This article provides a detailed overview of how licensing works within our system. It will explain the different types of licenses, how they are allocated, and the specific metrics used to count your active license usage on different HEIMDAL products. Understanding this process is crucial for managing your subscription and ensuring compliance.
EMAIL SECURITY
Licensing for Email Security depends on how you choose to configure the product for your environment. On one hand, customers using the Exchange Online service can configure Email Security automatically using the integration we developed for the Microsoft Graph API. On the other hand, customers who are not using Exchange Online can configure Email Security with the MX Records method by pointing the domain's DNS to the Email Security servers. Below, we will describe how licensing works for each setup method.
A. Microsoft Graph API
This licensing and synchronization mechanism must be enabled initially from the HEIMDAL Dashboard. Navigate to Network Settings -> Email Protection -> Email Security. Locate the Grant consent hyperlink and click it. Clicking the link establishes a secure connection between Email Security and your Azure/Microsoft 365 tenant. It automatically provisions the Heimdal ESEC enterprise application within your Microsoft Entra ID. This authorized application grants the HEIMDAL Dashboard the precise read permissions required to safely query your mailbox counts and activity data via the Microsoft Graph API.
To ensure you are only billed for active, utilized mailboxes, HEIMDAL calculates the total number of licenses based on a specific filtering process. A mailbox is counted toward your license seat total only if it meets all three of the following criteria simultaneously during the selected billing interval:
The mailbox must be discovered within Exchange Online Protection (EOP) and categorized as either a User Mailbox or a Shared Mailbox (distribution lists are not considered).
Note: Resource mailboxes (such as meeting rooms or equipment) are automatically excluded from this count.The mailbox must have an active, assigned Microsoft 365 Exchange Online license.
The mailbox must show active login activity (sign-in logs) within the selected billing period. If a mailbox is licensed but has completely zero login/access activity during the billing interval, it is excluded from that period's license count. For shared mailboxes, logging in refers to authorized users accessing or interacting with the shared mailbox during that timeframe, which is calculated entirely on the start date of your Device Info report.
Note: This activity and license data are retrieved directly from the Microsoft Graph API. The synchronization job runs once a week, every Monday. Any changes made in Microsoft 365 mid-week will be reflected in Heimdal after the next Monday sync.
B. MX Records counts
The number of licenses will be counted based on the following formula:
1. In the selected interval, we consider all the domains configured at the Customer level.
Example: Customer The Strong Example filters email traffic on 3 domains: strongexample.com, strongexample.eu, and strongernow.org.
2. We count all INBOUND mailboxes from all domains (the OUTBOUND is not taken into consideration).
3. We look for identical user accounts across all domains. If identical user accounts (mailboxes) are found, we strip the Top Level Domain (TLD) from each identical user account (mailbox) and merge them. The email counts for each merged mailbox are added to get the total.
Example: john@strongexample.com received 40 emails, and john@strongexample.eu has received 12 emails. Because the user accounts appear similar, we strip the TLDs (.com and .eu) and merge the 2 accounts' counts. Out of 2 mailboxes, the results show one mailbox (john@strongexample, with a total of 52 received emails).
4. After merging all identical mailboxes, we filter out the mailboxes that have a total of fewer than 21 received emails. Only the mailboxes (including the merged ones) that have an email count of 21 or higher are considered in the final billing report.
REMOTE DESKTOP
Your license usage is measured by the peak concurrent sessions within each licensing period. The total count is calculated based on the highest number of sessions active at the same time for each of your individual customers. For Managed Service Providers (MSPs), these individual customer peaks are aggregated into a combined total.
Example: During a given period, if you have four customers with the following peak session usage:
- Customer A: 1 session
- Customer B: 1 session
- Customer C: 1 session
- Customer D: 4 sessions
Your total license count for the period will be 7, calculated by summing each customer's peak usage: 1 + 1 + 1 + 4.