Mike Austin walks through how Microsoft counts active devices and users in EA audits: they check Active Directory, mark anything AD-enabled as active, and use last password reset as a signal. He warns that Active Directories are often full of stale objects and recommends negotiating your contract if you want a different counting method.
Chapters
Because a lot of times people say, well, how do I actually count those? Right? And this, this is actually relevant for the, what we're going to talk about Next, which is O365 and N365. But basically the way that Microsoft does this in an audit, and that's how I tell people you should count that same way. And if you don't like that way of accounting, then you want to try and figure out a way to get Microsoft to put something in your contract that states that this is how you're counting and that they agree to it. But the way that they're going to do this in an audit is they're going to come in, they're going to look at your Active Directory, they're going to try and determine what devices are active on the network based on Active Directory. That should scare you. Most people's Active Directory is very dirty, has lots of extra devices and users and things like that. But really what they do is they go and look at Active Directory and go if it's enabled. And then they look at some things like last password reset and a couple of other things within AD to say, yep, this is, this is an active device on the network, therefore this is your count.