Falcon Complete is CrowdStrike’s managed detection and response (MDR) service. CrowdStrike’s analysts operate Falcon modules on the customer’s behalf and carry out investigation, containment and remediation.[2] The Terms and Conditions treat the Falcon Complete Team as a Product-Related Service, sold with Products and distinct from Professional Services.[7] Falcon Complete Next-Gen MDR is sold by quote.[1] Subscriptions carry the Falcon Complete Limited Warranty, a ransomware response warranty with a per-endpoint payment and a capped total.[3] CrowdStrike also lets managed service providers use its products for their own clients under the Partner Program Agreement. That agreement distinguishes MSP Partners, which operate a customer’s own licensed instance, from CrowdStrike Powered Service Providers, which own the licences and bundle them into their services.[5]
Editions
Falcon Complete. The service provides managed protection across several domains: endpoints (Falcon Insight XDR, Falcon Prevent and Falcon Discover), identity (Falcon Identity Threat Protection), cloud workloads (Falcon Cloud Security), SaaS (Falcon Shield), AI agents (Falcon Guardian) and third-party data through Falcon Next-Gen SIEM.[2] The pricing page positions Falcon Complete Next-Gen MDR as “Fully Managed Protection”, with add-on modules such as Next-Gen Identity Security and Next-Gen SIEM.[1] Express Support is available as an add-on.[1]
Falcon Complete for Service Providers. A version of the service that MSPs and MSSPs can white-label or co-brand. It manages Falcon Prevent, Falcon Insight XDR and Falcon Discover, with Identity Threat Protection, Next-Gen SIEM, Cloud Security, Falcon Guardian and Falcon Shield as add-ons.[6]
| Partner designation | Catalog row | Who holds the licence | What the partner may do |
|---|---|---|---|
| Reseller or distributor | (Partner Program Agreement §4) | Customer, under the End User Agreement[5] | Resell Offerings; the customer’s use is governed by the End User Agreement[5] |
| MSP Partner, Managed Service Provider Partner, Managed and Monitored MSP | MSP Partner | Customer | Access and use the Requesting Customer’s instance on its behalf[5] |
| CrowdStrike Powered Service Provider (CPSP), formerly Packaged MSP or Managed Security Service Partner | CrowdStrike Powered Service Provider | Partner | Use Eligible Products as part of its Packaged Product for each CPSP Customer[5] |
Metrics
Falcon Complete and partner licences use the same Endpoint metric as the rest of the platform. An Endpoint is any physical or virtual device, including containers and virtual machine images.[7] The warranty defines its own term, Covered Endpoint: any Endpoint operating in a Protected Environment with a paid subscription to the Required Products.[3] The Identity Threat Protection add-on is licensed per active identity (see CrowdStrike Next-Gen SIEM, identity and cloud security licensing).
Counting / floors
Falcon Complete Limited Warranty
Amount and caps (version effective 2026-01-08). The warranty is available to each Customer with active, paid subscriptions to either EDR only, or EDR with Identity Threat Protection, managed by Falcon Complete (a Falcon Complete SKU).[3] Payments are $2,000 per Covered Endpoint impacted by an Incident. Total payments in a Warranty Period are capped at $1,000,000 for EDR only and $2,000,000 for EDR and ITP.[3] The warranty’s own example is two impacted Covered Endpoints under EDR only, which yields $4,000.[3] The FAQ describes the same calculation: $2,000 per impacted covered endpoint, up to the tier’s maximum.[4] Catalog proof: Falcon Complete Warranty: $2,000 per Covered Endpoint, $1M or $2M cap.
Inclusion. Coverage is extended automatically to all Covered Customers as a feature of Falcon Complete, unless the customer declines by email.[3] The warranty cannot be bought separately from an active Falcon Complete subscription, and its terms are standardized and cannot be negotiated.[4] A separately executed Limited Warranty Agreement for Falcon Complete stands alone and is not superseded by the Terms and Conditions.[7] Catalog proof: Warranty included with Falcon Complete; not sold separately; not negotiable.
Eligibility. Covered Endpoints must stay in the Measured Security Posture or higher for the whole Warranty Period. Impacted Endpoints must run a Qualifying Version of the Falcon Sensor, meaning the most recent version or one of the two previous production versions. Internet-facing services and remote access points must be protected by multi-factor authentication.[3] Incidents must be reported within three days of the Attack Date, and a Reimbursement Request made within fifteen days of that notice.[3] The warranty is null and void in any jurisdiction where it would be deemed a contract of insurance.[3] Catalog proof: Warranty eligibility: Measured Security Posture, current sensor, MFA.
Term. The warranty runs for the Subscription Term of the Required Products. It ends if the subscription or the Customer Agreement terminates, and termination of the Customer Agreement terminates the warranty.[3] The Warranty Period also ends if the customer fails to maintain the Measured Security Posture.[3] Payments count towards any liability cap in the Customer Agreement.[3] Catalog proof: Warranty notice deadlines and term tied to the subscription.
Service provider quantities
CPSP quantities (as retrieved 2026-09-26). For a CrowdStrike Powered Service Provider, both the partner’s and the CPSP Customers’ access and use is limited to the quantity and other limits in the partner’s Order. Software Components may be installed up to the licensed quantities on CPSP Customers’ Endpoints, or on the partner’s devices where the partner hosts them.[5] The partner may not price or distribute Eligible Products on a stand-alone basis.[5] A Packaged Product is defined as a partner product or service bundled with an Eligible Product that has no separate price.[5] Catalog proof: CPSP licences: partner-owned, bundled only, limited to Order quantity.
Virtualization & partitioning
The partner terms add no virtualization rules. Endpoints on CPSP Customers’ systems, or on partner-hosted devices, are counted against the partner’s Order in the same way as direct customers count Endpoints. That includes virtual devices, containers and virtual machine images.[5][7] Catalog proof: Endpoint includes virtual machines, containers and VM images.
Cloud / BYOL
Not applicable. Falcon Complete and the partner-licensed products are CrowdStrike cloud services. CPSP use must be limited to each CPSP Customer’s own internal information security or log management purposes.[5]
Programs
MSP Partners and customer contractors
A customer can let a third party run its Falcon environment in two ways. Under the Terms and Conditions, a Customer Contractor (any party other than a CrowdStrike Competitor) may use a Product solely on the customer’s behalf for its Internal Use. The customer remains responsible for the contractor, and contractors may not be given the intelligence reports in the Products.[7] The Falcon Sensor terms give managed services providers, incident response consultants and franchisors as examples of such Third Party Providers.[8] Catalog proof: Customer Contractors may use Products for the Customer; no intelligence reports; Falcon Sensor terms: install up to the validly licensed quantity.
Under the Partner Program Agreement, a partner designated as an MSP Partner receives a revocable, limited, non-transferable licence to access the Requesting Customer’s instance, solely on that customer’s behalf. The licence lasts only while the customer remains a Joint Customer and the partner remains authorized.[5] Access can come through an approved integration, customer-issued API keys, unique login credentials or an Authorization Form.[5] A CPSP Customer is not a Joint Customer.[5] Catalog proof: MSP partners use the customer's own instance only while authorized.
CrowdStrike Powered Service Providers
A CPSP licenses Eligible Products in its own name for the Subscription/Order Term, in its Territory, as part of a Packaged Product for each CPSP Customer.[5] Each such customer must have a Beneficiary Agreement with the partner. That agreement must contain terms substantially similar to, and no less protective of CrowdStrike than, the CrowdStrike Terms and Conditions.[5] The partner carries all obligations to its customers, and CrowdStrike may suspend use for any customer without a Beneficiary Agreement.[5] Some products, such as Counter Adversary Operations (formerly Falcon Intelligence Premium) and LogScale, need additional terms before they can be packaged.[5]
Warranty for service providers. The Falcon Complete Warranty is available to Falcon Complete for Service Provider partners, up to $2 million.[6] The warranty defines an Eligible Partner as one with an active Master Partner Agreement, designated in writing as a Packaged Managed Service Provider authorized to offer the warranty to its MSP customers.[3] For reseller partners, the warranty is part of the standard Falcon Complete bundle.[4] Catalog proof: Falcon Complete warranty extends to Service Provider partners.
Partner audit and monitoring
Partners must keep adequate records of their performance under the Program Agreement. On reasonable notice and during business hours, CrowdStrike may inspect and audit the partner’s business records and the Offerings to verify compliance, including the accuracy of amounts paid. It may do so directly or through an independent third party.[5] The partner pays any underpayment with interest. If the underpayment exceeds 5%, the partner also reimburses the reasonable costs of the audit.[5] Partners also agree that CrowdStrike may monitor use of the Offerings, APIs and content to verify compliance with the Program Agreement.[5] Either party may end the Program Agreement without cause on 90 days’ written notice.[5] Catalog proof: CrowdStrike may audit partner records; costs shift above 5% underpayment. For the general practice, see software license audit.
Out of scope
- Falcon Complete prices and service-level terms, which are set by quote and Order.
- The Partner Program Guide, partner-type specific terms and incentive programs, which the Program Agreement references but which are published in the Partner Portal.
- Engagement Use (ELP) partner licences, under which approved customers of a partner run Eligible Products up to a quantity and duration approved by CrowdStrike (Partner Program Agreement §6.6).[5]
- Store, Marketplace and Technology Alliance partner terms.