What SPLA is
Under SPLA, the MSP — not the customer — is the licensee, so every compliance obligation sits with the MSP. The Services Provider License Agreement lets service providers and ISVs rent eligible Microsoft products monthly over a three-year term to deliver hosted software services to third parties. Licences are monthly subscriptions, reported in arrears; there is no upfront purchase and no perpetual right.
How the agreement is structured
An MSP signs SPLA through an authorised SPLA reseller, who collects the monthly reports and invoices; the usage rules live in a separate, monthly-updated document called the SPUR.
| Document | What it governs |
|---|---|
| Microsoft Business and Services Agreement (MBSA) | Master legal terms; required before signing SPLA |
| SPLA agreement (3-year term) | Reporting, payment, audit, termination and wind-down obligations |
| Services Provider Use Rights (SPUR) | Product-by-product use rights, licence models and counting rules; Microsoft can revise it monthly |
| SPUR Universal License Terms | Rules applying to every product: licence assignment, disaster recovery, multiplexing, activation |
| End User License Terms | Terms the MSP must flow down into every customer contract |
| Listed Providers list | Hyperscalers on whose infrastructure SPLA licences cannot be used |
Key contract mechanics:
- Microsoft Partner Network (now Microsoft AI Cloud Partner Program) membership is required.
- Affiliates and software-services resellers do not report separately; the MSP consolidates their usage into its own report.
- Termination for convenience needs 60 days' written notice. A wind-down period must be requested at least 30 days before expiry and allows no new end customers.
- Within 30 days of termination or expiry: file a final report and remove client software from end-user devices.
- Prices can fall at any time but rise only once a year on 1 January (plus currency adjustments for non-USD pricing).
Core obligations: reporting and counting
Every month the MSP must report peak licence requirements for the previous month to its reseller, certified accurate by an authorised representative; a missed report is itself non-compliance.
Monthly reporting rules
- Deadline: a use report or zero-use report for every calendar month, typically within 10 days of month end (resellers may set an earlier cut-off).
- Content: total licences required per product, plus the name and address of any end customer generating more than US$1,000/month of Microsoft revenue.
- Minimum spend: zero-use reports are allowed only for the first six months; from month seven, reporting under US$100/month can lead to termination.
- Corrections: a revised report that lowers fees needs a detailed explanation and must be filed within 60 days of the original invoice date.
- Exclusions: demos, evaluations, internal testing and server administration are not reported, but must be provable (e.g. labelled accounts in Active Directory).
- Internal use: allowed only if reported, paid for and below 50% of total reported use of each product.
Licence models
| Model | How it is counted | Typical products |
|---|---|---|
| Per Subscriber (SAL) | One SAL per unique user or device authorised to access, whether or not they actually used it | Exchange, SharePoint, Office desktop apps, RDS, SQL Server Standard (SAL) |
| Per Core (OS) | All physical cores on the host, minimum 8 per processor; Datacenter covers unlimited VMs, Standard covers 1 OSE (+ limited extra) | Windows Server |
| Per Core (Applications) | Physical cores (min 4 per processor) or virtual cores per VM (min 4 per VM); only Enterprise licensed on physical cores covers unlimited VMs | SQL Server |
| Per Processor | One licence per physical processor, per OSE; some products also need SALs | Legacy Dynamics ERP (NAV, GP) |
| Per Host / Guest | Host licences per processor on the host fabric, guest licences per VM, SALs for some guest functions | Cloud Platform Suite |
Counting rules that catch MSPs out
- Multiplexing or connection pooling does not reduce the SALs required.
- A licence cannot be reassigned to a different user or device within the same calendar month, except for hardware failure.
- Every graphical Windows Server session (RDS or any other technology) needs an RDS SAL; up to two admin users per instance are exempt.
- Windows desktop operating systems cannot be used for hosted desktops or desktop-as-a-service under SPLA.
- Disaster-recovery servers may run only for testing (one week every 90 days) or during an actual disaster.
