This worked case belongs to the license reclamation exceptions guide, which covers what to inventory before a license true-up. Here the job is to tell one hard case decision by decision.
What went wrong: one signal read as the whole story (Illustrative)
Invented for this page. A fictional 540-person veterinary hospital group runs 22 sites. Each reception desk uses a single shared account, such as frontdesk-site07, left signed in on the workstation and used all day by several staff.
The IT asset team runs a reclamation rule in its asset manager: any account holding an office suite license with no interactive sign-in in 90 days becomes a removal candidate. ServiceNow, for example, documents a scheduled job that creates software removal candidates when a reclamation rule's conditions, such as its last-used filter, are met, and stores them in a candidates table.
ServiceNowThe mechanism behind the false positive is documented. Microsoft's guidance on inactive accounts explains that lastSignInDateTime tracks the last interactive sign-in attempt, while the same signInActivity resource carries a separate lastNonInteractiveSignInDateTime. Shared computer activation adds a second layer: each account signed in on a shared computer gets its own licensing token, valid for 30 days and renewed while that account is signed in and using the apps. A reception computer can look idle on the first field while it is busy on the second.
Six decisions and the record each one left
Six steps, four owners, three systems. This is the order an auditor, a new asset analyst or a model would need to follow.
| Step | Day | Decision or event | Who | Record that captured it |
|---|---|---|---|---|
| 1 | Mon | frontdesk-site07 listed for removal: no interactive sign-in in 94 days | Reclamation rule, scheduled job | Candidate record in the asset manager |
| 2 | Tue | Removal scheduled for Friday; site manager objects that the computer is used all day | Site operations manager | Service desk ticket citing the candidate number |
| 3 | Wed | Interactive sign-in 94 days ago; non-interactive sign-in yesterday; device confirmed as a shared reception workstation | IT asset analyst | Sign-in values pasted into the ticket |
| 4 | Wed | License kept; account reclassified as a shared device account | Site operations manager and IT asset manager | Exception approval on the ticket and candidate closed as rejected |
| 5 | Following week | Shared device accounts excluded from the 90-day rule | IT asset manager | Change record linked to the ticket |
| 6 | Next quarter | License counted as in use, with the exception reference | Procurement analyst | True-up worksheet line |
Step 3 is the one record sets often lose. Microsoft documents that Entra sign-in logs are kept for seven days on the Free tier and 30 days on P1 and P2 unless routed elsewhere, so the values survive only because the analyst pasted them into the ticket on the day.
Why the objection and the pasted values carry the weight
Because together they record a correction, not just an outcome. A removal list would show this account as "candidate, rejected" and nothing else.
The first answer was wrong, and the record says so. The candidate record proves the rule fired. The ticket proves someone challenged it. Without both, nobody can tell a correct exception from a careless one.
The evidence was checked before the decision. The values were pasted on Wednesday and the approval followed the same day. Dates in order, in one time zone, are what show the decision rested on the evidence. The records across systems map explains which keys keep that order intact.
The rule learned. Step 5 turns one exception into a policy. A history of rule changes that cite tickets shows a team improving its process, which is the kind of history exception handling data for AI agents describes.
Authority is split. A site manager objected, an analyst checked, two managers approved. The records describe employees, so who can authorize their use is a separate question, covered by the who can license decision tree.
How to recognise a similar case at a client
Ask the head of IT asset management five questions. None requires opening a system.
- Does a rule propose removals on one usage signal? A single last-used or last-sign-in condition is where shared devices, kiosks and service accounts get misread.
- Has anyone ever objected to a proposed removal? If the answer comes with a story, the pattern exists.
- Where do objections go? Tickets that cite the candidate number are followable; chat messages and emails usually are not.
- Are sign-in values copied into the ticket, or only described? Values survive; descriptions and screenshots tell much less.
- Do rule changes cite the tickets that caused them? That link is what shows a process learning.
Strong signals: a multi-site organization with shared front-desk, warehouse or clinical workstations, an annual true-up, and a service desk that has run on one tool for several years. The same objection-and-decision pattern shows up in accounts payable exception handling, and license removals for departed staff raise their own questions, covered in the inactive mailbox guide.
What a partner notes, and what stays unknown
Note the pattern, rough volumes and owners in plain words: "About 300 candidates a cycle, perhaps 20 objections with written decisions; sign-in values pasted into tickets since about 2022; rule changes cite tickets; head of IT asset management runs it." Never ask for candidate lists, account names, tickets or screenshots. The referral brief template gives the fields.
The introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license the records and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Partners sign the Channel Partner Agreement before submitting introductions.
Unknown until SourceX reviews it: what privacy review concludes about records that describe employees and their devices, what de-identification account names need, whether software vendor terms limit sharing usage reports, buyer interest and any price.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
If a client's asset team can describe a removal it stopped, the second signal it checked and the rule it changed afterward, register as a partner, check the company against who qualifies and read the program terms before you introduce its head of IT asset management.