365 E3 Reconciliation Issues: Intune Data vs. User Subscription Entitlements

[mfhaciahmetoglu]

Hi everyone,

We are currently in the birthpangs of implementing SAM Pro and running into a reconciliation discrepancy with Microsoft 365.

Our Setup:

• Discovery Source: We are using the Service Graph Connector for Microsoft Intune to pull software installation data.

• Entitlement: We created an entitlement for "Microsoft M365 E3 Unified Existing Customer Sub Per User" (P/N derived from our invoice).

• Normalization: Data from Intune is flowing in and normalizing correctly (e.g., we see "Microsoft 365 Apps for enterprise" on the installation table).

The Issue: After running reconciliation, the results do not seem to match reality. The Intune data (which provides device-level installations) does not seem to map cleanly to the M365 E3 User Subscription entitlement we created. We are seeing either low consumption or no consumption against the license. When I check the cmdb_sam_sw_install table, I see many, many different names for the entitlement we fill in (which is basically our MS Office product).

Questions:

1. Is relying solely on Intune installation data sufficient for reconciling M365 User Subscriptions?

2. Do we need to configure the direct SaaS License Management integration (M365/Azure AD) to properly reconcile these user-based licenses, rather than relying on discovered installs?

3. If Intune is sufficient, are there specific "Suite" configurations or Software Model mappings we need to adjust so that "Microsoft 365 Apps" installs consume the "M365 E3" license?

Any best practices on how you handle M365 E3 specifically would be appreciated.

Thanks!

[Shaqeel]

Hi @mfhaciahmetoglu 

Great questions! This is a common challenge when reconciling user-based SaaS licenses like Microsoft 365 E3 in SAM Pro. Let’s break it down:

1. Is relying solely on Intune installation data sufficient for reconciling M365 User Subscriptions?
No, not really.
Intune provides device-level installation data, which works well for traditional software compliance (per-device or per-install licenses). However, Microsoft 365 E3 is a user-based subscription, so reconciliation should ideally happen at the user level, not based on installs.
If you rely only on Intune, you’ll see mismatches because:

A user might have multiple devices with installs, but only one subscription.
Some installs (e.g., shared devices, VDI) don’t correspond to a licensed user.

2. Do we need to configure the direct SaaS License Management integration (M365/Azure AD)?
Yes, this is strongly recommended.
The Microsoft 365 SaaS License Management integration (via Azure AD) pulls:

User accounts
Assigned subscriptions
Actual license consumption per user

This is the most accurate way to reconcile user-based entitlements like M365 E3. It avoids the ambiguity of device installs and maps directly to your entitlement.

3. If Intune is sufficient, what configurations are needed?
If you still want to leverage Intune for consumption:

You need to configure Software Models and Suites properly:

Create a Suite Model for “Microsoft 365 Apps for enterprise” and link it to the M365 E3 entitlement.
Ensure the Publisher, Product, and Version normalization aligns with the entitlement.
Map all variants (e.g., “Microsoft Office 365 ProPlus”, “Microsoft 365 Apps”) to the same suite.

Even then, this will only approximate compliance because installs ≠ user subscriptions.

Best Practice Recommendation

Use Azure AD SaaS integration for license reconciliation.
Keep Intune discovery for visibility into installs (helps with device-level audits and optimization).
Configure Software Models and Suites for completeness, but don’t rely on them for compliance on user-based licenses.