Delinea licensing is the set of terms under which Delinea sells privileged access management and identity security software. The products covered here are Secret Server, a vault for privileged credentials; the Delinea Platform and its Privileged Remote Access (PRA) feature; Privilege Manager, for endpoint least privilege and application control; and Server PAM, delivered as Privilege Control for Servers, Cloud Suite or Server Suite.[10][1] One contract covers all of them: the Master Subscription and License Agreement (MSLA), made with Delinea Inc., a Delaware corporation, and last updated on 2026-05-01. It governs every “Solution” and every purchase of Support Services and Professional Services.[1]
The MSLA distinguishes two delivery models. SaaS Subscriptions give access to Delinea’s cloud-hosted versions (“Cloud Services”), including upgrades and support during the subscription. Licensed Software is downloaded, installed and managed by the customer “for use in its internal business operations for a specified term”.[1] There is no perpetual licence in the current MSLA. On-premises software is licensed for an Initial Term of one, two or three years, or for a purchased number of Compute Hours, and renews like a subscription.[1] Catalog proof: Licensed Software is a term licence; Initial terms of one, two or three years.
The MSLA takes effect on the customer’s “first download, installation, access, or use of a Solution”. If a company has a separately executed agreement with Delinea, that agreement applies instead, and the MSLA covers only what it leaves out.[1] Catalog proof: Separately executed agreement replaces the MSLA.
Editions
| Product | Delivery | Licence unit | Deeper article |
|---|---|---|---|
| Secret Server Vault, Professional, Platinum | On-premises term licence; Vault on cloud for new customers | Vault includes 25 users; Professional and Platinum “Licensed by User”[4] | Secret Server and Delinea Platform licensing |
| Delinea Platform | SaaS | IT User and Business User licence types[5] | same |
| Privileged Remote Access | SaaS feature of the Platform | Concurrent users[7] | same |
| Privilege Manager | On-premises or cloud | Client licence per workstation; Server licence per server[8] | Privilege Manager and Server PAM licensing |
| Server PAM: Server Suite | On-premises | Workstation, server and audit licences per computer[9] | same |
| Server PAM: Cloud Suite, Privilege Control for Servers | SaaS | Not published in the reviewed documents | same |
Delinea publishes no price list. The MSLA refers to the prices in Ordering Documents or, where none are stated, to “Delinea’s authorized price lists”.[1]
Metrics
The MSLA lists the units that usage-based Solutions may use: “number and type of users, agents, API calls, hosts, or secrets as applicable to the specific Solution”. The SaaS grant also covers “concurrent and/or total sessions” and states that users “may be human or non-human”.[1] The product documentation gives the concrete units.
| Unit | Catalog row | Where it applies |
|---|---|---|
| User (on-premises) | Secret Server user licence, support licence | Secret Server Professional and Platinum |
| Named user by licence type | IT User, Business User | Delinea Platform |
| Concurrent user | PRA concurrent user license | Privileged Remote Access |
| Endpoint | Privilege Manager Client, Privilege Manager Server | Privilege Manager |
| Computer | Workstation, Server, Audit and monitoring | Server Suite |
| Usage units and hours | MSLA usage-based units, Compute Hours | SaaS and some Licensed Software |
Counting / floors
Membership type, not role, decides Platform consumption. Every Delinea Platform user left at the default Employee membership type consumes one IT User licence, “even if they only ever use Vendor-level capabilities”. Users set to the Vendor membership type do not. “Consumption follows the membership type, not the roles or RBAC permissions you assign.”[6] Catalog proof: Employee membership consumes an IT User license.
PRA concurrency. A PRA licence is consumed when a user starts the first remote connection. It covers up to four concurrent sessions and is released when the last session ends.[7] Catalog proof: PRA user may run up to four sessions on one licence.
Endpoint and computer windows. Privilege Manager Cloud counts only machines that registered in the past 30 days.[8] Server Suite counts only computers used within the 45 days before a licensing report.[12] It separates workstation licences, for computers used by “one or two concurrent users”, from server licences.[9] Catalog proof: Privilege Manager Cloud counts machines registered in the last 30 days; Server Suite computers inactive for 45 days are not counted.
Support parity. For on-premises Secret Server, “the number of support licenses and user licenses must match” for update eligibility. The MSLA requires any support renewal to “cover all Licensed Software for the full Term”.[3][1] Catalog proof: Secret Server support licences must match user licences; Support must cover all Licensed Software.
Virtualization & partitioning
Delinea counts identities, endpoints and computers, not processors. Physical and virtual machines are treated alike. The MSLA forbids deploying Licensed Software “in a virtual or gateway-based (i.e., jump box) architecture” unless every computer or device, “whether physical or virtual”, that is audited through the gateway is licensed, together with a separate licence for the gateway itself.[1] A jump server therefore does not reduce the count of audited hosts. Catalog proof: Gateway or jump box deployments must license all audited devices. See virtualization and partitioning.
Per-system Licensed Software may move like for like, server to server or workstation to workstation. Per-usage Licensed Software allows a departed user to be replaced by another.[1] Catalog proof: Per-system licences may move like for like; Per-usage licences allow user substitution.
Cloud / BYOL
Cloud and on-premises versions are licensed separately, under Section 4 (SaaS Subscriptions) and Section 5 (Software Licenses) of the MSLA. There is no stated right to apply on-premises licences to cloud use.[1] The Secret Server Vault edition is offered “On-Premises for current customers” and “Cloud for new customers”.[4] When a SaaS Subscription ends, the customer has 30 days to export its data.[1] The Delinea Platform’s Subscriptions page shows consumed and allocated licences for each subscription.[11] Catalog proof: Thirty days to export data after a SaaS subscription ends; Platform subscriptions page shows consumed and allocated licences.
Programs
- Usage reporting and verification. Usage reports are due twice a year, on May 31 and November 30, with an audit right; see Delinea MSLA, usage reporting and renewals.
- MSLA renewal terms. Automatic one-year renewals at then-current pricing unless notice is given 30 days before the term ends.[1]
- Evaluation Use and the Privilege Manager trial. Evaluations last 30 days by default; Privilege Manager trials cover 50 endpoints.[1][8]
- Support packages. Standard, Premium, Premium Plus and Sustaining Support.[2]
- Authorized Channel Partner purchases. The MSLA governs, but payment goes to the partner.[1]
Audits and compliance
Delinea relies first on product telemetry and customer reporting. Use of a usage-based Solution is consent to its usage tracking for billing, and renewal invoices “reflect Customer’s usage as tracked”.[1] Customers keep usage records during the MSLA and for two years afterwards, and report usage twice a year. Materially late reporting is billed at “then-current list pricing”.[1] Delinea may audit usage records on notice of no more than 30 days and invoice any under-reported usage. The MSLA states no percentage threshold that shifts audit costs to the customer.[1] Delinea may suspend a customer that misses usage reporting or “repeatedly or intentionally exceeds any concurrent or other session limits”.[1] Catalog proof: Usage must be reported twice a year; Delinea may audit usage records; Exceeding session limits or missing usage reports allows suspension. For the general process see software license audit and true-up.
Out of scope
- Prices and part numbers, which Delinea sets in quotes and authorized price lists.
- StrongDM and Fastpath products, which the Support Policy covers separately and which were not reviewed here.[2]
- Negotiated enterprise agreements, which replace the MSLA where they exist.