This article provides a detailed overview of how licensing works within our system. It will explain the different types of licenses, how they are allocated, and the specific metrics used to count your active license usage across different HEIMDAL products. Understanding this process is crucial for managing your subscription and ensuring compliance.
1. DNS Security
2. Patch & Assets
3. Endpoint Protection
4. Privileges & App Control
5. Email Security
6. Remote Desktop
For standard agent-based modules running on workstations and servers, licensing is calculated based on active endpoints (registered unique devices running the HEIMDAL Agent with the respective module enabled in their active Group Policy).
Each active host registered in the dashboard consumes 1 license seat for each enabled module assigned to that host. Below are the specific seat count rules for each product.
DNS SECURITY
DNS Security - Endpoint
- Metric: Active endpoints (Workstations and Servers).
- Calculation: Each device running the HEIMDAL Agent that has DNS Security (DarkLayer Guard) active consumes 1 seat.
DNS Security - Network
Usage is calculated by dividing the total DNS queries per second during the calendar month by the average query rate of a single device (totalRequests / totalSecondsOfTimeframe / 0.045). To determine monthly device usage, divide the total number of DNS requests by the total seconds in the calendar month to calculate your average queries per second (QPS). Then, divide that QPS figure by the single-device baseline rate of 0.045 queries per second. Alternatively, you can simplify the calculation by dividing total requests directly by the product of total seconds and 0.045.
PATCH & ASSETS
Patch & Asset Management (3rd Party & OS Updates)
- Metric: Active endpoints
- Calculation: Each Windows, macOS, or Linux device running the HEIMDAL Agent where 3rd Party Patch Management or Microsoft/OS Updates monitoring is enabled consumes 1 seat.
Infinity Management
- Metric: Active endpoints assigned to a Group Policy that comes with Infinity Management enabled.
- Calculation: Infinity Management is an add-on module to Patch & Asset Management. Each endpoint configured to receive custom patch deployments or 3rd-party application deployments via Infinity Management consumes 1 seat.
ENDPOINT PROTECTION
NEXT-GEN ANTIVIRUS
- Metric: Active endpoints with Antivirus protection active.
- Calculation: Each workstation or server where the Next-Gen Antivirus module is enabled in the assigned Group Policy consumes 1 seat.
Ransomware Encryption Protection (REP)
- Metric: Active endpoints protected by REP.
- Calculation: Each endpoint running the HEIMDAL Agent with Ransomware Encryption Protection toggled ON consumes 1 seat. REP operates independently or alongside Next-Gen Antivirus.
PRIVILEGES & APP CONTROL
Privileged Elevation and Delegation Management (PEDM)
- Metric: Active endpoints with PEDM capabilities enabled.
- Calculation: License usage is counted per endpoint managed by the PEDM module. Any device where local admin rights elevation requests can be initiated or approved consumes 1 seat, regardless of how many individual elevation requests are generated on that host.
Application Control
- Metric: Active Endpoints subject to Application Control rules.
- Calculation: Each host running the HEIMDAL Agent with Application Control enforcement (Allow, Block, or Audit Mode) active in its assigned Group Policy consumes 1 seat.
Privileged Access & Session Management (PASM)
Unlike endpoint-based PEDM, Heimdal PASM (Privileged Access & Session Management) licensing is measured as the higher value between the number of Administrator Accounts and one-tenth of the total number of users during the last calendar month.
EMAIL SECURITY
Licensing for Email Security depends on how you choose to configure the product for your environment. On one hand, customers using the Exchange Online service can configure Email Security automatically using the integration we developed for the Microsoft Graph API. On the other hand, customers who are not using Exchange Online can configure Email Security with the MX Records method by pointing the domain's DNS to the Email Security servers. Below, we will describe how licensing works for each setup method.
A. Microsoft Graph API
This licensing and synchronization mechanism must be enabled initially from the HEIMDAL Dashboard. Navigate to Network Settings -> Email Protection -> Email Security. Locate the Grant consent hyperlink and click it. Clicking the link establishes a secure connection between Email Security and your Azure/Microsoft 365 tenant. It automatically provisions the Heimdal ESEC enterprise application within your Microsoft Entra ID. This authorized application grants the HEIMDAL Dashboard the precise read permissions required to safely query your mailbox counts and activity data via the Microsoft Graph API.
To ensure you are only billed for active, utilized mailboxes, HEIMDAL calculates the total number of licenses based on a specific filtering process. A mailbox is counted toward your license seat total only if it meets all three of the following criteria simultaneously during the selected billing interval:
- The mailbox must be discovered within Exchange Online Protection (EOP) and categorized as either a User Mailbox or a Shared Mailbox (distribution lists are not considered).
Note: Resource mailboxes (such as meeting rooms or equipment) are automatically excluded from this count. - The mailbox must have an active, assigned Microsoft 365 Exchange Online license.
- The mailbox must show active login activity (sign-in logs) within the selected billing period. If a mailbox is licensed but has completely zero login/access activity during the billing interval, it is excluded from that period's license count. For shared mailboxes, logging in refers to authorized users accessing or interacting with the shared mailbox during that timeframe, which is calculated entirely on the start date of your Device Info report.
Note: This activity and license data are retrieved directly from the Microsoft Graph API. The synchronization job runs once a week, every Monday. Any changes made in Microsoft 365 mid-week will be reflected in Heimdal after the next Monday sync.
B. MX Records counts
The number of licenses will be counted based on the following formula:
1. In the selected interval, we consider all the domains configured at the Customer level.
Example: Customer The Strong Example filters email traffic on 3 domains: strongexample.com, strongexample.eu, and strongernow.org.
2. We count all INBOUND mailboxes from all domains (the OUTBOUND is not taken into consideration).
3. We look for identical user accounts across all domains. If identical user accounts (mailboxes) are found, we strip the Top Level Domain (TLD) from each identical user account (mailbox) and merge them. The email counts for each merged mailbox are added to get the total.
Example: john@strongexample.com received 40 emails, and john@strongexample.eu received 12 emails. Because the user accounts appear similar, we strip the TLDs (.com and .eu) and merge the 2 accounts' counts. Out of 2 mailboxes, the results show one mailbox (john@strongexample, with a total of 52 received emails).
4. After merging all identical mailboxes, we filter out the mailboxes that have a total of fewer than 21 received emails. Only the mailboxes (including the merged ones) that have an email count of 21 or higher are considered in the final billing report.
REMOTE DESKTOP
Your license usage is measured by the peak concurrent sessions within each licensing period. The total count is calculated based on the highest number of sessions active simultaneously for each of your customers. For Managed Service Providers (MSPs), these individual customer peaks are aggregated into a combined total.
Example: During a given period, if you have four end users with the following peak session usage:
- End user A: 1 session
- End user B: 1 session
- End user C: 1 session
- End user D: 4 sessions
Your total license count for the period will be 7, calculated by summing each end user's peak usage: 1 + 1 + 1 + 4.
THREAT-HUNTING & ACTION CENTER
- Metric: Active Endpoints reporting telemetry to XTP / Action Center.
- Calculation: Licensing is calculated per monitored device sending security telemetry and behavioral events to the HEIMDAL Threat-Hunting engine. Each endpoint integrated into XTP detections consumes 1 seat.