LICENSEWARE
Contribute

Check Point workspace security licensing

From the LICENSEWARE WikiLast edited 14 ReferencesCited

This article is about licensing Check Point's workspace security services, formerly sold under the Harmony brand (Endpoint Security, Email Security, SASE, Mobile Security, Browse Security, SaaS Security). For gateways and management see Check Point Quantum and Cloud Firewall licensing.

On This Page

Check Point workspace security licensing covers the user- and device-facing security services that Check Point sold until 2026 under the Harmony brand. These are endpoint protection, email and collaboration security, secure access (SASE), mobile, browser and SaaS security. Most are cloud services administered in the Check Point Portal and governed by the Terms of Service for Cloud Services.[10] The on-premises managed edition of Endpoint Security also uses the Software License Agreement. Every service follows the same path. A new Portal account starts with a free trial, after which the customer buys a licence through a Check Point User Center account and links that account in the Portal.[7][2] The units differ by product. Endpoint Security counts seats, Email Security counts licensed user accounts, and SASE counts members and gateways.[1][5][8][9] For the overall terms see Check Point licensing.

Editions

Endpoint Security. The 2024 package sheet lists five packages: Data Protection, Basic, Advanced, Complete and Elite.[3] Data Protection provides access control, port protection and Full Disk and Removable Media Encryption, without threat prevention. Basic adds threat intelligence, anti-ransomware, anti-bot, anti-exploit, anti-malware, forensics, browser protection and threat hunting. Advanced adds Threat Emulation and Threat Extraction. Complete adds the encryption features to Advanced. Elite adds Posture Management, DLP and GenAI Security, and Endpoint XDR.[3] Optional add-ons are Infinity XDR for Endpoint, Posture Management and Data Loss Prevention.[3] The on-premises guide gives current names such as “Workspace Security Basic (formerly Harmony Basic)” and “Workspace Security Advanced (formerly Harmony Advanced)”.[1] Catalog: Harmony Endpoint Basic, Advanced, Complete, Elite, Data Protection.

Email Security. Packages are chosen on two axes. Coverage is either Email Only (Microsoft 365 Mail and Gmail) or Email and Collaboration, which adds applications such as OneDrive and SharePoint. Security level is either Advanced Protect or Complete Protect, which adds Data Loss Prevention.[4] Add-ons are sold separately: archiving for up to 10 years, Incident Response as a Service, DMARC Management, Security Awareness Training, SSPM and SSPM Premium, and leaked-credential monitoring.[4] Catalog: Advanced Protect, Complete Protect.

SaaS Security. Three licence types differ by the number of SaaS platforms covered: Essentials (up to 2 core platforms), Premium (up to 6) and Complete (unlimited, including multiple instances of the same platform).[12] Catalog: Essentials, Premium, Complete.

SASE, Mobile Security and Browse Security are bought as licences through the User Center after a 30-day trial.[7][13][14] Browse Security trials can be extended in the User Center with the evaluation SKU CP-HAR-BROWSE-EVAL.[14]

Metrics

Product Unit Catalog row 
Endpoint Security Seat: each Endpoint Security client[1] Endpoint seat 
Email Security Each user account with a licence to a protected SaaS application[5] Email Security protected user 
SASE Member licences and gateway licences[8][9] Member; Gateway 
All Portal services (PAYG and usage reports) Daily unique billable units: devices, cores, users, seats or assets[11] Portal billable unit 

Counting / floors

Endpoint seats and the pool. Every Endpoint Security client needs a per-seat licence, and the Endpoint Security Management Server needs its own licence.[1] Clients take their container and component licences from a pool. Licences of different types can be combined to reach the required number of clients. Where the pool holds mixed licences, each client receives a random one.[1] Resetting or deleting a client returns its licence to the pool, and licences are validated when the client sends SYNC or heartbeat messages.[1] SKUs beginning CPEP are containers and CPSB are components. A licence whose SKU ends in -SUBSCR also needs a contract file, which the management server downloads from the User Center every two hours if it has internet access.[1] Licences can be bought as a subscription, an annually renewed contract, or a one-time purchase.[1] Catalog: Endpoint Security is licensed per seat from a pool.

Terminal servers. On Terminal Services and Remote Desktop Services hosts, licensing is per user. Each user counts as a seat, using existing SKUs.[2] Catalog: Terminal server users each count as a seat.

Endpoint data limits. Threat Hunting and endpoint data are retained for 30 days by default, with an ingestion limit of 110 MB per seat per day. One-year retention needs an additional SKU.[2]

Email Security users. Email Security protects only active user accounts that have a valid Microsoft or Google licence and at least one mailbox. Each such account consumes one licence.[5] The counting rules have several edges that matter when reconciling against Microsoft 365 or Google Workspace counts.[5]

  • A person with both a Google account and a Microsoft account under different addresses, protected from the same tenant, consumes two licences.
  • Group mailboxes, unlicensed shared mailboxes and aliases are protected but not counted. Licensed shared mailboxes, which Microsoft bills for, do consume a licence.
  • Microsoft 365 F1 users are not protected or counted for email by default.
  • Users with licences only for Microsoft Teams are protected and do not show as consuming licences, but Check Point says licences must still be bought for them.
  • Users sync every 24 hours, so additions and removals take up to a day to affect the count.

Customers can limit licence consumption to a specific group.[5] Some Microsoft and Google plans are not supported at all. Microsoft 365 F1 users, for example, are counted and protected for OneDrive and SharePoint but not for email.[6] Catalog: Email Security counts licensed user accounts, not shared mailboxes.

