There are occasions where customers can use an additional user license unexpectedly causing them to exceed their normal license usage. Here are the three most common reasons:
A user has multiple Client profiles with different Identity Providers
Even though it is the same person signing in on the same device, the Appgate SDP system will treat each user on different IdPs as separate users. This is something important to keep in mind in situations where customers are moving their users to a different IdP. As per the licensing model in Appgate, user licenses are automatically un-assigned 30 days after a user was last seen. So there can be a transitional period where 2 licenses are consumed per user. In cases like that, customers are advised to contact their Customer Success Manager (CSM) or Appgate Support to acquire a temporary license that will get them through the 30-day lease period.
Changes made to the user in Active Directory
The Appgate system is sensitive to the username including being case sensitive. Making changes to the user like when making a domain change will cause the user to consume an additional license. Changes in case sensitivity will also cause AppGate to identify the user as being different. For example, usernames xyz@appgate.com and xyz@Appgate.com will be treated as different users and a second user license will be consumed when the punctuation is changed.
This is important to keep in mind when customers are making any IdP changes having to do with the capitalization of usernames. In this case as well, customers are advised to contact their CSM or Appgate Support to acquire a temporary license that will get them through the 30-day lease period.
When generating the next CA, under System --> Certificate Authority in the Admin UI
Generating a new CA is required when it is about to expire. After generating the new CA, administrators will see that a new "License for Next CA" section will be added at the bottom of the Settings --> Licenses page. This is because the License is tied to the CA certificate and your current one(s) will no longer be valid once the next Controller CA certificate is activated. Before you can activate the next CA, please make sure to request and obtain a new License - it requires a new request code - that will replace your old one(s) and apply it in that section of the Licenses page. Once you activate the next Controller CA certificate, the new/replacement license will be automatically applied.
More information on the Certificate Authority and generating the next CA can be found in our Admin Guide.