Delinea Privilege Manager and Server PAM licensing covers Delinea’s products for least privilege on endpoints and servers. Privilege Manager removes local administrator rights and controls applications on workstations and servers. It is available on-premises or as a cloud service, and Delinea’s product page positions it for workstations alongside Cloud Suite for servers.[8][1] Server PAM brings privileged access control to Windows, Linux and UNIX servers in three forms:
- Privilege Control for Servers, part of the Delinea Platform;
- Cloud Suite, “a standalone SaaS solution”; and
- Server Suite, “a standalone on-premise solution” that manages policy from Active Directory.[4]
All of them are licensed under the Delinea Master Subscription and License Agreement (MSLA) as SaaS Subscriptions or term Licensed Software.[5] Catalog proof: Server PAM is offered as Cloud Suite or Server Suite.
Both product families are counted per machine. Privilege Manager counts managed endpoints, and Server Suite counts computers. Each product sets its own rules for which machines count.
Editions
| Product | Licence types | Deployment |
|---|---|---|
| Privilege Manager Client | Workstation endpoints (Windows, macOS) | On-premises or cloud |
| Privilege Manager Server | Server endpoints (Windows Server) | On-premises or cloud |
| Server Suite | UNIX or Windows workstation and server licences for authentication and privilege elevation; UNIX or Windows audit and monitoring licences | On-premises |
| Cloud Suite | Not published in the reviewed documents | SaaS |
| Privilege Control for Servers | Not published in the reviewed documents | Delinea Platform |
Sources: Privilege Manager Licensing, How Delinea Licenses are Managed, Server PAM product page.[1][2][4] A Platform Agent for Privilege Control for Servers is “currently available only to customers participating in a Private Preview”.[6]
Metrics
Privilege Manager Client license. “This license provides coverage for endpoints that are workstations, such as Windows 10, windows 7, or macOS endpoints, etc.”[1]
Privilege Manager Server license. “This license provides coverage for endpoints that are server machines, Windows Server 2019, Windows 2016, etc.” A separate support licence is needed to “complete upgrades” and to receive support and maintenance.[1] Catalog proof: Privilege Manager licenses workstations and servers separately.
Server Suite workstation license and server license. Server Suite licensing “is based on the number of servers and workstations you authorize for authentication and privilege elevation, and for audit and monitoring service”. Workstation licences are “intended for computers that are used interactively by one or two concurrent users but that do not host applications accessed by multiple users”. Server licences are for computers “accessed by multiple concurrent users” that typically host an application. There are separate UNIX and Windows versions of each.[2] Catalog proof: Server Suite workstation licences are for one or two concurrent users.
Server Suite audit and monitoring service license. These are “issued for each computer that will be connected to an audit and monitoring service collector”, separately for UNIX and Windows. They are bought and installed separately from authentication and privilege elevation licences.[2] A server that is both controlled and audited therefore needs one licence of each kind. Catalog proof: Server Suite licenses access control and auditing separately.
Counting / floors
Privilege Manager Cloud. Licensing is managed by Delinea, and “Only machines that have registered in the past 30 days consume a license.” When usage exceeds the licensed amount, a message is shown but functionality is not affected. “At renewal, your license will be trued up to reflect actual usage.”[1] Cloud overage therefore surfaces as a higher renewal quantity rather than an outage. Catalog proof: Privilege Manager Cloud counts machines registered in the last 30 days; Privilege Manager Cloud overage is trued up at renewal.
Privilege Manager on-premises. Licences are entered as license names and keys, or as a licence certificate. Online activation is not required. Where Secret Server runs on the same server, licences installed in Secret Server are imported into Privilege Manager.[1] If licences expire or the count is exceeded, the server “will stop processing new inventory and application control events on all installed agents”. Endpoints keep enforcing policies, but new endpoints are not recorded, inventories are not collected and automation stops. The violation affects all agents until unused agents are deleted or more licences are bought.[1] Catalog proof: Exceeded on-premises Privilege Manager licences stop data processing.
Server Suite: which computers count. The License Management Administrator Guide defines “counted” computers for licensing reports.[3]
| Computer state | Authentication and privilege elevation licence | Audit and monitoring licence |
|---|---|---|
| Zoned or Auto Zone, active | Counted | Counted if active |
| Express or Zoneless agent | Not counted | Not applicable |
| Joined to the null zone | Not counted | Counted |
| Orphaned (AD computer object removed) | Not counted | Counted |
| Inactive (no use in the 45 days before the report) | Not counted | Not counted |
| Duplicated audit agent after migration | Not applicable | Counted once |
| Never joined the domain | Not counted | Not counted |
Activity is measured by the LastLogonTimestamp attribute for access licences and by the last contact with a collector for audit licences.[3] Catalog proof: Server Suite computers inactive for 45 days are not counted; Null-zone computers are excluded from access licences but not audit licences; Express and Zoneless agents are not counted for authentication licences.
License keys and warnings. Each Server Suite licence has a 24-character key that sets the licence type, the number of computers and any time limit. Capacity is the sum of all installed keys, so three keys for 100 UNIX workstations each give 300 workstation licences.[2] If licensed computers exceed purchased licences, the consoles show a message with usage details.[2] The Licensing Service emails warnings at default thresholds of 90%, 100% and 120% of usage. The Licensing Report wizard produces a CSV report that customers can use themselves or send to Delinea Support.[3] Some Server Suite components keep Centrify names, for example the “Centrify_Licensing_Service” installer.[3]
Virtualization & partitioning
Both products count each managed machine, physical or virtual. Two MSLA terms matter for virtual and jump-host designs:
- Licensed Software may not be deployed “in a virtual or gateway-based (i.e., jump box) architecture” unless every audited computer or device, “whether physical or virtual”, is licensed, plus a separate licence for the gateway.[5]
- Per-system licences may move like for like: “Licensed Software deployed on a Customer-managed server may be moved to another Customer-managed server”, and a workstation licence to another workstation.[5]
Catalog proof: Gateway or jump box deployments must license all audited devices; Per-system licences may move like for like. See virtualization and partitioning.
Cloud / BYOL
Privilege Manager Cloud and Cloud Suite are SaaS Subscriptions, and Privilege Manager on-premises and Server Suite are Licensed Software. Each falls under its own MSLA section.[5] The cloud counting rules (30-day registration, true-up at renewal) are different from the on-premises rules (hard licence count with processing stopped on overage).[1]
Programs
- Privilege Manager trial license. “Normal trial licenses offer 50 endpoint agents and expire 30 days after issue.” Production keys must then be installed.[1] Catalog proof: Privilege Manager trials cover 50 endpoints for 30 days.
- Server Suite evaluation keys. These allow unlimited computers for a time set in the key, and the licence count shows zero. They must be replaced by permanent keys.[2]
- Lifecycle. Each Server Suite release in a calendar year is supported for 36 months, and each Privilege Manager release for 12 months. After that, support requires a custom Sustaining Support agreement.[7] Catalog proof: Server Suite minor releases are supported 36 months.
Audits and compliance
Endpoint and server counts are the usage that the MSLA’s reporting and audit clauses verify. Customers report usage twice a year, and Delinea may audit usage records for the term and two years after.[5] The Server Suite licensing report and the Privilege Manager licence pages provide the vendor-side counts. Removing inactive, orphaned and decommissioned machines before a reporting date keeps the reported numbers accurate. See Delinea MSLA, usage reporting and renewals and true-up.
Out of scope
- Licence units for Cloud Suite and Privilege Control for Servers, which were not published in the reviewed documents.
- Prices and part numbers.