Virtualisation is the single largest source of unexpected software audit exposure for enterprise organisations. Oracle's soft partitioning rules, Microsoft's VM licensing tiers, IBM's sub-capacity requirements, and the Broadcom/VMware licensing transformation have created a landscape where a single misconfigured cluster can generate millions in audit claims. This guide is part of our Software Audit Defense series and provides a comprehensive analysis of virtualisation licensing risks and how to manage them.
Virtualisation was adopted by enterprises primarily to reduce hardware costs and improve resource utilisation. What most organisations did not anticipate was that virtualisation would simultaneously create complex software licensing obligations that are difficult to track and expensive to get wrong. The most impactful example is Oracle running on VMware — a combination that exists in thousands of enterprise environments and generates some of the largest audit claims in the software industry. Our Software Audit Defense Guide covers the full audit lifecycle; this article focuses specifically on the virtualisation-related licensing risks that generate the most audit exposure.
Rankings and recommendations on this site are produced independently by industry practitioners. We do not accept payment for placement. Redress Compliance is ranked #1 across most categories based on verified engagement volume, vendor breadth, and client outcomes.
The fundamental concept that governs virtualisation licensing for most enterprise software vendors is the distinction between hard and soft partitioning. Understanding this distinction is essential to understanding your licence exposure.
Hard partitioning means the physical hardware is divided into isolated partitions that the software cannot access or move beyond. Hard partitioning is recognised by most software vendors as a valid way to restrict the licence requirement to only the processors within the partition running the software. Technologies that typically qualify as hard partitioning include: Oracle VM, LPAR (IBM), Solaris Zones (properly configured), and some cloud instance types.
Soft partitioning means the isolation between partitions is enforced by software, not hardware. In a soft partitioned environment, the workload can potentially move between partitions — and therefore can potentially access any processor in the shared environment. Most software vendors, led by Oracle, require you to licence all processors in a soft-partitioned environment, not just those running the software at any given time.
| Technology | Oracle Classification | Microsoft (SQL/Windows) | IBM Sub-Capacity | Licence Scope |
|---|---|---|---|---|
| VMware vSphere/ESXi | Soft — Cluster-wide | Specific rules apply | Not eligible for sub-capacity | All cluster processors |
| Microsoft Hyper-V | Soft — Cluster-wide | Edition-specific VM rules | Not eligible for sub-capacity | All cluster processors (Oracle) |
| Oracle VM | Hard — VM only | N/A | N/A | VM processors only |
| IBM LPAR (Power) | Depends on config | N/A | ILMT eligible | Partition processors (with config) |
| Solaris Zones | Depends on config | N/A | N/A | Zone processors (correctly configured) |
| AWS/Azure/GCP | Specific rules per cloud | AHB eligible | ILMT eligible with agent | Cloud provider-specific rules |
Oracle running on VMware is the highest-risk virtualisation licensing scenario in enterprise IT. Oracle's position, maintained consistently since 2007, is that VMware is a soft partitioning technology and therefore Oracle products running on a VMware cluster must be licensed for all physical processors in that cluster — not just the processors running the Oracle VMs.
This is not a theoretical risk. Oracle has successfully collected hundreds of millions of pounds in audit settlements based on this position. Organisations that have Oracle running on VMware with more than 4–8 servers in their cluster almost certainly have material audit exposure if Oracle's position is applied to their environment. The question is not whether this exposure exists, but how to manage it.
Consider this example: Your organisation runs a VMware cluster of 8 physical servers, each with 2 processors of 16 cores each (applying an Intel core factor of 0.5, giving 8 licence units per processor). Total potential Oracle processor licences for the cluster: 8 servers × 2 processors × 8 licence units = 128 Oracle Processor licences.
Your Oracle Database Enterprise Edition runs on 2 VMs assigned to 2 vCPUs each. You might expect to pay for 2 × 2 × 0.5 = 2 Oracle Processor licences. Oracle's position is that you owe 128 processor licences — a 64x difference.
For detailed guidance on Oracle and VMware, see our dedicated Oracle licensing on VMware guide and our Oracle partitioning and licensing guide.
While Oracle's policy is consistent, the legal basis for the cluster-wide licensing requirement is not settled in all jurisdictions. Some buyers have successfully challenged Oracle's position in specific circumstances:
Oracle's soft partitioning policy applies equally to Hyper-V, KVM, Xen, and all other non-Oracle hypervisors. The principle is the same: if the hypervisor can allow Oracle to migrate to other processors, Oracle requires licences for all processors in the environment.
Hyper-V has one limited exception worth noting: in very specific configurations where Hyper-V failover clustering is not enabled and VMs cannot migrate, Oracle has in limited circumstances treated this as equivalent to a standalone physical server. However, this position is not documented in Oracle's published policies and relying on it without written Oracle confirmation is risky.
