RSS

Category Archives: Compliance

Steps to take to limit SPLA audit exposure

It’s the fourth quarter at Microsoft, this means audits are in full swing.  One of the easiest ways to collect large upfront payments are through SPLA audits.  Knowing this, what steps can you take to limit your audit exposure?

  1. Inventory – Although you submit a SPLA usage report each month, licenses are missed inadvertently.  When collecting inventory of what you should and should not report, be sure to include customer owned licenses.  If ANY customers are bringing licenses into your datacenter, they must have software assurance if it’s a shared environment.  Secondly, make sure to take a hard look at SQL.  To no one’s surprise, SQL is very expensive.  If you miss license SQL, it can add up really quickly.
  2. Agreements – Which MBSA agreement did you sign?  Don’t know what a MBSA agreement is?  Please ask your reseller for a copy.  Every SPLA customer has a signed Master Agreement.  This is the umbrella that ties all your Microsoft agreements together including SPLA.  There’s specific language in the agreement that goes over audits and the timeframe in which they are able to audit historically. Look closely at your agreements with your customer.  Did you mention they are responsible for licenses they bring into your datacenter?  Did you send them a license verification form for license mobility?  Do you have language that states they are responsible for anything under their Microsoft agreement but you are only responsible for yours?  Do you make the end user license terms (part of your signed SPLA) available to all customers?  Don’t know what an end user license terms agreement is?  Ask your reseller.
  3. Check AD closely.  Do you have administrative accounts that you are reporting?  What about test accounts?  Read your Microsoft SPLA agreement around testing, developing, and administrative access.
  4. Label server names appropriately – Label if a server is “passive” and label a server if it’s “development”.  This can save you time with the auditors.
  5. Check server install dates – If a server was active June, 2013 but nothing was reported on that server until June, 2015; Microsoft is going to ask A) what that server is doing and B) Why haven’t you reported it.  If it’s doing nothing, than shut it down before the audit.
  6. Check SAL licenses –  Do all users who potentially HAVE access are being reported?
  7. Check Office licenses – Do all users need access to Office Pro Plus?  Can they get away with Standard?  Did your engineers inadvertently publish Visio to every user when it only needs to go to a handful of end users?
  8. Double check server versions – Did your engineers accidentally install SQL Enterprise when it should be Standard?
  9. Are you taking advantage of all the use rights available?  As a SPLA, are you aware you can provide demonstrations to your customers at no charge?  Are you aware of the admin rights?  Are you aware you can run 50% of what you are hosting externally – internally?  (must actually report it all under SPLA – they are not free).
  10. Virtualization rights – Are you reporting SQL Enterprise to run unlimited VM’s? Are you running Windows Datacenter?  Remember, you do not license the individual VMs for Windows Server.  (You count physical cores which allows 1 VM for Standard or unlimited for Datacenter).
  11. MSDN, VDI, and other restrictions – No, you cannot host VDI and MSDN in a shared environment.  If you are, dedicate the servers immediately.  If you are hosting from the same hardware you are running internally, this also must be separated.
  12. Hiring Experts – Are they really experts or just advertise as such?

Hope this helps.  Any questions email info@splalicensing.com

Thanks for reading,

SPLA Man

 

 
Leave a comment

Posted by on April 25, 2017 in Compliance

 

Tags: , , , , , , , , , , , , , ,

Epic Community Connect and SPLA

The healthcare community has increased concerns with the way they have deployed (and licensed) their electronic medical record (EMR) software such as Epic Community Connect and others.  As a reader of this blog, you know that when you deploy software for the benefit of a third party (non employee) SPLA must be part of the conversation.  The only exception to this rule is if you actually own the code to the software you are hosting.  In other words, if you developed the software, you can use your own volume licenses to host your software.  If you host a third party software (such as Epic) you must license this in SPLA.   In most cases, many healthcare companies do not own the application, but lease it from the EMR vendor.

Rewind a few years and let’s pretend you are a large hospital who partnered with Epic to provide best in class patient record management for your clients, doctors, and other clinics. Your Epic deployment resides on a Windows Server, SQL Server, and RDS.  As the IT director, you purchased several server licenses and hundreds of Client Access Licenses (CAL) to cover all the external users.  You think you are covered; no one mentions you need to license this via SPLA.  Your reseller didn’t tell you, Microsoft didn’t tell you, and for that matter the vendor didn’t tell you.  You think all is well based off the information you received.  Fast forward 3 years and your volume licensing agreement is up for renewal.  Someone on the licensing side informs you that you shouldn’t true-up licenses or renew your agreement under volume licensing, you need to license SPLA.  You think that’s fine, if you must license under a different program who are you to argue. But what about all those license you already purchased and own?  Unfortunately, you cannot return them, you must allocate those internally.  You think to yourself that’s fine, except for one minor detail…. you purchased hundreds of CALs and you do not have hundreds of employees; those license you own are essentially worthless.  On top of everything else, you just received an audit notification.

