This decision tree is part of the license reclamation exceptions guide. It answers one question: who can say yes to a licensing discussion about these records, and where does the answer stay open until SourceX's rights review?
Why the person who runs the tools is not the person who decides
The asset management head can tell you that a candidate table exists, how far back tickets go and whether sign-in values were pasted into them. That makes them the right first conversation. It does not make them the owner of the records.
Look at what the records contain. Reclamation rules read each user's sign-in activity; Microsoft documents that the signInActivity resource records the last interactive and non-interactive sign-in times for every account. Candidate records name accounts, ServiceNow-style candidate tables list them for removal, and tickets record who objected and why. That is information about named employees, and decisions about using it sit with the CEO, advised by the executive who owns the function and usually with HR and privacy at the table.
ServiceNowThe decision tree, question by question
Work down the tree with the asset management head. Each answer moves you to the next question or ends at a person to introduce.
- Does the company itself hold the records, or does a provider?
- Company: go to question 2.
- Managed service provider or outsourcer: the company still usually owns records about its own staff and licenses; note the provider's contract for review and go to question 2.
- Which executive owns IT operations data?
- A named CIO, CTO or COO: that person is the records owner and the natural sponsor. Go to question 3.
- Nobody clear: ask who approves the IT budget or software contracts; that is often the answer. If still unclear, the delegation of authority matrix template helps the company work it out.
- Do the records name employees or describe their activity?
- Yes, as assignment and usage records almost always do: HR and the privacy lead will need to be involved before any licensing decision. Note it; do not analyze it.
- No, fully aggregated counts only: less personal data, but the company still decides.
- Do software agreements limit how usage reports or license data may be shared?
- Possibly: some vendor terms can restrict this. Legal review settles it, not the partner. Note "vendor terms to check".
- Who can actually sign for the company?
- The CEO: introduce them, with the executive from question 2 as sponsor.
- In an owner-managed business the owner is usually the CEO. Where a trust holds the business, the trust ownership guide explains how that can change the route.
The tree ends with three names: the CEO, the records owner as sponsor and the asset management head as the subject-matter contact.
Roles and what each can authorize
| Role | What they know | What they can authorize | Where they sit in the introduction |
|---|---|---|---|
| Head of IT asset management | Rules, candidate volumes, ticket coverage, gaps | Nothing beyond describing the process | Copied as subject-matter contact |
| Identity or systems administrator | Sign-in fields, log retention, exports | Technical access only | Not introduced; answers later questions |
| Service desk manager | Where objections and approvals are recorded | Nothing on licensing | Not introduced |
| CIO, CTO or COO | Why the records exist and how they are used | Sponsorship; the CEO authorizes | Sponsor of the introduction |
| HR lead and privacy lead | Employee notices, works council or consultation duties | A view on whether personal data can be used | Brought in by the executive |
| General counsel | Vendor terms, employee data obligations | Legal sign-off before any agreement | Brought in by the executive |
| CEO (often the owner) | Ownership and signing power | A licensing discussion and the final signature | Primary introduction |
The general question of who must approve a company data partnership is covered in who needs authority to approve a data partnership.
Branches that need HR, privacy or legal sign-off
Three branches cannot be settled in a partner conversation:
- Employee data. Assignment histories, sign-in values and objections tied to named people. Retention and use are decisions for the company's privacy lead and counsel. Microsoft documents that Entra sign-in logs are kept seven days on the Free tier and 30 days on P1 and P2 by default, which is one reason some companies route them elsewhere; whether they did is a fact to note, not a practice to recommend.
- Vendor terms. Software agreements may restrict sharing usage or license data. Note the main vendors; legal reads the terms.
- Provider contracts. If an outsourcer runs the tools, its contract may say who controls exports.
What stays unknown until SourceX's rights review
Partners stay at metadata level: what the records are, how many, how long, which system, who owns them. Never ask for exports, user lists, tickets or screenshots. Until SourceX reviews the opportunity, these stay open: whether the records can be licensed at all given employee data and vendor terms, what de-identification is required, whether there is buyer interest, and any price. Why data rights matter explains why that review comes before any commitment.
The introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license the records and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. Partners sign the Channel Partner Agreement before submitting introductions; credit goes to the first valid introduction within the 90-day window, recorded when the company submits a verified application. To check which joins the review will test, see the system map; to write the handoff, use the referral brief template.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
Once the tree has led you to the CEO and the CEO has agreed to an introduction, register as a partner, confirm the company against who qualifies and read the program terms.