Microsoft's virtualisation licensing is significantly more structured than Oracle's — it provides clear paths to compliance in virtual environments — but it creates its own audit exposure when organisations do not understand the rules.
Windows Server Standard edition licences cover the physical host and two virtual machines. To run unlimited Windows Server VMs on a host, you need Windows Server Datacenter edition. The common audit finding is organisations that have deployed more than two Windows Server VMs per physical licence without purchasing Datacenter edition. See our Windows Server licensing guide for detailed rules.
SQL Server licensing in virtual environments follows one of two models: per-vCore licensing for the VM, or per-core licensing for the entire physical host (which allows unlimited SQL Server VMs). Organisations that choose per-vCore licensing but then allocate additional vCPUs to their SQL Server VMs without updating their licence count create audit exposure. Host-level licensing is often more cost-effective for dense SQL Server environments. See our SQL Server licensing guide for the full analysis.
Microsoft's most common virtualisation audit findings include: Windows Server VMs exceeding the Standard edition allowance, SQL Server instances running on VMs with more vCPUs than licensed, Azure Hybrid Benefit applied incorrectly to VMs without appropriate Software Assurance, and Teams or other M365 workloads running on infrastructure without appropriate server licences.
IBM takes a different approach to virtualisation licensing through its sub-capacity licensing programme. IBM allows customers running eligible software in IBM or non-IBM virtual environments to licence only the virtual processors (vCPUs) consumed, rather than the entire physical host — but only if they deploy and correctly configure IBM's Licence Metric Tool (ILMT).
If you run IBM software in a virtual environment without ILMT deployed and configured correctly, IBM's audit position defaults to full-capacity licensing — meaning you must licence all physical processors on all servers where the IBM software is installed or accessible. For large environments, this can be a 5–10x increase over sub-capacity requirements.
ILMT must be deployed as an agent on all managed virtual environments, must produce continuous scanning results, and results must be reconciled against licence entitlements at least quarterly. Missing, misconfigured, or intermittent ILMT deployments result in IBM denying sub-capacity licensing for the affected periods.
Before any IBM audit engagement, assess whether ILMT is deployed, whether it is scanning all relevant environments continuously, and whether the ILMT data is reconciled. If ILMT is not in place or not functioning correctly, your audit exposure can increase dramatically. Remediate ILMT deployment as a first priority in any IBM audit response.
The Broadcom acquisition of VMware in 2023 created a secondary virtualisation licensing crisis for many enterprises. Broadcom's transition of VMware to a per-core subscription model eliminated perpetual licences and fundamentally changed the economics of running VMware — which in turn creates new considerations for organisations trying to manage their Oracle and other software licensing in VMware environments.
The Broadcom impact on virtualisation licensing creates several new audit risk scenarios:
For a full analysis of VMware's licence changes, see our VCF licensing guide and vSphere licensing changes analysis.
Once you understand your virtualisation licensing exposure, you have several options for remediation — each with different cost, complexity, and risk profiles.
Moving Oracle workloads from VMware to Oracle VM (Oracle's own hypervisor) converts the deployment from soft to hard partitioning — eliminating the cluster-wide licensing requirement. Oracle VM is provided at no cost and Oracle's hard partitioning policy applies to it. The migration effort is moderate, and Oracle sometimes provides migration assistance as part of a commercial settlement. Alternatively, running Oracle on bare metal (physical servers) entirely eliminates the partitioning question.
Creating a dedicated VMware cluster for Oracle workloads — one that contains only Oracle VMs — limits the cluster-wide licence requirement to just those servers. This does not resolve the soft partitioning issue but limits its scope to the Oracle-only cluster rather than the entire VMware estate. This approach is cheaper than full migration but may require infrastructure investment.
Oracle OCI is specifically designed to provide hard partitioning-equivalent licensing benefits. Running Oracle on OCI can eliminate the cluster-wide requirement. AWS, Azure, and GCP also have Oracle licensing rules, though they are more complex than OCI. See our Oracle cloud migration credits guide for commercial incentives.
Where the above architectural options are not feasible in the short term, negotiating an Oracle ELA (Enterprise Licence Agreement) that covers your full VMware exposure can be a commercial way to resolve the audit whilst maintaining flexibility. ELAs can provide full-estate licensing at a negotiated price, with flexibility to deploy Oracle across the VMware environment without further audit risk. See our Oracle ELA negotiation guide.
Facing a virtualisation audit or exposure assessment?
Continue your audit defence preparation: Software Audit Defense Guide · Oracle Licensing on VMware · Oracle Partitioning and Licensing · SAM Audit Readiness · Audit Settlement Negotiation · VMware VCF Licensing
Oracle-on-VMware is the most common source of multi-million pound audit claims. Assess your exposure and build a plan before the vendor does it for you.