BeyondTrust licensing is the set of contractual rules under which BeyondTrust Corporation licenses its privileged access management, remote access and identity security software, including Remote Support, Privileged Remote Access, Password Safe, Endpoint Privilege Management and Identity Security Insights. Since the retirement of perpetual licensing, every product is sold as a term Subscription: either an On-Premise Software Subscription for software installed on customer-controlled computers, or a Cloud Services Subscription for software accessed over the internet.[1][2] The governing contract is the Software License and Subscription Agreement, which incorporates its Standard Terms & Conditions, an Exhibit A of defined terms and each Order. Where these conflict, the Standard Terms prevail over Exhibit A, which prevails over the Order.[1]
The quantity a customer buys is expressed in units defined in Exhibit A. The main units are Active Login (concurrent Remote Support representatives), Active Endpoints (endpoints accessed through Privileged Remote Access), Asset, Managed User and/or Managed Computer Object, Managed Devices, Managed Servers and Instance.[1] Product documentation adds technical counting rules, such as licence pools in Remote Support, endpoint counters in Privileged Remote Access and client limits in Endpoint Privilege Management for Unix and Linux.[4][5][7]
Editions
BeyondTrust does not publish one edition matrix or a public price list for its portfolio. Its product pricing pages, such as the one for Identity Security Insights, ask buyers to contact the sales team for a custom quote.[12] What the contract distinguishes is the delivery model, not an edition:
- On-Premise Software Subscription. Electronically delivered software installed on computers owned or managed by the customer. The grant is a limited, non-exclusive, non-transferable, revocable right to install and use the software for internal use during the Subscription Term.[1]
- Cloud Services Subscription. Access to the software over the internet. The customer receives a subscription to use the service, not an intellectual property licence to the software behind it.[1]
- Perpetual licence. Still covered by Appendix 1 of the agreement, but only for customers who continue to own perpetual licences up to December 2026. BeyondTrust stopped selling perpetual add-ons on 2025-12-31 and will stop selling maintenance for them on 2026-12-31.[1][2]
The perpetual retirement notice names six products that had perpetual licences: AD Bridge, Endpoint Privilege Management for Windows & Mac, Endpoint Privilege Management for Unix & Linux, Remote Support, Password Safe and Privileged Remote Access. All of them except AD Bridge have both SaaS and on-premises subscription offerings. AD Bridge is sold only as an on-premises subscription.[2] The EoS and EoL page also lists older editions and products as end of sale or end of life. These include Endpoint Privilege Management Windows Group Policy Edition (GPO), the Trellix ePolicy Orchestrator Edition (ePO), PowerBroker for Windows and Privileged Identity.[3]
Metrics
Each Order states its quantity in one or more units from Exhibit A. The definitions are held as catalog rows. This page names them and does not restate them.
| BeyondTrust unit | Catalog row | Typical products |
|---|---|---|
| Active Login | Active Login | Remote Support |
| Active Endpoints | Active Endpoints | Privileged Remote Access |
| Maximum Concurrent Users | Maximum Concurrent Users | Privileged Remote Access |
| Jump Client | Jump Client | Remote Support |
| Asset | Asset | Password Safe, BeyondInsight, all products |
| Managed User and/or Managed Computer Object | Managed Computer Object | Endpoint Privilege Management |
| Managed Servers / Managed Devices | Managed Servers, Managed Devices | Password Safe, Endpoint Privilege Management |
| Instance | Instance | All products (production, test, disaster recovery) |
| Client (EPM-UL licence) | EPM-UL Client | Endpoint Privilege Management for Unix and Linux |
| Endpoint (EPM for Linux licence) | EPM-L Endpoint | Endpoint Privilege Management for Linux |
Exhibit A defines an Asset as a physical or virtual device that meets any one of the descriptions for Active Login, Active Endpoints, Managed User and/or Computer Object, Managed Devices and Managed Servers. It therefore works as an umbrella term over the more specific units.[1]
Counting / floors
The licence grant in both subscription types is capped by the Order. Use is limited to the number of deployed Instances, Assets, physical and virtual machines and physical locations specified there.[1] BeyondTrust publishes no general minimum purchase quantity. The product documentation describes how each product counts consumption:
- Remote Support is licensed by concurrent users. Any number of accounts can be created, but only as many representatives as there are licences can be logged in to the representative console at the same time. A representative in extended availability mode consumes an additional licence.[4] Since 2025-01-01 all customers are subject to a ratio of 150 Jump Clients per concurrent licence, and additional Jump Clients can be bought.[3]
- Privileged Remote Access reports two counters on its Status page. Maximum Concurrent Users is the number of users who can be logged in to the access console at the same time. Endpoint Licenses is the total number of endpoints, meaning Jump Clients and Assets, the site is allowed.[5]
- Password Safe and BeyondInsight licences carry a purchased asset count. Moving from one asset tier to another (the documentation’s example is 500 to 1,000 assets) requires a licence update.[6]
- Endpoint Privilege Management for Windows and Mac requires a valid licence code in at least one policy applied to each computer.[14] Endpoint Privilege Management for Unix and Linux counts every machine that runs a client component, including machines that are also policy server or log server hosts.[7]
The per-product rules are covered in BeyondTrust Remote Support and Privileged Remote Access licensing and BeyondTrust Password Safe and Endpoint Privilege Management licensing.
