you are facing an audit and your monthly records are uneven, start the reconstruction before you answer the auditor's first data request. The full guide sets out the sources, the register format, and the sequence we use.
If an auditor is already asking questions, our SPLA reporting discipline service puts the monthly evidence in order before an auditor ever asks.