SaaS Security floor. Organizations with up to 499 users cannot buy the Essentials licence and must buy Premium or Complete.[12] Catalog: SaaS Security Essentials is not sold to organizations with up to 499 users.

SASE traffic. For the Harmony Connect Remote Access and Internet Access services, the Cloud Terms cap the Permitted Scope at 12 GB of traffic per licensed unit per month.[10] Catalog: Harmony Connect traffic cap of 12 GB per licensed unit per month.

Virtualization & partitioning

Virtual desktops and servers running the Endpoint Security client count like physical ones, because the seat is the client. Multi-user terminal servers count each user.[1][2] No core- or host-based rule applies to the workspace products.

Cloud / BYOL

All workspace services except on-premises Endpoint Security management are delivered from Check Point’s cloud, so BYOL does not apply. Endpoint Security licences can also be bought with Amazon Web Services credit through AWS Marketplace.[2]

Programs

Trials. A new Check Point Portal account gets a free 30-day trial for SASE, Mobile Security, Browse Security and Endpoint Security, after which a licence must be bought.[7][13][14][2] Email Security gives a 14-day trial with all features for an unlimited number of users.[4] Under the Cloud Terms, Check Point may end a trial at any time.[10] When Mobile Security moves to production, trial licences stop applying and the dashboard counts only devices covered by production licences.[13] Catalog: Portal services need a User Center licence after the trial.

Pay-As-You-Go for MSPs. MSPs can use the Check Point Portal for MSSPs to assign Pay-As-You-Go licences to customers, for example for Email Security and Mobile Security.[5][13] PAYG usage is calculated from daily unique billable units. Monthly usage is the sum of daily usages multiplied by 12 and divided by 365.[11] Catalog: Portal monthly usage is daily unique units x 12 / 365. See Check Point support and enterprise agreements.

Audits and compliance

Compliance for workspace services is measured by the services themselves. The Cloud Terms allow Check Point to measure consumption with technical tools. Use beyond the Permitted Scope may be charged at list price for the extra subscription licences, or lead to limitation, suspension or termination.[10] Endpoint Security also enforces seat limits in its console. When seats are exceeded or a licence expires, it escalates from email notifications to top banners and pop-ups, then makes the Policy menu read-only, and finally disables new installations.[2] Catalog: Endpoint licence violations escalate to blocking policy changes and installs; Excess cloud usage is charged at list price. The Portal’s usage page shows a contract quantity threshold that Check Point says it does not currently enforce.[11] See license compliance.

Out of scope

  • Prices and current SKU part numbers, which Check Point publishes only in its login-protected product catalogue.
  • Workspace XDR, Events & AIOps, External Risk Management and AI security products, which are listed in the Cloud Terms service table but not analysed here.
  • Consumer products.

References

  1. Endpoint Security Licenses (R81.20 Endpoint Security Administration Guide)Page dated 24 April 2026. Catalog: Endpoint Security Licenses (R81.20 Endpoint Security Administration Guide)Effective 2026-04-24. Retrieved 2026-10-02.
  2. Check Point Endpoint Security Administration GuideCover dated 01 October 2026. Catalog: Check Point Endpoint Security Administration GuideEffective 2026-10-01. Retrieved 2026-10-02.
  3. Harmony Endpoint PackagesCopyright 2024. Catalog: Harmony Endpoint PackagesRetrieved 2026-10-02.
  4. Licensing the Email Security ProductPage dated 17 September 2026. Catalog: Licensing the Email Security ProductEffective 2026-09-17. Retrieved 2026-10-02.
  5. Managing Email Security LicensesPage dated 17 September 2026. Catalog: Managing Email Security LicensesEffective 2026-09-17. Retrieved 2026-10-02.
  6. Minimum License Requirements to Activate SaaS ApplicationsEmail Security Administration Guide; page dated 17 September 2026.Effective 2026-09-17. Retrieved 2026-10-02.
  7. Licensing the Product (SASE Administration Guide)Page dated 01 October 2026. Catalog: Licensing the Product (SASE Administration Guide)Effective 2026-10-01. Retrieved 2026-10-02.
  8. Modifying Member Licenses (SASE Administration Guide)Page dated 01 October 2026. Catalog: Modifying Member Licenses (SASE Administration Guide)Effective 2026-10-01. Retrieved 2026-10-02.
  9. Modifying Gateway / Application Licenses (SASE Administration Guide)Page dated 01 October 2026. Catalog: Modifying Gateway / Application Licenses (SASE Administration Guide)Effective 2026-10-01. Retrieved 2026-10-02.
  10. Terms of Service - Cloud Services; Infinity PortalCloud End-user License Agreement. Catalog: Terms of Service - Cloud Services; Infinity PortalRetrieved 2026-10-02.
  11. Usage (Check Point Portal Administration Guide)Page dated 03 September 2026. Catalog: Usage (Check Point Portal Administration Guide)Effective 2026-09-03. Retrieved 2026-10-02.
  12. Licensing SaaS SecurityPage dated 22 June 2026. Catalog: Licensing SaaS SecurityEffective 2026-06-22. Retrieved 2026-10-02.
  13. Licensing the Product (Mobile Security Administration Guide)Page dated 01 October 2026. Catalog: Licensing the Product (Mobile Security Administration Guide)Effective 2026-10-01. Retrieved 2026-10-02.
  14. Managing Licenses (Browse Security Administration Guide)Page dated 23 April 2026.Effective 2026-04-23. Retrieved 2026-10-02.

See also

Catalog Rows Cited

10SKUs5Metrics9Rules

Esc