The $3M Hosting Problem: When a Compliant Company Is Under-Reporting
We recently worked with a hosting company that believed it was fully compliant. They were reporting and paying every month. They weren’t hiding anything. But they were under-reporting 60% of what they owed.
I’m Paul Lindberg, president of Altaris Cloud — 17 years in Microsoft licensing and compliance, more than 600 audits personally. This is part of a six-part series on licensing risk in mergers and acquisitions. If your deal involves a hosting company, a managed service provider, or anyone delivering software as a service to third parties, this is the video to pay attention to.
SPLA Works Completely Differently
The service provider license agreement works completely differently from a standard volume agreement, and that difference is where the exposure lives.
Under a normal agreement, a company buys licenses up front. There’s a purchase order. There’s a quantity. There’s a paper trail you can audit against. Under SPLA, however, there is no purchase. The service provider self-reports usage every single month and pays only for what they report on a subscription basis.
The entire model runs on the accuracy of a monthly report that nobody independently verifies until an inspection happens. Let me say that again, because it’s the whole point: the financial accuracy of an SPLA hoster rests on a number they calculate themselves every month, with no external check.
Now, counting licenses across shared infrastructure is genuinely hard. I want to be fair about that. When you have multiple customers on shared hosts, virtual machines moving between clusters, and users connecting from anywhere, arriving at an accurate count takes real discipline, real tooling, and deep licensing knowledge. Most don’t have all three.
What It Looks Like in Practice
Here’s what it looks like in practice. We ran a compliance inspection on a hosting provider. During the inspection period, they had reported and paid roughly $1.3 million in license fees. Their actual net under-reporting was just over $2.1 million — 60% of their total obligation unreported. The under-reporting penalty and additional costs added another $600,000. Total findings and costs were approaching $3 million.
That’s a company that considered itself current and compliant. They were simply counting wrong. Now imagine that company is your client’s acquisition target, and that number lands 90 days after close.
The Most Common Root Cause
Let me tell you the single most common root cause, because it explains a large share of what we find. Windows Server must be licensed through SPLA unless the physical host hardware is fully dedicated to a single client and the client brings their own licenses. In any shared scenario, the service provider has to report that Windows Server consumption monthly.
There’s a widespread belief that license mobility through Software Assurance solves this. It does not. License mobility does not apply to Windows Server.
So a hoster builds a shared cluster, believes their customers’ existing licenses cover it, and under-reports Windows Server for years without ever knowing they had an obligation. That single misunderstanding, on its own, produces some of the largest findings we see.
The Problem Isn’t Just the Penalty
There’s a second implication that matters even more to a buyer, and it has nothing to do with penalties. If a hosting company has been under-reporting for years, then the margin on their financial statements is not real. The cost of goods sold is understated.
Bring that reporting current, and the true cost of serving those customers goes up permanently. That doesn’t just create a one-time liability. It changes the economics of the business your client is buying.
You’re not just buying a compliance problem. You may be buying a business whose entire margin profile is different from what the model shows.
In the next video, I break down the five specific places licensing exposure hides — and the one category where we often actually find money instead of risk. If there’s Microsoft licensing anywhere in your deal, reach out before you close.
The Full Exposure
Under Microsoft's SPLA terms, under-reporting triggers additional costs beyond the gap itself:
| Finding | Amount |
|---|---|
| Under-reported licensing (back fees) | $2,148,999 |
| 25% under-reporting penalty | $537,250 |
| Estimated third-party inspection cost | $50,000 |
| Total inspection findings and costs | $2,736,249 |
The company was reporting barely more than a third of their actual Microsoft licensing obligations.
What Drove the Gap
Altaris performed a full deployment scan using the same tools and methodology Microsoft employs during a formal SPLA inspection, comparing actual deployed software against the subscriber counts reported to Microsoft. The under-reporting was systemic — across the entire estate, not one product:
| Product | Under-reported |
|---|---|
| Office Standard SALs | $206,577 |
| SQL Server Standard 2-Core Packs | $302,162 |
| Office Professional Plus SALs | $392,458 |
| SQL Server Enterprise 2-Core Packs | $492,999 |
| Windows Server Standard 2-Core Packs | $57,280 |
| Windows Server Datacenter 2-Core Packs | $499,591 |
| Additional products (net) | $197,932 |
| Total net under-reported | $2,148,999 |
The largest single contributor was Windows Server licensing. The assessment revealed:
- All physical servers were deemed part of SPLA, including hosts where application software was furnished by clients — a common misunderstanding of SPLA scope.
- The hosting provider had been licensing Windows Server at the VM level instead of the physical core level — one of the most common SPLA mistakes, creating a multiplier effect where every under-counted host magnifies the gap.
- Nineteen hosts were running fewer than seven VMs each, representing consolidation opportunities that could reduce the licensing footprint going forward.
- A significant portion of the environment was running legacy Windows Server versions that would benefit from modernization and migration planning.
- SQL Server licensing gaps across both Standard and Enterprise editions contributed nearly $800,000 to the total — driven by core-count miscalculations and edition mismatches.
Why This Matters in M&A
This hosting company wasn’t cutting corners. They were reporting what they believed was accurate. But SPLA licensing — especially Windows Server and SQL Server on shared infrastructure — is complex enough that self-reporting without independent validation will almost always produce gaps.
A 62% under-reporting rate means the company was paying for roughly one-third of its actual Microsoft licensing obligation. If this environment had been an acquisition target, the buyer would have inherited $2.7 million in exposure on day one — exposure that would have surfaced the moment Microsoft exercised their contractual right to inspect.
For any deal involving an SPLA hoster, the question isn’t whether there’s a gap. It’s how big.
Related Case Studies
62% Under-Reporting Exposed: $2.7M in Total SPLA Licensing Exposure — A managed hosting provider was reporting barely a third of its actual Microsoft licensing obligation.
Post-Close Licensing Assessment Finds 838+ Excess Licenses — Sometimes the finding is money sitting on the table, not risk.
If your deal involves an SPLA hosting company, we should talk before close. Contact us or reach us directly at [email protected].
