Most organizations discover their true audit readiness on the day a letter arrives, which is the worst possible moment to learn it. The better approach is to treat readiness as a measurable capability that can be assessed and improved before any audit, the same way security or financial control maturity is assessed. This article sets out a five level maturity model that applies to both tracks, the Microsoft end customer track and the SPLA hoster track, with the mechanics kept distinct because they are genuinely different. Use it to place yourself, then to plan the climb.
The destination of the climb is a defensible position, which on the end customer side means an accurate Effective License Position you can stand behind. For the foundational treatment of that, read the Effective License Position guide.
Why maturity, not a checklist
A checklist asks whether you have done a thing. A maturity model asks how reliably and how repeatably you do it, and whether the result would survive scrutiny. That distinction matters in audits because Microsoft does not test whether you own a tool or filed a report. It tests whether your position reconciles to its own view. SAM tool output is not audit defense, since Microsoft uses its own counting methodology and its own data from Azure, Microsoft 365, and management tooling, and Microsoft's calculation governs. In 2026 Microsoft also applies AI anomaly detection across licensing and telemetry to select targets, so the gap between a tidy looking estate and a defensible one is exactly what the targeting is built to find.
Readiness is not whether you have records. It is whether your records would hold when Microsoft counts its own way.
The five levels for the end customer track
On the Microsoft end customer track, where verification comes through a SAM engagement, a self verification, or a formal audit, the curve runs as follows.
The five levels for the hoster track
On the SPLA hoster track the mechanics are different, because SPLA is pay as you consume and compliance is verified for every monthly reporting cycle across a 36 month lookback by a Big Four firm under the MBSA audit clause. The maturity curve is built around reporting discipline rather than a periodic position.
What each climb actually costs you in an audit
The levels are not academic. They translate directly into money when an audit lands, because the gap between your evidence and the auditor's reconstruction is what the commercial outcome is built on. On the end customer side, the clause provides that if unlicensed use reaches 5 percent or more of total use, you reimburse Microsoft's verification costs and acquire the missing licenses at 125 percent of the current price. A level two organization meets that clause with a baseline it cannot defend. A level four organization meets it with evidence and keeps the number down.
On the hoster side, back fees at the price file rate are not negotiable, while the penalty uplift of 25 to 125 percent is. A level one hoster has nothing with which to argue the uplift down. A level four or five hoster argues it down from a position of demonstrable discipline. The maturity level you reach before the audit is, in effect, the size of the discount you can earn during it.
| Level | End customer in an audit | Hoster in an audit |
|---|---|---|
| 1 to 2 | Opening number stands; weak position | No uplift argument; full back fee base |
| 3 | Some corrections; partial defense | Count tightened; uplift argued partially |
| 4 to 5 | Defended ELP; exposure minimized | Count reconciled; uplift argued to the floor |
How to move up a level
The climb is incremental and each step is concrete. To move off level one you build a baseline. To reach level three you reconcile it against the way your counterparty actually counts, which for an end customer means Microsoft's method and for a hoster means the monthly reconstruction a Big Four auditor would perform. To reach level four you attach evidence to every claim, provable decommissions and matched entitlement for end customers, sealed counts and documented isolation for hosters. To reach level five you make the whole thing continuous so it never has to be rebuilt.
For the end customer, the practical starting moves are covered in building your internal position before the SAM call and in the discipline of choosing a SAM tool wisely. For the hoster, the foundation is the reporting discipline described in how monthly reporting drives exposure. In both cases the move from inventoried to defensible is where most of the financial benefit sits, and it is also the step most organizations skip until an audit forces it.
Where this leaves you
Locate yourself on the curve honestly. If you are at level one or two, you are carrying exposure you cannot currently quantify, and an audit would set the number for you. If you are at level three, you understand your gaps but may not yet be able to defend them with evidence. Level four is where an audit becomes a comparison against your records, and level five is where it becomes routine. The point of the model is that the climb is cheaper and calmer when done in advance than when forced under an audit clock.
A buyer side advisor assesses your maturity on either track, identifies the fastest path to a defensible level, and builds the evidence that the climb requires, on a Fixed Fee from $18,000 or on Gainshare, a share of verified savings or avoided penalty with zero retainer and no risk to you. The work is backed by our guarantee: we reduce your exposure or we reimburse our service fee. Book a strategy call and we will place you on the curve and plan the next level.
If an auditor is already asking questions, our Microsoft audit defense team manages every exchange with the auditor on your behalf.