Virtualization & partitioning
BeyondTrust does not use processor, core or partition metrics, so it has no hard or soft partitioning policy. Virtualization matters because it decides how many units a device-based metric counts. Exhibit A treats physical, virtual and Container devices alike when it defines a Managed User and/or Managed Computer Object, whatever the number of IP addresses. It names VMware Server, Hyper-V, Azure VMs, Amazon AWS VMs and zOS LPARs as examples of virtual environments.[1] The Managed Servers definition applies to virtual and physical servers alike. The Active Endpoints definition covers virtual or physical systems, as well as unique applications published through Secure App and unique URLs published through Web Jump.[1] In practice, each virtual machine or container counts as one unit wherever the metric is device-based.
Cloud / BYOL
BeyondTrust’s cloud offerings are its own SaaS services, sold as Cloud Services Subscriptions. They are not a bring-your-own-licence right for third-party clouds. The Cloud Service Level Agreement commits to commercially reasonable efforts to make the Cloud Service available at least 99.9% of each calendar month, excluding Excused Downtime. Excused Downtime includes up to two hours of monthly maintenance.[10] Exhibit A states that this SLA applies only to Cloud Services, not to On-Premise Software.[1] BeyondTrust publishes no vCPU or core mapping for running on-premises subscriptions on public cloud infrastructure. An on-premises subscription stays limited to the machines, Instances and locations in the Order.[1]
Programs
Subscription terms
The Initial Subscription Term is whatever the Order states, and may be several years. If the Order is silent, it is one year. Each Order then renews automatically for one-year periods unless either party gives written notice at least 30 days before the end of the current term.[1] BeyondTrust may adjust fees at the end of a term by giving at least 60 days’ written notice before the next renewal term. Invoices are due within 30 days.[1] When a Subscription Term ends, the customer must stop using the software and return or destroy it within five days.[1]
Support Services
Support Services are part of every On-Premise and Cloud Subscription. They start on delivery, on download availability or when the cloud password is issued, and they last for the rest of the Subscription Term.[1] The Customer Support Guide states that a product must be covered by a valid maintenance contract to receive support.[8] Where customers control the deployed version, each major version is supported for two years from its initial release, and out-of-support versions are not patched.[9]
Not For Resale licences
Partners may receive Not For Resale (NFR) licences at no charge. These are solely for evaluation at the partner’s own sites and may not be used with the partner’s customers or in production.[11]
Bundled capabilities
BeyondTrust describes the Secrets Safe capability as included in Password Safe at no extra cost. It gave this as one reason for retiring the older Privileged Identity product in favour of Password Safe.[13]
Use rights and restrictions
The permitted use is internal use. The territory is worldwide unless the Order says otherwise, subject to export law.[1] The customer may not time-share the software, use it in a service bureau arrangement or use it for the benefit of any third party. It also may not disclose benchmark results.[1] The customer’s Affiliates and Personnel may use the subscription, but the customer remains primarily responsible for their breaches.[1] Neither party may assign the agreement without consent. The exceptions are assignment to an Affiliate and assignment as part of a transfer of all or substantially all of a business. When BeyondTrust does permit an assignment, the transferee must accept the terms in writing.[1] Customers located in the People’s Republic of China or the Russian Federation are defined as Ineligible Customers, and BeyondTrust may reject their Orders.[1]
Audits and compliance
Section 10 of the agreement gives BeyondTrust two ways to verify compliance. The first is online verification, including collecting product utilization information. The second is a customer-supplied report, no more than once a year, that details installation and usage in enough detail to show compliance or non-compliance with the Order’s limits.[1] If the customer has exceeded its rights, it pays for the excess at BeyondTrust’s then-current rates. Because BeyondTrust may sell subscription rights in unit multiples, the customer pays for enough units to cover at least its usage.[1] The agreement has no on-site audit clause and no notice period for verification. Instead, BeyondTrust’s own products show licence counters that can serve as evidence, such as the total support licence count in Remote Support and the endpoint and concurrent-user counters in Privileged Remote Access.[4][5]
Out of scope
This article does not cover Identity Security Insights licensing in detail. BeyondTrust publishes no licence metric for it, and its pricing page offers only a quote on request.[12] It also does not cover professional services and e-learning fees, the Data Processing Addendum, hardware appliance pricing or partner programmes other than NFR. Legacy products are covered only where a BeyondTrust document is cited. For the end of sale of perpetual licences and appliances, see BeyondTrust perpetual licensing end of life.