Article update (April, 2018 ) We created a new website called MSCloudlicensing to help SPLA and CSP partners understand the different program options and use rights available to them. The new website is www.mscloudlicensing.com it’s designed to be a collaborative platform that includes a forum to ask and answer licensing questions, document library, and licensing articles. Check it out, it’s free.
There’s a lot of benefits to moving to Azure, I’ll let your Microsoft account team review them with you. On this website, we are not that concerned about the benefits, all we care about is the licensing. In this article, we will review the Microsoft Online Services Terms.
What is the Microsoft Online Services Terms? First starters, it used to be called Microsoft Online Services Use Rights or MOLSUR for short (or long). It is now called OST pronounced OAST when speaking to Microsoft. Basically the OST defines how you may consume online services through Microsoft. You can download a copy here. Although your legal team should review the document in its entirety, below are some of the highlights I think you will find relevant and are often overlooked.
License Reassignment
“Most, but not all, SLs may be reassigned. Except as permitted in this paragraph or in the Online Service-specific Terms, Customer may not reassign an SL on a short-term basis (i.e., within 90 days of the last assignment). Customer may reassign an SL on a short-term basis to cover a user’s absence or the unavailability of a device that is out of service. Reassignment of an SL for any other purpose must be permanent. When Customer reassigns an SL from one device or user to another, Customer must block access and remove any related software from the former device or from the former user’s device.” (April, 2017 OST)
What does this mean?
Most Microsoft products cannot be reassigned on a short-term basis, that’s why Microsoft has the use right called license mobility. In short, pay attention to which users are assigned a license and if/when they no longer need the service.
Hosting Exception “Customer may create and maintain a Customer Solution and, despite anything to the contrary in Customer’s volume licensing agreement, combine Microsoft Azure Services with Customer Data owned or licensed by Customer or a third party, to create a Customer Solution using the Microsoft Azure Service and the Customer Data together. Customer may permit third parties to access and use the Microsoft Azure Services in connection with the use of that Customer Solution. Customer is responsible for that use and for ensuring that these terms and the terms and conditions of Customer’s volume licensing agreement are met by that use.” (April, 2017)
What does this mean?
It allows you (a service provider) the right to use Azure as a datacenter provider. The last sentence is very important in the above definition “Customer is responsible for that use and for ensuring that these terms and the terms and conditions of Customer’s volume licensing agreement are met by that use.” In the above definition, “customer” is you. If you use Azure as a datacenter provider, purchase Azure via your own volume licensing agreement, and use SPLA for user based products (e.g. RDS) you must follow the OST, Product Terms, and the SPUR!
Azure Services Limitations
Customer may not “Allow multiple users to directly or indirectly access any Microsoft Azure Service feature that is made available on a per user basis (e.g., Active Directory Premium). Specific reassignment terms applicable to a Microsoft Azure Service feature may be provided in supplemental documentation for that feature.” (April, 2017 OST)
What does this mean?
Sounds similar to a SAL license right? “Directly or Indirectly access any Microsoft Azure Service.” Although if you are using Azure as your datacenter provider, the likelihood of you consuming user based licensing through Azure is not very high.
Security
I encourage you to read the security measures and policy’s set forth by Microsoft for their online services. You can read it here. I included a breakdown of the difference compliance and security certifications below:
Microsoft Online Information Security Policy (as of April, 2017)
| Online Service | ISO 27001 | ISO 27002
Code of Practice |
ISO 27018
Code of Practice |
SSAE 16 SOC 1 Type II | SSAE 16 SOC 2 Type II |
| Office 365 Services | Yes | Yes | Yes | Yes | Yes |
| Microsoft Dynamics 365 Core Services | Yes | Yes | Yes | Yes* | Yes* |
| Microsoft Azure Core Services | Yes | Yes | Yes | Varies** | Varies** |
| Microsoft Cloud App Security | Yes | Yes | Yes | No | No |
| Microsoft Intune Online Services | Yes | Yes | Yes | Yes | Yes |
| Microsoft Power BI Services | Yes | Yes | Yes | No | No |
Last and certainly not least, I get asked A LOT about language that you should include as a service provider. I would encourage you to create your own online services terms for your hosted offerings. Too many providers do not have basic language around compliance, licensing, and overall use rights. At a minimum, you should include a copy of the End User License Terms for SPLA. If you do not have a copy, please contact your reseller. If you forget to include licensing terms and conditions, you could be on the hook during an audit. Don’t be on the hook.
Thanks for reading,
SPLA Man
SPLA Licensing 