Licensing & Plans
Understand what your plan includes, what a locked feature looks like, and how the identity cap works.
Requires role: Viewer (see the license banner and which features are locked) · Admin (open the License page, apply or renew a license) Related: License Management & Feature Gating, Preview & License Lifecycle, Select Fire™, Detection Alerts, Critical Junctions, Delegation Risk, Multi-Agent Intelligence, Remediation Reversibility and Undo, Bridge Configuration
Overview
Every GraphnAI deployment runs on a plan. The plan decides two things: which advanced features are unlocked, and how large a directory you can collect. Signing in, the identity graph, dashboards, posture scoring and directory sync work the same on every plan.
Features your plan doesn't include stay visible, marked with a lock, so you can see what an upgrade adds. A few safety controls never depend on the plan. See What always works.
Prerequisites
- Viewer role or above to see the license banner and which features are locked.
- Admin role to open Admin > License and apply or renew a license.
- Nothing else to set up. The plan applies as soon as a license is imported.
What always works, whatever your plan
Your plan never restricts these:
- Signing in and out, and your own sessions.
- Users and identity providers, so you can always add teammates and keep sign-in working.
- Everything you can see: the identity graph, search, dashboards, security posture, stale identities, over-permission analysis and the identity inventory.
- Directory sync, scheduled and manual, within the identity cap and directory source limit described below.
- The automation kill switch, which stops automatic actions.
- Undo of an action you already ran. An action you ran while it was licensed can be undone on any plan. See Remediation Reversibility and Undo.
An expired license is a separate case. It turns the platform read-only, which blocks every change, undo and the kill switch included. See Read-Only State.
What a locked feature looks like
A feature you haven't bought stays in the product with a lock:
- In the sidebar, a locked item keeps its place with a lock icon. Its tooltip says an upgraded plan includes it, for example "Detections are available with an upgraded plan." Detection Alerts also keeps its count of open alerts.
- A locked page names the feature, says what it does, and lists what you'd gain. It links to Read the docs and See plans.
- A locked control, such as a button or a mode toggle, looks dimmed but still responds. Its tooltip carries the same note. Select it to open a dialog with the page's details and links.
If GraphnAI can't check your license, for example after a network error, a locked page shows "Couldn't check your license" with Retry. A locked control shows "License check failed". Neither offers an upgrade, because the feature may already be yours.
The identity cap
Some plans, including free plans, set a hard limit on the number of identities. If your plan has no such limit, skip this section.
How the cap works
- Syncs keep running when your directory first grows past the limit.
- A 14-day grace window starts. A yellow banner reads "Your directory has more identities than your license covers. Collection pauses on {date} unless you upgrade." It shows how far over the limit you are.
- New collection pauses if you're still over the limit when the window ends. The red banner reads "Collection is paused." Syncs stop starting, but a sync that's already running finishes.
- Everything already collected stays. Nothing is deleted, hidden or partly collected, and every analysis keeps running on the data you have.
To clear the countdown during the grace window, bring your directory under the limit and let a sync finish. Once collection has paused, syncs can't run, so only a license with a higher limit resumes it. Apply that license and collection resumes at the next sync, with no restart.
GraphnAI checks the grace window once an hour, so the pause can start up to an hour after the date on the banner.
Why collection pauses instead of syncing part of your directory
A directory that's only half collected understates your exposure. Accounts, groups and computers would be missing, and the posture you see would be wrong without saying so. Pausing new collection keeps what you already have complete and accurate.
What counts toward the cap
The cap counts every directory object GraphnAI collects: users, groups, computers and service accounts, and also OUs, containers and the other objects in the graph. The count is taken each time a sync finishes.
Directory sources
Your plan may also limit how many directory sources you connect. A directory source is:
- One Active Directory domain, or
- One Microsoft Entra ID tenant.
A hybrid environment, an on-premises domain plus its Entra ID tenant, counts as two sources. An Entra ID tenant configured more than once, for example under two identity providers, counts once.
- Adding a source beyond your plan is refused when you try to add it: "The current plan covers N directory sources. Remove one or upgrade to add another." Your existing sources aren't touched.
- Removing a source always works, even when you're over the limit.
- If a new license covers fewer sources than you have, the sources you added first keep syncing. The rest stop syncing until you remove sources or raise the limit.
See Bridge Configuration and Domain Auto-Discovery to add and remove directory sources.
Renewing or changing your plan
A new plan takes effect at once, with no restart and no support ticket.
- Sign in as an Admin and open Admin > License.
- Under Apply a license, select Choose your license file, or drag the file onto the box.
- Select Apply.
Once applied:
- New features unlock in place. A page that showed a lock shows the real feature, with no reload.
- A higher identity limit, or none, clears the grace countdown or the pause at once. Collection resumes at the next sync.
- A higher directory source limit, or none, lets you add the sources that were refused.
If the new license gives you less than your current one, a confirmation dialog lists what changes first. Plans with a yearly renewal, including free plans, renew the same way.
Locked features that already show a count
Some locked features show a live count before you've bought them:
- Detection Alerts in the sidebar shows how many alerts are open. Its locked page reads "14 open detection alerts are waiting in your directory."
- The Critical Junctions locked page reads "Your directory has 6 critical junctions." The Junction score card on the dashboard counts them too.
GraphnAI keeps evaluating detections and Critical Junctions on every plan. Only the detailed view is locked.
When you upgrade, nothing has to be found again. Everything found while the feature was locked is there the moment it unlocks, with no new scan or sync. Detection alerts are kept for a year.
Troubleshooting
A feature still shows a lock after you applied a new license
- Cause: The new license doesn't include that feature, or the page hasn't refreshed its license status yet.
- Fix: Open Admin > License and check the feature's badge. A lock there means the license doesn't include it, so ask whoever issued it. A check there with a lock on the page means the page is behind, so reload it.
Directory syncs stopped collecting
- Cause: Your directory has more identities than your plan covers, and the 14-day grace window has ended.
- Fix: Nothing is lost, and every analysis keeps running. Compare Identities with its limit on Admin > License. Apply a license with a higher limit to resume collection.
Adding a domain or tenant was refused
- Cause: It would put you over the number of directory sources your plan covers. A hybrid domain and tenant pair counts as two. A tenant that's already configured doesn't count again.
- Fix: Remove a directory source first, which always works, or move to a plan that covers more sources.
You can't undo a remediation action
- Cause: Your plan never blocks undo. The action may be outside its undo window, already undone, or no longer reversible. A read-only license also blocks undo.
- Fix: Open the action's entry on the History tab of the Remediation page for the reason. If the banner says the license is read-only, apply a new license first. See Remediation Reversibility and Undo.