Appgate SDP is licensed by Users, Portal Users, Sites, Connector Resource Groups and Service Users. The first Controller in a Collective has a default license which will allows two Sites, six users, and one service user.
NOTE
Optional feature licenses will be shown only when they are enabled.
Users, Portal Users, and Service Users
The different user types are each assigned from separate license pools on a first come, first served basis and counted on a unique user basis. A user who signs in twice using the same IdP will only use one license.
Service users are licensed when a unique k8s service Client is injected.
Users are automatically un-assigned and returned to the pool 30 days after the user/device was last seen (twp days for Portal users).
The license counts are checked every hour to see if used licenses > effective license. This might occur because a license has expired, been deleted, or a CA renewal was done with a new, smaller license. When this happens, all the licenses of that type are unassigned and returned to the pool. They are then reassigned on a first come, first served basis.
The always-on Client comprises two parts, full and headless, so it will consume two user licenses. However, the headless part is likely to use a service account which is shared across a number of machines, so the actual number of licenses consumed will be a lot less than two and will more likely be n+1 (where n=users).
Sites and Connector Resource Groups
A Site is granted a license at the time it is created. See Sites.
A Connector is configured using Resource Groups which are effectively Client instances with up to 60 configured on one Connector. A Resource Group is granted a license at the time it is created. See Connector-Express and Connector-Advanced. When a Connector is configured for HA (shares a VIP with another Connector), the cloned Resource Groups configured in the second instance will not be counted.
Site and Connector Resource Group licenses are automatically un-assigned and returned to the pool when the licensed entity is deleted.
Feature Licenses
There are three feature licenses which enable some additional functionality within Appgate SDP.
Risk Engine. Allows the use of the risk engine connectors available through Appgate's ZTP Cloud service.
Digital Experience Monitoring. Provides more insight into both users and app health to better understand usage and to help diagnose issues.
Application Discovery. Allows access to a tool that helps to discover and then define the right Policies and Entitlements for an optimized deployment model.
License usage
Usage is reported in a number of places:
Under Effective License Summary (see below)
In the License widget in the Dashboard
When adding resource groups to a Connector
.png?sv=2022-11-02&spr=https&st=2026-04-17T01%3A19%3A53Z&se=2026-04-17T01%3A34%3A53Z&sr=c&sp=r&sig=HyyPh7Q%2BIb%2BSGzc489t2InJi7CORcocJoRdLSITpV%2BQ%3D)
By a health check warning triggered when usage is greater than 95% AND less than 50 licenses remain
In the file generated when you run the
cz-system-infocommandIn the SNMP/Prometheus stats provided by the Controller
License Expiry
Thirty (30) days before a license expires a warning banner will be displayed on the dashboard. The warning banner will continue to show you how much time remains before the license expires. It is recommended to take action as soon as possible to request a new license before it expires. When a license expires:
Users and Portal users will have their licenses revoked and reallocated on a first come, first served basis. Once all the licenses of a given type are allocated additional users will not be able to connect.
No Sites and Connector Resource Groups will be removed or disabled. However, Sites and Connector Resource Groups can only be created, edited, or saved when there are sufficient licenses of the respective type.
Please contact support if you have questions about license renewal.
The Licenses Form
Use the Licenses form to view all the licenses that have been applied to the system. These are summed up to make the effective license that is active on the system.
Effective License Summary
Shows you the total number of active licenses on the system.
New systems come with one default license that allows six users, two Sites and one service user. If you want to test using Portal user or Connector Resource Group licenses please contact support.
Adding another license
To add another license, click the <Upload License> button. The last license on a system cannot be removed.
Current Licenses
Shows you the details of each individual license on the system. The Current licenses will show which feature licenses are enabled.
License for next CA
Shows you the details of first license that will be used when the next CA is activated. This can be obtained using the unique request code used for license generation. Because this is related to the next root CA to be used by the system this must be present already.
NOTE
Applies the first license that will be used after the next CA is activated. Additional licenses should be added after activation.
Below the license tabs you will see details about how to obtain a production license. To do this you must send your unique request code (related to the root CA of the system so will only work on this system). Click on the link to create an email addressed to appgatesdp.support@appgate.com with subject line: Request for Production license xxxxxxxxxx_v2. Remember to provide information on number of Users, Portal Users, Sites and Connector Resource Groups bought as detailed in your POE (proof of Entitlement).
The process to replace a license (for the next CA) is the same as for a new license. However the email addressed to appgatesdp.support@appgate.com should include the subject line: Request Replacement Production license from xxxxxxxxxx_v2 to zzzzzzzzzz_v2.