MICROSOFT AUDIT AND REVIEWS

Transcription

1 »Achieving Compliance, Control & Cost savings for your IT.«MICROSOFT AUDIT AND REVIEWS IT S GOOD TO BE BACK AGAIN Danny Gelens // Teamlead Microsoft SAM Softline Solutions Northern Europe

2 MICROSOFT AUDIT AND REVIEWS INTRODUCTION Danny Gelens Teamlead Microsoft Senior Business Consultant Background: 20 years in IT, 15 years in software licensing and since 3 years a full time focus on SAM Specialism: Microsoft licensing 2

3 IMPORTANT CHANGES IN MICROSOFT LICENSING» SCA amendment has been replaced by QMTH amendment (Qualified Multitenant Hoster Program)» Authorize HSP s to host customers Windows 10 virtual machines on dedicated or multitenant hardware» Authorize HSP s to host Office 365 ProPlus, Project Online Professional and Visio Pro for O365 on dedicated or multitenant hardware» Azure and SPLA All Products that are licensed by SALs can be moved to Azure» Products that are licensed by Cores/Processors are not allowed to be installed in a public cloud even if VM is dedicated (SCA mode) 3

4 EXCITING THINGS ARE HAPPENING» SPLA business is growing 35 40% in terms of annual revenue which Hosting Service Providers currently need to manage ITAM Review 4

5 EXITING THINGS ARE HAPPENING» By 2020 a corporate No-Cloud policy will be as rare as a No-Internet policy is today Gartner 5

6 AND SOME COME WITH A CHALLENGE» Although individuals and organizations are encouraged not to pay the ransom, cybercriminals still managed to rake in roughly $1 billion last year Trend Micro 2016 Security Roundup 6

7 AND SOME COME WITH A CHALLENGE» Rapid technological developments and globalization have brought new challenges for the protection of personal data. European Union 7

8 AND SOME COME WITH A CHALLENGE» If the Hosting Service Provider can not manage the growth of licensing and IT assets accordingly, it can have a big impact in the licensing and cost of ownership. 8

9 » HOSTING AND CLOUD SERVICES CAN PRESENT BIG CHALLENGES Challenges» Multiple vendors with complex license rules and their metrics;» Understanding what needs to be reported» With CSP, SCA, License Mobility, Azure and regular SPLA the ability to track licenses becomes more complex;» Collecting Inventory data» Monthly reporting is time consuming» Tracking licenses and usage can be complex and time consuming» Threat of an Audit

10 MICROSOFT AUDIT & REVIEWS

11 » WHY Microsoft wants to verify compliance but more important, they want to create a fair level playing field for all their partners.

12 SPLA COMPLIANCE VERIFICATION THE FLAVOURS WHICH TOOLS DOES MICROSOFT HAVE FOR VERIFYING COMPLIANCE SAM for Hosting Announced by local Microsoft sub Microsoft often position s the review as a way to avoid a contractual audit Introduced as value for the Partner (Review offers valuable insights and opportunities) Conducted by third-party auditor Shortfalls must be remedied but can happen under negotiated terms and current rates Negotiation with local Microsoft sub Self-Audit Self-assessment process represent a much more favorable framework for verifying compliance with SPLA Audit Announced by Microsoft Ireland No interaction with local Microsoft sub Conducted by KPMG, EY, Deloitte Shortfalls must be remedied and Microsoft can insist that licenses need to be reported with a markup over the current rates (125%) Microsoft can insist that the Partner reimburse it for the costs incurring in conducting the audit 12

13 SPLA COMPLIANCE VERIFICATION THE PROCESS 5 PHASES FRAMEWORK 1 Planning & Kick-off Determine the scope Set timelines Define requirements 3 Analysis Analysis of all Hard- and Software assets Compare deployments and usage against monthly SPLA reports Identification of delta s 5 Closing Present results to all parties Discuss licensing issues Regularization of eventual shortfall Improve and optimize Kick-off Data Collection Analysis Reporting Closing 2 Data Collection Inventory of: Hard- and Software assets License Data Deployment Data Usage Data 13 4 Reporting Report provided to Hosting Service Provider Review of report to identify errors or discrepancies Correct errors based on evidence or add notes Approve report