- Prior versions and lower editions can be run, but you report and pay for the licensed version.
Customer-facing obligations
The MSP must contractually bind every end customer to Microsoft's End User License Terms and must know, per customer, whether a workload runs on SPLA licences or the customer's own.
- End User License Terms (EULT): must be in every customer contract or accepted online (click-through). Auditors check that every end customer has agreed to them; a missing EULT is a finding in its own right.
- Technical support: the MSP, not Microsoft, supports the products it delivers to customers.
- Customer-owned licences (BYOL): since October 2022 the Flexible Virtualization Benefit lets customers with Software Assurance or subscription licences bring them to an MSP's shared hardware. The MSP must keep eligibility evidence per instance and License Verification forms for older License Mobility arrangements.
- Do not mix: keep SPLA-licensed and customer-licensed workloads on separate hosts. Mixed hardware makes Windows Server Datacenter and SQL Server hard to defend in an audit.
- Dedicated hardware: where a customer brings licences that need dedicated hardware, the MSP needs contractual or other conclusive evidence of that dedication.
- Listed Providers: since 1 October 2025, SPLA licences cannot be used on Microsoft Azure, AWS, Google Cloud or Alibaba Cloud, directly or via an outsourcer who uses them (details). Workloads there must move to own or regional infrastructure, switch to the hyperscaler's licence-included offers, or be licensed another way.
- Data centre providers and outsourcers: an MSP may host on a third-party data centre provider or let an outsourcer manage servers, provided neither is (or uses) a Listed Provider.
- Product removals: legacy Dynamics products leave SPLA by 31 March 2026; check the SPUR's monthly Summary of Changes for others.
- Disclosure: desktops delivered as a service on SPLA must be identified as such in marketing materials.
Audits and common pitfalls
SPLA audits look at every month of the agreement, not a single snapshot, and any shortfall is charged at a premium. Where an MSP cannot show when a workload started, the auditor will assume it has been running unreported since the customer relationship began, so the burden of proof sits squarely with the MSP.
| Term | Detail |
|---|---|
| Notice | 30 days (per the MBSA) |
| Auditor | Independent firm appointed by Microsoft, usually EY, PwC, KPMG or Deloitte |
| Scope | Each calendar month; can run up to 2 years after the agreement ends |
| Shortfall pricing | 125% of list price, payable within 30 days |
| Audit costs | Borne by the MSP if non-compliance exceeds 5% |
| Surpluses | Over-reported months do not offset under-reported ones |
Audit rights flow from the MBSA and SPLA agreement; check the exact wording in your signed versions.
Where shortfalls usually come from
- User licences (SALs): usually the biggest gap — disabled or stale Active Directory accounts still counted, users given access but never reported, RDS sessions overlooked.
- Windows Server: hosts left unlicensed, or Standard deployed where the VM density needed Datacenter; difficult to argue down once found.
- SQL Server: if you can't prove which edition is installed, expect it to be treated as Enterprise.
- Customer-owned licences: no proof of Software Assurance or subscription cover, missing License Verification forms, or no evidence that hardware was dedicated.
- End User License Terms: customers who never signed or accepted them.
- Deployment history: no record of when workloads went live, so usage is back-billed to the start of each customer contract.
- Hyperscaler workloads: SPLA licences still running on Azure, AWS, Google Cloud or Alibaba Cloud after 30 September 2025.
- Spreadsheet reporting: manually declared figures are hard to defend when automated discovery could have produced the numbers.
Keep monthly reports, payment evidence and inventory snapshots for at least five years.
MSP self-check
0 of 15 checked
An MSP that can't tick every box below has audit exposure today.
Sources
- SPLA Program Guide, 13 May 2026
- Services Provider Use Rights (SPUR) — Universal License Terms, Windows Server, SQL Server, Summary of Changes
- SPLA agreement summary v20.40
This summary is for general guidance only. The signed SPLA, MBSA and current SPUR always take precedence; the SPUR changes monthly.