September ITAM SAM Licensing Update from Certero

Oracle Java 17 becomes chargeable

In October 2024 Oracle will introduce Java Version 17 Update 13. The licensing model changes from Oracle No-Fee Terms and Conditions (NFTC) License to the Oracle Technology Network (OTN) License agreement for updates 13 and higher which may introduce risk to organizations.

Under the Java SE Universal Subscription model, which was introduced in January 2023, then a single use of Version 17 Update 13 or higher could mean that an organization would have to pay for ALL their employees.

This is part of Oracles' strategy to move customers who want to continue using the NTFC versions of products to the latest Long-Term Release (LTR) version, while customers who want to stay on a previous LTR version will be expected to pay for the subscription which allows them to use that versions' latest updates.

Organizations should ensure that they understand which hosts are using version 17 and take steps to ensure that employees can’t just update to the latest update because they get a pop-up message. Oracle track all downloads of Java software and use the download history in compliance reporting which can include all downloads since 1st January 2022 or, even earlier.

Microsoft Announces Mandatory Multi-Factor Authentication for All Azure Users

On August the 15th 2024 Microsoft announced that as part of a five year plan to invest $20 billion dollars into security, it is introducing mandatory multifactor authentication (MFA) for all Azure sign-ins.  The rollout of MFA for Azure users will be conducted in two phases: 

• Phase 1: Set for October 15th 2024, MFA will be required to sign-in to Azure portal, Microsoft Entra admin center, and Intune admin center. The enforcement will gradually roll out to all tenants worldwide. This phase will not impact other Azure clients such as Azure Command Line Interface, Azure PowerShell, Azure mobile app and Infrastructure as Code (IaC) tools. 

• Phase 2: Beginning in early 2025, gradual enforcement for MFA at sign-in for Azure CLI, Azure PowerShell, Azure mobile app and Infrastructure as Code (IaC) tools will commence. 

The stated reasoning behind this change being that this is part of Microsoft’s Secure Future Initiative, which aims to align with zero-trust principles and secure identities across cloud services.  There has been speculation that a series of high-profile Azure outages and security breaches in the past year has accelerated this change. US government accounts being hacked by Chinese state actors, an Azure outage caused by a DDoS attack and the CrowdStrike outage have kept Microsoft in the headlines for the wrong reasons.  It’s possible that this announcement is intended to increase confidence in the platform, but it’s doubtful MFA would have had influence in regards the DDoS and CrowdStrike incidents. 

Organizations are recommended to start enabling MFA for their accounts to ensure a smooth transition, more information regarding how to do this can be found here. If organizations are finding the stated timelines too aggressive to achieve, then Global Administrators can go to the Azure Portal and request a delay to March 15th, 2025. This must be done before October 15th, 2024, and the Global Administrator must have elevated access. 

Microsoft Dynamics Price Rise

In April 2024, Microsoft announced a price increase for its Dynamics 365 suite, affecting businesses worldwide. The average price hike is around 10%, with some premium products like Dynamics 365 Finance and Operations seeing even steeper increases. This adjustment reflects both rising operational costs and the enhanced value Microsoft continues to add to its products. 

Microsoft's decision to raise prices is driven by several factors. Microsoft has made significant investments in improving Dynamics 365, adding advanced AI capabilities, better data analytics, and enhanced user experiences. These upgrades, while valuable, come with higher development and operational costs, which are being passed on to customers. 

Global inflation has impacted the tech industry just as it has other sectors. Rising costs for labour, materials, and other resources have forced companies like Microsoft to adjust their pricing to maintain profitability. 

For businesses relying on Dynamics 365, this price hike could strain budgets. Companies should take this opportunity to reassess their use of Dynamics 365, ensuring they are utilizing its features effectively to drive growth and efficiency. 

Switching to alternative solutions may be considered but could prove challenging due to the deep integration of Dynamics 365 into business operations. Instead, businesses might focus on optimizing their current usage and negotiating better terms with Microsoft or its partners. 

To manage the impact of the price increase, businesses should consider conducting an audit of their current Dynamics 365 usage. This can help identify any underutilized features or licenses that could be adjusted to reduce costs.

VMware by Broadcom is discontinuing license support for the IT Academy program

Broadcom has decided to initiate the end-of-life process for the VMware IT Academy and Academic Software Licensing programs, effective 15th August 2024. As a result, customers are no longer be able to purchase new subscriptions in the VMware IT Academy store after 5:00 PM ET on 15th August 2024.

VMware customers are seeing large price increases since Broadcom takeover 

Broadcom has made some changes to increase their profitability since the takeover, including bundling VMware’s products to “simplify its portfolio.” This means customers will probably have less flexibility and pay increased subscription payments for more products even if they don’t use them all. 

Customers should be advised that they can not renew their maintenance on existing perpetual licenses, as Broadcom has brought in a new policy that maintenance and update rights will only be available with the 2 new subscription models. For customers who want to continue to use their perpetual licenses, then this is possible on the understanding that they lose the rights to upgrade or have any type of support.

IBM Price Hikes

In August 2024, IBM listed price increases for several of its software products. There was no formal announcement calling these out, so it is assumed this is part of the IBM General Price Harmonization (GPH) that has taken place over the past year. Affected products include IBM App Connect Enterprise and Integration Bus. Some have speculated that recent IBM acquisitions are in part being offset by price increases to IBM’s traditional offerings. 

To compound this news, IBM have announced they are withdrawing all Modernization licenses effective December 10th 2024.  These licenses allowed the trade up from perpetual legacy products to modern versions. By doing this there will be no path to attain modern versions other than subscription upgrades and Cloud Pak for Data cartridges. 

IBM Product Withdrawals and new versions of passport advantage agreements

IBM recently announced significant changes to its Passport Advantage agreement which took effect on August 1, 2024. These revisions impact various aspects of software licensing, support, and compliance for organizations using IBM products. 

Notable changes: 

• Detailing the format in which deployment reports must be submitted. IBM had verbiage in the last IPAA requiring customers to furnish IBM with an annual deployment report upon 30 days’ notice, with records retained for a minimum of 2 years. In addition, the new License Verification clause (4.1a) now stipulates that this report must be in the templated format (or equivalent) linked to here.  The format itself does not look especially complicated and appears to be a shortened version of the IASP templates IBM has made available. 
• More detailed wording of what constitutes Full Capacity 

Previously this was defined as: 

 ‘license the total number of physical processor cores activated and available for use on all servers where the EP, if applicable, is deployed (Full Capacity).’ 

Now the same clause says: 

‘license the total number of all physical Activated Processor Cores in the physical hardware environment made available to or managed by the EP, except for those servers from which the EP has been permanently removed (Full Capacity). An Activated Processor Core is a processor core that is available for use in a physical server, regardless of whether the capacity of the processor core can be or is limited through virtualization technologies, operating system commands, BIOS settings, or similar restrictions.’ 

Likely a change made in response to customers contesting license counts by using one of several methods to limit what processor resources an IBM product can actually use. To correspond with this change, the Virtualization Guide was updated to include the new definition of an Activated Processor Core: 

Interestingly the guide does state that calculating Activated Processor Cores by OS commands or BIOS settings is a valid means to count them, just not a valid means to restrict them.