14 SPLA COMPLIANCE VERIFICATION SAM FOR HOSTING WHAT IS THE VALUE TO YOU, ACCORDING TO MICROSOFT A SAM for Hosting (SPLA) engagement provides you with recommendations and best practices for taking license inventory and reporting. The intent is to help you get the most out of SAM for Hosting, minimize compliance risks and identify cost saving opportunities Control Reduce technology conflicts and increase stability Help upderstand and protect your IT infrastructure Gain insight into actual usage and consumption Minimize risks associated with non-compliance Optimize Maximize workloads to achieve cost savings Manage your reporting requirements Enhance infrastructure efficiencies Improve datacenter security Align Increase your market position Improve budget predictability Acquire insight into company assets 14

15 FRIENDLY BUT WATCH OUT» The scope is the current and previous SPLA agremeent till the start date of the engagement» Contains a Historical-use element» Any software uninstalled after the inspection has started will be recorded as deployed in the report» The Historical License Position will be determined based scandata and other information» If no historical information of usage is available Microsoft will presume that any unreported use began upon commencement of End User relationship with HSP unless HSP reasonably demonstrates a different scope and duration» After 10 days from provisioning the Report to the HSP, the Report is considered final and shall be submitted to Microsoft 15

16 SPLA COMPLIANCE VERIFICATION» WHO IS ABLE TO GO BACK 18 MONTHS?

17 SPLA COMPLIANCE VERIFICATION» WHO IS ABLE TO GO BACK 36 MONTHS?

18 SPLA COMPLIANCE VERIFICATION» AND NOW 71 MONTHS?

19 THE POSITIVE AND NEGATIVE DELTA S» You have the right to adjust or revise the monthly use report within 60 days from the original invoice date» The financial value of the positive delta s is not deducted by Microsoft from the negative delta s during the settlement» During the settlement Microsoft will charge the value of the total unreported use 19

20 » WHO HAS ALREADY GONE THROUGH A FRIENDLY REVIEW OR AUDIT?

21 » LOOKING BACK: WHAT WOULD YOU HAVE DONE DIFFERENTLY?

22 SOFTLINE SOLUTIONS EXPERIENCES TOP-3 OF MOST COMMON PITFALLS No or limited access to (virtual) machines Hosting Service Provider has no access to the VM s (often IaaS) the HSP does not know what Product has been installed and is being used No or not properly configured security groups Access to particular software is not limited or limitation is not working correctly with the result that everyone has access to the software Wrong version of Software Product is installed Installed version of the Software Product is different according to the Product which is provided as a service 22

23 COMMON PITFALLS SOFTLINE SOLUTIONS EXPERIENCES (1/2) What are the most common pitfalls we encounter during a Microsoft SPLA review?» No or limited access to (virtual) machines (Hosting Service Provider has no access to the VM s (often IaaS) the HSP does not know what Product has been installed and is being used)» ISVR Licenses used on multitenant environments» TS Allow property is active for all accounts and no administration is available which accounts really access RDS functionality» Test or Demonstration environments are active for months without reporting licenses (in SPLA this is allowed for maximum 90 days, depening on the type of environment)» Using SQL Server Web to support Line-of-Business applications» No Standard Naming conventions for servers and accounts» Classification of AD accounts 23

24 COMMON PITFALLS SOFTLINE SOLUTIONS EXPERIENCES (2/2) What are the most common pitfalls we encounter during a Microsoft SPLA review?» Installed version of the Software Product is different according to the Product which is provided as a service» No or not properly configured security groups (access to particular software is not limited or limitation is not working correctly with the result that everyone has access to the software)» No proper management of Active Directory (End-Customer s users are still active despite the fact that they are no longer working for the organization and the provided services have been stopped)» Reporting SQL Server PROC licenses on a recently signed agreement» Providing Outlook to install locally from the Exchange Standard Plus SAL» Multi Language Pack is not free of charge in SPLA. (Unlike Multi Language Pack for Office in Volume Licensing or Office 365 ProPlus in CSP)» Providing Office 365 ProPlus from Shared Platform (without being CSP Tier-1 partner and having an SCA amendment signed) 24

