A robust SAM process is the key here. If software entitlements are accurately allocated to users/devices upon installation during the execution of Request Fulfilment or Change Management processes, then when publisher reconciliation is executed and the number of installations exceeds the purchased entitlements, the Unlicensed Installs list on the Software Model results will contain the unauthorised installations. If there isn't a robust process around allocating entitlements, then the Unlicensed Installs list can only be treated as a list of 'suspected' unauthorised installs.