Why would they receive an audit notification?  Once a vendor recognizes you have been under-licensed, the vendor might want to dig in deeper to see how long you have been out of compliant and if you purchased enough licenses to cover all the users.  In 90% of all audits, the customer is under-licensed.  Now you own licenses you don’t need, but should’ve purchased more because you don’t own enough licenses to cover all external users initially.  The vendor will want you to pay the delta of what you should’ve paid under SPLA and what you purchased under volume licensing (plus an audit fee).

If you are a healthcare provider and have been notified by Microsoft or any other vendor, please contact us.  We have found that in many cases the licenses report is not always 100% accurate.

Thanks for reading,

SPLA Man

 
Leave a comment

Posted by on October 12, 2016 in Compliance, EMR Software, Self Hosted

 

Tags: , , , , , , , , , , , , , , , ,

Microsoft Audit Support

There’s a new service called SAM for SPLA.  Every day I get asked about a tool or a resource to help manage SPLA environments.  There are two types of SPLA audit support:

  1. Audit Prevention – If you are having trouble tracking SPLA usage each month, this is an opportunity to partner with us to help manage the process and ensure what you are reporting is accurate.  Yes, we can review your reporting, but that doesn’t do us any good if we don’t know what you are submitting is accurate.
  2. Audit Support – Don’t go through an audit alone; don’t go through it with someone else either.   As soon as you hire outside legal counsel, the vendor will go right to their legal as well.  That’s why it’s best to work with someone behind the scenes where you control the outcome, not a lawyer.  There are a ton of resources and SAM practices out there in the world; very few actually work with SPLA.

Thanks for reading!

SPLA Man

 

 

 
Leave a comment

Posted by on March 3, 2016 in Compliance, Uncategorized

 

Do you have SA? Why this question really matters.

Brett’s Hosting’s sales director is consistently looking on the web to see what competition is advertising.  It drives him nuts to see other “hoster’s” advertise SharePoint for less than what he can get directly from his reseller.  He’s upset..big time.   How can this be?  Then he stumbles upon the Microsoft Office 365 website.  He blew a gasket.  “There is no way I can compete!  I am going to go out of business!”

So the sales director decided to get creative.  “I will forgo SPLA and just have my customers purchase SharePoint.  They bring it into my datacenter, I won’t report SPLA anymore.”  So that’s what he did.  He started selling SharePoint by the truckload.  Their reseller kept placing orders for him as they’d joyfully ask  “how many CAL’s do you need?” and they would order it; never once asking what it was for.

Brett’s Hosting did a tremendous job marketing their SharePoint offering.  “No SharePoint…No Problem!” It was marvelous.  The CEO of Brett’s Hosting vociferously announced at the World Partner Conference “We are hosting over 10,000 SharePoint sites!”  The celebration continued.  Then one foggy October morning, the office manager for Brett’s Hosting received a letter from Microsoft.  She excitedly opened it thinking they were being promoted as ‘SharePoint Partner of the Year’ but was severely disappointed.  It was an audit letter.  The story turns.

Brett’s Hosting CEO reviewed the letter and then called in their sales director (now sales VP).  The CEO threatened him with his job unless he fixed this mess.  The sales director/VP was at a loss.  “Where did I go wrong.”

To be continued….

Where do you think he went wrong?  Have you ever been given wrong licensing advice?  You don’t need to answer that, I already know.

Hosting industry has changed.  Competition has changed.  End users have changed.  In my experience, the conversation has changed from “how do I license Windows” to “what are ways I can optimize my licensing spend?”  I’ve written about license mobility; I also reviewed SAL for SA.  Those two programs have a common theme – Software Assurance (SA).  In the above fictitious story, the sales person should’ve asked his customer “do you have SA on these licenses”  That question is important because if they do not have SA, the entire environment (hardware/VM) must be dedicated.

I can’t stress this enough.  The hosting game is getting brutal.  Every service provider is looking for a way to cut/reduce costs.  Getting in compliance hot water is not a good way to do that.  If the customer does not have SA, you can certainly use SPLA in its place.  If you go this route, be sure to make it a bundled solution.  Telling customers they must pay for something they already own is not an easy conversation.

The customer can also purchase SA.  You just have to be ready to clearly explain their options. That’s why it’s important to work with a reseller that understand SA benefits to help educate and coach you through the process; not all products are eligible.  Be prepared.

