Let’s be honest. Nobody opens a SPLA audit letter and feels good about it.

But I’ve been in the licensing trenches long enough to tell you this: the hosters who get hurt aren’t usually the ones who cheated. They’re the ones who stopped watching their reports. And right now, three things are making that easy to do.

1. The Listed Provider rule just turned one year old

On October 1, 2025, Microsoft’s rule kicked in: you can’t run your own SPLA licenses on AWS, Azure, Google or Alibaba infrastructure anymore. Microsoft announced it back in 2022 and gave everyone three years.

A year later, plenty of shops still have a few workloads sitting on a hyperscaler and getting reported through SPLA “for now.” Auditors can spot that one easily. It’s a placement question, not a judgment call.

If that’s you, fix the placement first. Move it, or license it directly through the provider. Then write down when you fixed it. That timeline matters if anyone asks.

2. Windows Server 2012 ESUs are done

The final Windows Server 2012/2012 R2 ESU update shipped October 13, 2026. Arc-enabled ESU licenses for 2012 deactivated the next day.

So if you’ve got 2012 boxes still running for customers, they’re now unpatched. That’s a security problem first. It’s also a sign that your inventory might not match what you think you’re reporting.

3. Windows Server 2016 hits end of support January 12, 2027

That’s about ten weeks out. Microsoft is offering Windows Server 2016 ESUs through Azure Arc, for up to three years (through 2030). You can set them up in the Azure portal now, and billing starts January 13, 2027.

Two details hosters should actually care about:

• SPLA-licensed 2016 machines don’t need Software Assurance to buy ESUs. Microsoft says that in its own docs.
• Arc ESUs bill through Azure, so they can draw down an existing Microsoft Azure Consumption Commitment (MACC).

Hang on to that second point. We’ll come back to it.

What a SPLA audit actually looks at

No mystery here. Microsoft sends an independent auditor, usually a Big Four firm. You get a notice letter and roughly 30 days to respond. They compare your monthly SPLA reports against what was actually deployed, often going back about three years.

If you come up more than 5% short, you’re typically looking at the under-reported licenses at current price, plus a 25% penalty, plus the auditor’s fees. (Check your own agreement for the exact terms. Mine isn’t the one that counts.)

Where the findings usually come from:

• Monthly reports that undercount what’s running
• Products mapped to an old SPUR (the use rights change regularly)
• Shared infrastructure and “who’s the end customer?” arguments
• Workloads in the wrong place (see #1)

So where does Azure Arc come in?

Here’s the part people ask me about.

You’ll hear partners and licensing advisors talk about steering an audit settlement toward a forward-looking Azure commitment, like a MACC or Arc-based consumption, instead of just writing one big backward-looking check. The thinking: Microsoft wants Azure growth, and you’ve got servers that need ESUs, management, and pay-as-you-go licensing anyway.

To be clear, Microsoft doesn’t publish an official “settle your SPLA audit with Azure Arc” program. I’m not aware of one. What people describe is a negotiation conversation. Some audit advisors say the claim, the SKUs and the back period are all negotiable, and payment terms usually are too. Whether a forward commitment is part of the deal depends on your account, your reseller, your PDM, and how much leverage you have. No guarantees.

Where Arc does genuinely help, no negotiation needed:

• Pay-as-you-go Windows Server and SQL Server. Arc is one of the few monthly, flexible options for those two products outside SPLA.
• ESUs for 2016 billed through Azure, which can draw down a MACC.
• Inventory and change tracking. It won’t replace your SPLA reporting or count as audit evidence by itself, but it makes it a lot harder for your reports to drift from reality.

If you’re going to commit Azure spend anyway, it can make sense to put that on the table. Just don’t sign a commitment you can’t burn down just to make an audit number look smaller. That’s trading one problem for another.

What I’d do this week

1. Pull your last 36 months of SPLA reports and match them to invoices.
2. Scan what’s actually running and reconcile it against the reports.
3. Find anything SPLA-licensed on a hyperscaler. Fix it and document it.
4. List every 2012 and 2016 server. Decide: upgrade, migrate, or Arc ESU.
5. If a letter’s already landed, don’t argue alone. Confirm the scope in writing and get independent help before you agree to a number.

This isn’t legal advice. Every SPLA agreement and every audit is a little different. But clean monthly reporting is still the best defense a hoster has, and that part’s in your hands.

If you want to talk through your SPLA reporting, an audit letter, or whether Arc makes sense for your 2016 fleet, that’s what we do at www.splalicensing.com. No pressure. Just a straight conversation.

---

Sources: Microsoft SPLA licensing guidance (microsoft.com/licensing/guidance/SPLA); Microsoft Learn, ESUs for Windows Server through Azure Arc; Windows Server 2016 lifecycle page; Windows Server Blog, Feb 25, 2026; Microsoft “Important SPLA Update” (Listed Providers); Redress Compliance SPLA audit guide.

Thanks for reading,

SPLA Man