License reclamation system map: the keys that join candidates, sign-in evidence, tickets and true-ups

Short answer

Reconstructing one license reclamation exception takes four joins across at least three systems: account to device, candidate to ticket, ticket to evidence, and decision to the next true-up. The asset manager holds candidates and statuses, the identity system holds the usage signals, the service desk holds objections and approvals, and procurement holds the true-up worksheet. Each join depends on one linking key surviving an export: the user principal name, the candidate number, the ticket number and an exception reference.

Visual briefFull-size diagram
Four system nodes, the asset manager, identity system, service desk and procurement true-up file, with four linking keys (user principal name, candidate number, ticket number and exception reference) travelling between them to join one license decision.
Illustrative map. A case can be rebuilt only if each linking key survives the export.

This system map is part of the license reclamation exceptions guide. It shows where each record lives, the key that carries it to the next system, who owns it, and what one fully joined case looks like.

Where each record lives

SystemRecords it holdsTypical ownerWhat it cannot show alone
Asset managerLicense assignments, reclamation rules, removal candidates and statusesHead of IT asset managementWhy a candidate was kept or removed
Identity systemAccounts, registered devices, sign-in activity fields, audit logsIdentity teamWhether anyone looked at the signals
Service deskObjections, evidence notes, exception approvals, change recordsService desk manager and business approversWhat the rule saw when it fired
Procurement or finance filesTrue-up worksheets, contract countsProcurement leadWhich counted licenses were exceptions

The asset manager's candidate table is the spine. ServiceNow, for example, documents a scheduled job that creates software removal candidates when a reclamation rule's conditions, such as its last-used filter, are met, and stores them in a candidates table. Every explanation of a candidate sits in another system.

The four linking keys, one by one

JoinLinking keyAsset manager sideOther system sideOwnerWhat is often missing
Account to deviceUser principal nameAssigned user on the install or subscriptionAccount and registered device in the identity systemIdentity teamShared accounts not tagged as shared
Candidate to ticketCandidate numberCandidate recordCandidate number quoted in the ticketService desk managerObjections raised by chat or email, never ticketed
Ticket to evidenceTicket numberCandidate closed with a ticket referenceSign-in values pasted or attached in the ticketIT asset analystScreenshots instead of values; raw logs expired
Decision to true-upException referenceCandidate status and closed dateTrue-up worksheet lineProcurement leadWorksheet built from a fresh export with no exception reference

The third join is the fragile one. Microsoft documents that Entra audit and sign-in logs are kept for seven days on the Free tier and 30 days on P1 and P2 unless routed to storage or Log Analytics. Whatever signal justified a decision last year therefore tends to survive only where someone typed it into the ticket.

One fully joined case (Illustrative)

Invented for this page. The same fictional 540-person veterinary hospital group as the worked case, but a different exception: a diagnostic imaging viewer licensed to a surgery-suite kiosk account that staff open only during procedures. The table shows only the keys.

OrderSystemRecordKey carried forward
1Identity systemKiosk account surgery-k2, registered to the surgery-suite cartUser principal name
2Asset managerImaging viewer license assigned to surgery-k2User principal name
3Asset managerRemoval candidate RC-5521: viewer unused for 120 days by the rule's measureRC-5521
4Service deskTicket INC-30418: head veterinary surgeon objects, quotes RC-5521INC-30418
5Service deskKiosk sign-in values and the procedure calendar summary added to INC-30418INC-30418
6Service desk and asset managerException EX-112 approved; RC-5521 closed as rejected with INC-30418EX-112
7Service deskChange CHG-0907 tags kiosk accounts and exempts them, cites INC-30418CHG-0907
8Procurement fileTrue-up line counts the license as in use, notes EX-112EX-112

Remove the candidate number from the ticket in row 4, or the exception reference from the worksheet in row 8, and the case falls apart into a ticket nobody can match and a count nobody can explain.

Chronology is the second join

Keys prove which records belong together; timestamps prove the order. A reviewer needs the candidate date, the objection date, the evidence date and the decision date in sequence, in one time zone, to show the evidence was checked before the decision rather than found afterward. Ask whether the service desk and asset manager store times in the same zone, and whether closed candidates keep their creation date after purge settings run.

Test the map with the asset team, at metadata level

Take the map to the head of IT asset management. Each question is about a field, never a record.

  1. Are kiosk and shared device accounts tagged as such in the identity system or the asset manager?
  2. Do tickets quote candidate numbers, and since when?
  3. Are sign-in values pasted as text, attached as screenshots, or only described?
  4. How long do closed candidates stay in the candidate table?
  5. Do true-up worksheets carry an exception reference for kept licenses?

Write the answers into the workflow map template. ITSM ticket history explains why the service desk is usually where the reasoning survives, and license accounting data for AI training covers the counting side. Retention rules that may cut a join short are listed in the Microsoft 365 retention policy checklist.

Qualification and what stays unknown

The company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license the records and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Partners sign the Channel Partner Agreement before submitting introductions.

These records describe employees and their devices, so the person who can approve a licensing discussion is usually not the person who runs the tools; the who can license decision tree sorts that out. Unknown until SourceX reviews it: the privacy and vendor-terms position, de-identification needs, buyer interest and any price.

Next step

Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

If a client's tickets quote candidate numbers and its true-up worksheets carry exception references, register as a partner, confirm the company against who qualifies and read the program terms before you introduce its head of IT asset management.

  1. Step 1Share your linkSend your personal link to a company you know.
  2. Step 2Company appliesThe company applies itself at /apply.
  3. Step 3Company signs and is paidThe company signs, delivers its data and is paid by SourceX under its agreement.
  4. Step 4You get your rewardYour 25% of the actual supplier payout. A reward becomes payable after SourceX has paid the referred company under its signed agreement and the payout conditions in the program terms are met, including finance approval and your tax and payment details.

Common questions

Is the asset manager export enough to rebuild an exception?

No. It shows candidates and their statuses. The usage signals sit in the identity system and the reasons sit in the service desk, so a rebuild needs the keys that join all three.

What if objections were raised by chat or email?

Then that join is missing for those cases. Note roughly what share of objections reached a ticket. The ticketed share is the part that can be followed.

Should the company start exporting sign-in logs to keep the evidence?

That is the company's decision under its own policies and legal advice, not a partner's recommendation. A partner can note that short default log windows exist and leave the decision to the owner.

Sources

  1. support.servicenow.com/kb
  2. learn.microsoft.com/en-us/entra/identity/monitoring-health/howto…
  3. learn.microsoft.com/en-us/entra/identity/monitoring-health/refer…
  4. refer.sourcex.si/terms

Free resources

Know a company with valuable proprietary data?

Become a referral partner, get your link and introduce the company’s CEO (in an owner-run company, usually the owner). Referral partners can join from most countries. We can't work with partners in countries or regions under U.S. sanctions or on U.S. restricted-party lists. The companies you introduce should be based in the U.S., Canada and the EU, or in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia with at least 90% of their data in English.

Refer a company →

I own a business

Explore licensing your company's data directly to SourceX for AI training and evaluation. Start a short assessment; no uploads needed.

Start an assessment