Story continued…

The sales vp went back to his customers and asked them to purchase Software Assurance.  When the customer asked “why?” all the sales vp could say is “because Microsoft told me you needed it.” (he clearly couldn’t explain why…it only made the customer more upset).  The customer simultaneously yelled and slammed the door –  “I’m going to Joe’s Hosting! They advertise VDI too!”

The sales vp went back to his CEO and was forced to resign.  The customer went to Joe’s Hosting and was very happy for over a year. When out of the blue he received a call from his sale rep from Joe’s Hosting.  The sales rep frantically told him they could no longer offer VDI; it apparently is not available under SPLA.  The sales rep also asked him to buy SA for his SharePoint…”Microsoft told me you needed it!” The customer loses again!

Moral of the story – read the SPUR, read the PUR, and don’t be afraid to ask “Do you want SA with that?”

Thanks for reading

SPLA Man

 

 

 

Tags: , , ,

Top Reporting Errors

Here’s a list of common mistakes service providers make when reporting SPLA.  Don’t say we didn’t warn you!

  1. Reporting only (1) 2 core pack (must report a minimum of 4 cores)
  2. Office without RDS
  3. CRM without SQL
  4. SharePoint without SQL
  5. Reporting SharePoint Enterprise without reporting Standard
  6. Miss combination of Windows and SQL
  7. Agreement without Windows Server
  8. Reporting SQL processors on a recently signed agreement
  9. Using SQL Web to support a line of business application
  10. Reporting less than $100 on a recently signed agreement.

I understand there are many more, but this is a list you can control month end and month out.  More difficult licensing errors to correct include: hosting SPLA on servers that are also consumed internally; installing SPLA software on hardware you don’t control or have access; and using System Center to manage both internal and external facing applications.

Correct it now before it’s too late.

Thanks for reading,

SPLA Man

 
7 Comments

Posted by on September 26, 2014 in Compliance

 

SPLA Audit start to finish

Your business is doing great, your sellers and customers are happy, you are making money instead of spending money, when out of the blue….BAM…you receive an audit letter.  Sound familiar?

So what do you do?  Your first reaction is panic.  Your second reaction is to call a lawyer.  Your third reaction is to blame your reseller.  I think that about sums it up.  If you disagree, I’m not 100% sure you are being truthful with yourself.  If you do agree, I also think you are making a HUGE mistake.  Sounds a little odd doesn’t it?

First thing you need to understand is it’s not your fault.  It’s not as if you are purposely trying to be out of compliant.  Microsoft knows this as well.  SPLA is a difficult program and very hard to understand. As I pointed out in the “About” section of this blog, there is little information written about the SPLA program leaving service providers vulnerable.  The SPUR?  Forget about it. That’s why I created this blog in the first place.

I think that is why SPLA customers call a lawyer to help guide them.  This may help you sleep at night, but is it REALLY helping?  I will let you determine that after the dust settles.

What does happen during an audit? I don’t care if this is the first step or fourth step but at some point you will have to collect data.  Data that PROVES the reason you reported the way you did.  One of the biggest mistakes a SPLA provider can make is not reporting indirect access.  Again, not your fault.  Who has any idea of what “indirect” really means?  Think of indirect as Microsoft software that is used to run your other applications that you market to your customers.  You have an application that you developed that reports back to SQL using Excel.  Users have no idea they are using SQL, all they know is the application they use.  But since SQL is part of your hosted solution…it must be reported.  Make sense?  That’s also why Windows will always need to be reported.  Try running Exchange without a Windows OS.  Not going to happen.

Data can also mean the licenses that your customers own that they bring over to your environment.  How do you know who owns what?  Are there enough CAL’s?  One of the arguments service providers make is they can go after their customers if being audited.  There’s an easy conversation right?  Remember, you want to keep customers not lose them.

Some service providers have learned that their end customers install software on VM’s without informing them.  How do you know what is actually being installed?  So take a look at your datacenter; are your customers installing software you don’t know about?  Collecting this information after the fact is a difficult process.  This leaves auditors with no choice but to make a best guess.  Best guesses can cost you significantly.

So after all this data is analyzed by the audit team, it is then delivered to Microsoft.  That’s when you present your case.  They will take things into consideration, but understand that if you are missing information, it makes your argument that much more difficult.  Don’t blame your reseller, that doesn’t work.  Don’t rely on a lawyer, that doesn’t always work either.  Educate yourself.  That’s the best advice I can provide.  Just by taking the time to read this I think you are on the right path.

Happy to walk you through the process in greater detail.  I am one of the few that actually gets it. My email is at the top righthand side of this page.