25 TIPS AND TRICKS

26 TIPS & TRICKS (1/4) SPLA Agreement» Incorporate the End User License Terms into your customer agreements» Incorporate terms into your customer agreements according to responsibility» Submit an End Customer Enrollment (ECE) for every End Customer who is generating more than US Dollar license usage per month Monthly Reporting» Implement processes and procedures that allows you to accurately measure and report the monthly usage under SPLA;» Gather sufficient data on a monthly basis to allow a complete and accurate calculation of current usage;» Save the gathered data along with summary reporting that reflects the calculation in a repository» If an account is created during the month and disabled a couple of days later it needs to be reported for this particular month 26

27 TIPS & TRICKS (2/4) License Mobility through SA» Allows end customers to move eligible server applications to a dedicated VM on your shared servers.» You must be authorized mobility partner (SPLA Partner + LM amendment)» Active Software Assurance coverage is required on eligible licenses and an License Verification Form needs to be filled in» Keep a record of end user agreement and ensure SA is active for the product they are using under license mobility 27 Shared Computer Activation» Allows you to provide multiple Office 365 ProPlus, Project Pro for O365 and/or Visio Pro for O365 towards end customers on a shared hardware platform.» It enables installation of these Office 365 Applications on a network (RDS) server or on Azure.» If you want to provide Office 365 from your shared hardware platform you need a SCA amendment on your SPLA agreement.» You must be CSP Tier 1 partner (SPLA Partner + CSP Tier 1)

28 TIPS & TRICKS (3/4) Active Directory» Keep track of all users that have access to the software and ensure those that do not have access truly do not have access» Classify accounts and Avoid General accounts (or keep records who is using this account)» Manage your AD properly. Disable accounts which are not in use anymore.» Use a Standard Naming Convention for servers and accounts Security Groups» Use Security Groups to authorize users for a particular software product» Active management of your Security Groups;» Keep track of all users who are member of security groups and keep records when the user was added to or deleted from security group. 28

29 TIPS & TRICKS (4/4) General» Provide the right version of the software. For example: if Office Standard functionality is provided as an service, use the Office Standard media instead of Office Professional Plus media and limiting the functionality.» Keep track of all software which is installed by you or the end-customer (IaaS)» Avoid using a SA or general accounts for the connection between SQL if you are reporting SQL SALs» Keep accurate and complete records relating to all use and distribution of Microsoft software on a monthly basis» Separate your Internal Use Environment from the shared environment for end customers if you want to use Microsoft Partner licenses for your own purposes. 29

30 1. SPLA Agreement 2. Monthly Report 3. Active Directory 4. Security Groups Incorporate terms into your customer agreements according to responsibility Gather sufficient data on a monthly basis to allow a complete and accurate calculation of current usage; Save the gathered data along with summary reporting that reflects the calculation in a repository Classify accounts and Avoid General accounts (or keep records who is using this account) Keep track of all users who are member of security groups and keep records when the user was added to or deleted from security group. TIPS & TRICKS TOP-4

31 MICROSOFT WANTS TO REVIEW YOU HOW SHOULD YOU REACT?

32 A REVIEW NOTIFICATION HOW SHOULD YOU REACT? Peter s Datacenter Audit Reponse Team (ART) 32

33 PRELIMINARY RESULTS Audit Reponse Team (ART) 33

34 THE SETTLEMENT Meet in the middle. 34

35 OUR RECOMMENDATION» Politely decline Microsoft s SAM advances (for now) or try to postpone the audit» Begin to work with a third-party SAM consultancy firm to conduct a comprehensive, internal review of your current compliance status» Achieve the maximum flexibility to solve the findings» Once the internal review is complete, you will be in an excellent position to respond to any contractual audit demands that follow the rejection of the Friendly Review 35

36 »Achieving Compliance, Control & Cost savings for your IT.«THE NEXT STEP» Implement SAM processes and procedures according to Softline Solutions best practises» Implement tooling which helps you to:» reduce and simplify the complexity of licensing» identify potential security risks and vulnerabilities» prepare your business for privacy and GDPR» Achieve Compliance, Control & Cost savings together with Softline Solutions 36

37 THANK YOU! Danny Gelens // Teamlead Microsoft SAM PHONE // // Danny.Gelens@softline-group.com SOFTLINE SOLUTIONS NORTHERN EUROPE Softline Solutions Netherlands B.V. // Marconibaan 1C // 3439 MR Nieuwegein // Netherlands // Softline Solutions N.V. // Brusselstraat 51 // 2018 Antwerp // Belgium // Softline Solutions Ltd. // Kemp House, 152 City Road // London EC1V 2NX // United Kingdom //