Woody Walton

Office Audit and Control Management Server 2013.  What is that?   I asked myself that same question around the first of May when I become aware this product was releasing to the Open License Price list on June 1st.

There is not a ton of information or advertising about this product, so I thought I would share what I know from both a technology and licensing standpoint, while pointing you to the resources I am aware of.

Background and overview:

Office Audit and Control Management Server or ACM for short, is part of a suite of 5 tools /solutions called spreadsheet controls and is associated with our Business Intelligence offerings through Excel, Access, and SharePoint.  These tools came to Microsoft through the acquisition of the Prodiance Corporation in 2011.  The client tools you may already know as they are component of Office 2013 Professional Plus (or Office 365 Pro Plus).  The Server tools are less known however.

The below image breaks down tools that comprise Spreadsheet Controls

So Three Desktop tools:

• Inquire
• Database Compare
• Spreadsheet Compare

and Two server tools:

• Discovery and Risk Assessment Server
• Audit and Control Management Server (ACM)

Should you want to know more about the three desktop tools above I would encourage you to look at What you can do with Spreadsheet Inquire (Has Compare info as well), and the Overview of Database Compare in Access 2013.

As far as the Server side spreadsheet controls are concerned, there is an excellent whitepaper titled Spreadsheet Management with the new Office. Additional technical documentation can be found on TechNet here.

The above whitepaper provides a good overview of the capabilities of both Discovery and Risk Assessment Server and ACM, but the best distillation I have found (with screenshots) is a recently updated post to the Excel Blog by the Excel team, New server release: Spreadsheet controls in Office 2013.  It was just updated to time with the impending release of the aforementioned Server tools in Spreadsheet controls.

To Quote the Post:

…Now available are Audit and Control Management Server (ACM), and Discovery and Risk Assessment [Server], which are both designed to help you manage the use of spreadsheets and Access databases.

The Problem or issue these tools address is what are called End-User Computing Applications or EUCs.

The acronym EUC, which refers to End-User Computing applications, has become a common way to say "critical spreadsheets and databases created by end users without the involvement of IT."  The 2 new applications are aimed at helping organizations deal with the significant risks introduced by EUCs.

So the world runs on Excel! … and these tools are designed for organizations that want to know about the data and make sure that data is protected, accurate and audited!

The data produced by the EUCs is typically trusted and accepted by stakeholders, and often becomes the basis for critical decisions and reporting.  Without proper controls, use of EUCs can lead to financial and operational loss, through undetected errors, unexpected mistakes, and even fraud. 

So after the EUCs are identified and categorized by Discovery and Risk Assessment Server, ACM allows one to keep track of all the changes to those mission critical EUCs.

The workhorse of all these new products is Audit and Control Management (ACM) Server, which provides powerful change management features for Excel and Access files.  ACM Server keeps a close eye on your critical EUCs and gives you the ability to see the "who, what, where, and when" for changes in EUCs down at the cell level.  You can see if someone has modified formulas or VBA code, and ACM Server will show you the old value and the new value after the change.  ACM Server also keeps the revision history for your files, so you can easily compare any 2 versions, or even restore a prior version.

A couple of other points worth mentioning are ACM does this work remotely. It monitors files on network file shares and SharePoint document libraries and captures a cell-level audit trail of changes. This then allows for change control and versioning.  The screenshot on the Excel blog post above does not give a good view of the UI, but it is web-based and very similar to SharePoint making the learning curve rather slight.

The bulk of ACM’s capabilities can be summarized as:

• Automatically saves that version of the file and tracks what changes the user has made since the prior version.
• Maintains a version history of changes to all to enable historical comparisons of EUC versions and the ability to revert files that have been corrupted with errors or unauthorized changes.
• Supports all recommended controls including change control, access control, version control, analytics, backup and archiving, security and data integrity, and segregation of duties.

Another rather important point to note is that the purchase of ACM is required for Discovery and Risk Assessment Server.  So you are getting two Spreadsheet control products included in the price.  You can read more about it on the links above, but as the name of the product suggests

Discovery and Risk Assessment Server is used to detect and assess Excel and Access files in specified folders. It populates and then updates a master inventory in Audit and Control Management Server, and displays findings and results in charts for ease of consumption.

Its primary use would be to create or update a list of important Excel workbooks and Access databases, or when admins want a quick and easy way to identify potential areas of risk in Excel workbooks and Access databases

This leads me to the licensing information on the product that was difficult to find.  The above excel blog post simply refers one to the volume licensing site, which is roughly the size of Hudson bay, so good luck with the finding out how to buy ACM!    That can be forgiven considering the quality of the other information provided!

I found a an appendix slide buried at the bottom of a SharePoint licensing deck that gave what you see below.  The only clue to get me started was the fact the Spreadsheet Management with the new Office whitepaper does state a SharePoint ECAL is required for ACM.

The licensing details as I know them are as follows:

The Two Server features:

Discovery & Risk Assessment

Audit & Control Manager

Are licensed through SharePoint Enterprise CAL (ECAL)

However, in order to USE these tools, customers MUST ALSO LICENSE:

Microsoft Office Audit and Control Management Server 2013 which becomes available for sale tomorrow through Open License.

NOTE:  The SharePoint ECAL is required for all users whose content is being managed/monitored by the Microsoft Office Audit and Control Management (ACM) Server or who access the ACM server

Microsoft Office Audit and Control Management Server 2013 will be priced @~50% off SharePoint Server 2013list price.

Thanks for listening,

Woody