Thanks,

SPLA Man

 

 
Leave a comment

Posted by on September 18, 2014 in Compliance

 

Tags: , , , , , , , ,

Hybrid, Dedicated, and Shared Scenarios…

There are three deployment options for service providers – Hybrid (mix of on premise and cloud) Dedicated, and Shared.  In this article, we will break each one down to explain how they work and the options available.

Dedicated Scenario – (3 options available)

Option 1
Your customer decides to bring their own software (such as Exchange) and infrastructure (Windows) via their own volume licensing agreement. They do not have software assurance on the software. Can they do this?

Yes. Why? Everything is dedicated. Server, virtual machine all dedicated to one single organization. Software Assurance is NOT required.

Option 2
Your customer decides to bring the software but the hoster will provide the infrastructure in a dedicated environment. Again, customer does not need Software Assurance if it’s a dedicated environment. In this scenario, the hoster (you) will provide the Windows license via SPLA and not report the other applications the customer brings over since it is already covered via their own volume licensing agreement. This is applicable, it’s dedicated (VM and physical servers)

Option 3
Your customer is a healthcare company that needs a dedicated environment due to regulatory compliance. They do not own any software; they would need the hoster to supply the software licenses. Can they (the hoster) do this? Yes, the hoster would report everything under SPLA. The hoster (you) CANNOT use your own volume licensing agreement to provide the solution but you can certainly provide SPLA. Please be aware that if you own a volume licensing agreement, you cannot use the same hardware your volume licensing agreement resides as your hosted solution.

Also keep in mind that SPLA is non perpetual, when the customer leaves, they can no longer use the software they were accessing.

Summary of Dedicated –
Dedicated is applicable for both SPLA and end customer owned volume licensing. Dedicated also means dedicated hardware and dedicated VM’s. In dedicated environments, the end customer DOES NOT need software assurance. From a compliance perspective, it is defined as the following:

“Any hardware running an instance of Microsoft software (OS or application) must be dedicated to a single customer. For example, a SAN device that is not running any Microsoft software may be shared by more than one customer; since, a server or SAN device that runs Microsoft software may only be used by one customer.” (source: Microsoft VDA FAQ)

Hybrid Scenarios – 3 options available

Option 1
You decide to offer your customer a shared infrastructure but they want the same applications to run on premise. A good option would be to have the customer purchase the server applications (think Exchange, SharePoint, Lync) with software assurance (SA) and run them on premise. You (the service provider) would run the same applications in your shared environment BUT report the SAL for SA SKU. Much cheaper option than standard SPLA prices. I wrote about this here This also works well for Disaster Recovery options.

Option 2 (not really a hybrid but just go with it)
You can use license mobility. Microsoft likes to define this as a “hybrid option” but to me, hybrid insinuates the ability to run on premise and in your cloud. License mobility is a SA benefit for certain applications (SQL, CRM, SharePoint, Exchange, Lync) that allows customers to leverage their investment in SA and transfer those licenses into a hosters shared infrastructure. Reason why I don’t think this is truly a hybrid is the customer is TRANSFERRING licenses into your datacenter. This means that if a customer wants to move back to their own datacenter, they have to wait 90 days. (transfer license rule). With SAL for SA, nothing is being transferred. Windows does not have mobility rights, this will need to be reported under your own SPLA. I wrote about license mobility many times – here’s an article for your review – here You can also check out the Microsoft site for more of a definitive definition http://www.microsoft.com/licensing/software-assurance/license-mobility.aspx

Option 3
Good Ole’ SPLA. Customer can run their own servers on premise, you just report SPLA licensing in your shared environment. The new SPLA agreement even allows you to run SPLA software on customer owned hardware as long as you still manage it.

Shared Scenarios – 2 options

Option 1
License Mobility – see above

Option 2
SPLA. We all know what that is.

Summary

I hope this brings a bit more clarity. Sorry if some things are redundant but at the same time, some things are simply worth repeating. Here’s the takeaway – customer’s can always bring licenses into your datacenter. There is no law of the land that prohibits this. What is prohibited is the way you deploy the technology. There is only one option to install customer owned licenses in a shared environment and that is license mobility. Again, (here I go being repetitive) if Microsoft allowed customer owned licenses to be installed in shared environments than why would they create license mobility?

If you still have trouble comprehending all this, shoot me an email located at the top right of this page. One general rule of thumb – if it’s shared – 90% of the time SPLA is required.

Thanks for reading

SPLA Man

 
12 Comments

Posted by on August 27, 2014 in Compliance, License Mobility

 

Tags: , , , , , , , ,

 
%d bloggers like this: