SAMexpert has published what it describes as the first industry survey of Microsoft’s Services Provider License Agreement (SPLA). It covers 278 hosting and managed service providers, surveyed between April and June 2026, on a programme that, according to SAMexpert, Microsoft has been steering providers away from.
The headline: SPLA isn’t dying. 82% expect it to still play a role in 2028, more expect their spend to rise (43%) than fall (20%), and not one respondent says SPLA loses money. The bigger story is what happens when Microsoft checks.
Audited often, governed rarely
45% of providers were audited or verified in the past 12 months. Only 17% have never been audited.
That scrutiny hasn’t sharpened things up. Of those audited in the last year, 52% still run governance ad hoc or have no formal plan. Across the sample, only 21% are very confident in their compliance position, and 51% have no purpose-built reporting tool. Size doesn’t help: among providers spending $150,000 to $500,000 a month on SPLA, six in ten run governance ad hoc.
Confidence peaks just after an audit, because the auditor has just told you where you stand, then fades. Without a maintained position of your own, there is nothing to challenge the auditor’s version of events with.
The providers who do better have someone whose job it is. Only 15% have a dedicated SPLA team, but 43% of them are very confident and 57% have current, tested governance. It’s a small group, around 40 providers, but the direction is clear.
Why this isn’t just a provider problem
Think of your hosting provider as a landlord. Under SPLA, the landlord supplies the furniture: the provider licenses the Microsoft software and bills you for it. SAMexpert reckons that covers almost every Microsoft licence used in hosting.
Since October 2022, under Microsoft’s Flexible Virtualization Benefit (FVB), tenants can bring their own furniture: your own licences. But the landlord has no reliable way to check the furniture is yours. Among providers hosting no customer-owned licences, 18% are not highly confident in their compliance. Where customer licences cover more than half of workloads, that rises to 67%.
The old License Mobility programme gave providers a defined way to check customer licences. FVB replaced it without one. Daryl Ullman, SAMexpert’s Chief Negotiation Officer, says providers now have “no Microsoft-sanctioned process for confirming that those licences are valid.” Microsoft still wants the evidence at audit, so the question about your licences comes back to you.
Arc: adopted after audits, not by design
Azure Arc lets a server outside Azure, such as one in a hosting provider’s data centre, be managed and billed through Azure. For SQL Server, that means paying Microsoft by the hour through your own Azure subscription, instead of the provider licensing it under SPLA. The server stays put. What changes is who holds the licence and who sends the bill.
24% of providers already use Arc for SQL Server, and another 27% plan to start this year.
Why customers might want it. You pay only while SQL Server is running. A reporting server that is busy only at month-end costs less than under SPLA, where the provider bills the monthly peak. Arc billing also includes upgrade and disaster recovery rights that a basic licence lacks.
Who is switching. Close to six in ten providers planning Arc this year were audited in the past 12 months, and two-thirds have no proper reporting tool. Sasha Golev, SAMexpert’s Head of Consulting Services, believes a recent audit is what prompts the switch. Current users are different: nine in ten have a proper reporting tool. Arc works for providers who already know what they run. For the rest, it changes who sends the bill, not the counting underneath.
What to ask. If your provider proposes moving you to Arc, ask what changes for you: whether you’ll need your own Azure subscription, who will bill you, and who is responsible for the licence.
The committed hedge hardest
The providers most committed to SPLA are also diversifying fastest. Those who call it a strategic enabler place around 38% of new workloads on SPLA, against roughly 59% for those who call it a necessary cost centre. For the better-run providers, staying means spreading the risk.
What this means if you rent, not host
Three checks for enterprise ITAM teams.
Which of our licences sit with a provider? If you’ve taken licences to a hosting provider under FVB, you own the proof. Make sure you can produce it.
Is any hosted SQL Server billed to us through Azure? Ask your providers whether any of your workloads are, or will be, on Arc. Check your Azure subscriptions for SQL Server charges you don’t recognise.
Who owns Microsoft licensing at our provider? Nearly half of providers run audit governance ad hoc. Ask who is responsible, whether they have a tested plan, and when they were last audited. Treat it as supplier due diligence.
For providers, the cheapest fix is the one the data points to: name one person responsible for SPLA.
The landlord isn’t leaving
SPLA is staying. But Microsoft keeps changing the terms, nearly half of providers were audited last year, and most still can’t show what they run. Know which of your licences sit in someone else’s data centre, and who answers for them when the auditor calls.
If you’ve been on either side of a SPLA audit, I’d like to hear how it went.
