Licenses, seats and usage

Applies to client 2.0.x and later. For tenant admins, partner admins.

The license of a tenant sets its tier (Standard or Enterprise), its expiry, its number of seats and its plan. The seats limit how many devices can be active in the tenant at the same time. The portal checks this when a device enrolls; nothing changes on devices that are already enrolled, and the client needs no update for it.

Plans

Every license has a plan. Licenses shows it next to the tier, the seats and the expiry.

Plan	Who issues it	Device cap
Paid	Your partner, or the vendor	Soft cap: the seats plus a tolerance
Trial	The trial flow (50 seats, 30 days), your partner (at most 50 seats and 30 days), or the vendor	Hard cap: the seats
Free	The Free sign-up (25 seats, 12 months), or the vendor	Hard cap: the seats
NFR (not for resale)	The vendor only	Soft cap: the seats plus a tolerance

A license issued before plans existed counts as Trial when it is a trial license, otherwise as Paid. Paid and trial seats count toward a partner’s seat quota; Free and NFR do not, which is why only the vendor issues them. A tenant that started as a trial is converted for good by any license that is not a trial.

Free plan

The Free plan is for small organisations. Sign up at /free on the portal (company, name, work email; free mail providers are not accepted). The confirmation link in the mail creates the tenant at once, with you as its tenant admin, a Free license and your configured download. There is no approval step.

What is included:

• Standard features: approved applications, on-demand elevation with a reason, the audit. Enterprise features (manual approval, rules, child elevation, any application on demand, Entra group targeting, sandbox groups, the emergency admin account) are not included; the portal refuses to turn them on and sends them switched off to the devices.
• Up to 25 devices. The 26th active device is refused at enrollment (hard cap, see below).
• Audit kept for 30 days. Audit records, installed software changes and the local admin history written while the tenant is on the Free plan are deleted 30 days after they were written (every other plan: 400 days). The period is set on each record when it is written: a later plan change does not shorten or extend records that already exist. The tenant overview shows the period that applies now.

Renewal: the Free license runs for 12 months. 14 days before it ends, a daily check issues a new 12-month Free license when both are true:

• a tenant admin signed in to the portal within the last 90 days, and
• no more than 25 devices are active.

Otherwise the license is not renewed and every tenant admin gets a mail 14 days and 1 day before the end, naming the reason (no admin sign-in, or more than 25 active devices). Sign in, or revoke devices that are no longer used, before the end date: the next daily check then renews it. This still works during the 14 days after the end date, while the devices keep working on the license grace period; after that the Free plan needs a request to the vendor.

One Free tenant per organisation: a second sign-up from the same organisation (the same email domain, subdomains included) gets a mail instead of a tenant. When a Free tenant connects its Microsoft Entra directory (see Microsoft Entra sign-in), that directory belongs to it as well: another Free tenant cannot connect the same directory.

Enterprise trial and upgrade:

• A Free tenant can start one 30-day Enterprise trial from the tenant overview (Start a 30-day Enterprise trial, tenant admins). When it ends, the Free license applies again if no more than 25 devices are active (the original one while it is valid, otherwise a new one); otherwise it does not, and the tenant admins get the mail.
• To upgrade, contact the vendor: a paid license replaces the Free plan. The tenant keeps all its data, devices and settings, and the organisation does not get a second Free tenant.

Active devices

A device is active when its record is not revoked and its status is Active. Not counted:

• revoked devices;
• re-enrollments waiting for approval on Devices;
• an approved re-enrollment whose device has not collected its access yet (it counts once it has);
• rejected or expired re-enrollments.

Every record that is not revoked, pending ones included, counts as enrolled. The seats limit active devices only.

The device cap at enrollment

When a new device enrolls, the portal compares the tenant’s active devices with the limit of its current license. The current license is the newest one that is active and not expired. A new device is admitted while the active count is below the limit:

Plan	Limit (a new device is refused at this active count)
Free, Trial	the seats
Paid, NFR	the seats + max(2, ceil(seats x 10 %))
No current license, or 0 seats	no limit

Examples: 10 seats on a paid license admit up to 12 active devices (the 13th is refused), 50 seats admit 55, 100 seats admit 110 and 101 seats admit 112. A 50-seat trial admits exactly 50.

What the cap never does:

• It never touches a device that is already enrolled, also when the seats are lowered below the active count.
• It never refuses a machine that already has an active device. Such a machine (a reinstall or a new disk) waits under Re-enrollments waiting for approval as before; approving it replaces the old record, so the count does not grow.
• A refused enrollment does not use up the enrollment key.

Several devices enrolling at the very same moment can pass the limit by the number that were in flight; the next daily usage snapshot shows the real count.

What the device does when it is refused

The portal answers the device with 402 SeatsExceeded. The device:

1. writes event 3015 with code=ClientError and “HTTP 402 SeatsExceeded” to the Windows Application log (source AdminExplorer; the same code at most once per day);
2. stays not enrolled and keeps its enrollment key;
3. tries again with its enrollment back-off: after 1, 2, 4 and up to 60 minutes.

Once a seat is free it enrolls on its next attempt with the same installation; nothing has to be reinstalled. Until then the tray’s Status shows the device as not enrolled.

Seat warnings in the portal

Overview and Devices show “N active of S seats”, the plan and the active count at which new devices are refused. The state:

State	When	Shown
OK	below 90 % of the seats	OK badge
Near limit	at 90 % of the seats or more	Warning: the tenant is close to its seat limit
Over seats	at or above the seats, inside the tolerance (Paid and NFR only)	Warning: raise the seats or revoke unused devices
Limit reached	at or above the limit	Error: new devices are refused
No limit	no current license, or 0 seats	“N active (no seat limit)”

On a Free or Trial license there is no tolerance, so the state goes from Near limit straight to Limit reached.

Devices also lists Refused enrollments: time, machine name, the active count and the limit at the refusal, and the plan. The portal keeps the last 50 refusals per tenant and adds at most about 20 per hour to the list; devices past that are still refused, only not listed. Partner admins see the same seat state per tenant in their tenant list.

Daily usage snapshots

Every night (02:45 UTC) the portal takes one snapshot per tenant: active and enrolled devices, seats, tier and plan. A snapshot holds the tenant id and these counts only, no device names or users. Snapshots are kept for 400 days as usage history, also after a tenant is deleted. The refused-enrollments list holds machine names and is deleted with the tenant.

Partner roll-up and CSV export

Partner admins open Usage in the partner navigation:

• Seats now: per tenant the active devices of its seats and the state, from the tenant’s latest daily snapshot (counted live for a tenant that has none yet), and its last refused enrollment.
• Monthly usage: per month and tenant the peak of the daily active counts, with tier, plan and seats from the month’s latest snapshot, the number of days with a snapshot, and the totals. The default period is the last 12 months including the current one; choose at most 13 months.

The vendor sees the same roll-up across all partners and exports it as CSV, one row per month and tenant with the columns month, tenantId, tenantName, partnerId, tier, plan, peakActiveDevices, seats and days. The partner page has no export.

When new devices are refused

As a tenant admin:

1. Open Devices and check Refused enrollments and the seat state.
2. Revoke devices that are no longer used (retired, reimaged under a new name, duplicates). A revoked device stops working at its next call, and its seat is free at once.
3. If the tenant really needs more devices, ask your partner (or the vendor, if you buy directly) for a license with more seats. Only partner and vendor administrators issue licenses; the new license applies to the next enrollment at once.
4. The refused devices enroll by themselves on their next retry (with the default back-off within an hour). Check Devices.

As a partner admin, issue the new license on the tenant’s Licenses page. Your partner seat quota counts paid and trial seats; if the new license would exceed it, the portal refuses it and the vendor raises the quota.

Related guides

• Getting started
• Troubleshooting
• Audit and reports