Delinea Secret Server and Platform licensing covers Delinea’s privileged credential vault, Secret Server, and the Delinea Platform that hosts it in the cloud. It also covers two related products: Privileged Remote Access (PRA), for brokered remote sessions, and Connection Manager, a desktop client for RDP and SSH sessions. Secret Server can be run on-premises as Licensed Software or used as a cloud service. The two deployments use different licence vocabularies. On-premises Secret Server counts users in editions. The Delinea Platform counts named users by licence type, IT User or Business User.[1][3] Both are governed by the Delinea Master Subscription and License Agreement (MSLA).[9]
Editions
Secret Server On-Premises. Delinea documents three editions.
| Vault | Professional | Platinum | |
|---|---|---|---|
| Deployment | On-premises for current customers; cloud for new customers | On-premises | On-premises |
| Secrets | No limits | No limits | No limits |
| Users | 25 users | Licensed by user | Licensed by user |
| Automatic password changing, heartbeat, SDK and API | Not included | Included | Included |
| Approval workflow, discovery rules, SSH key management, service account governance | Not included | Add-on | Included |
| Connection Manager | Not included | Add-on | Add-on |
Source: Secret Server On-Premises Features by Version.[2] The same table lists keystroke logging and session recording for Professional with a “50-Secret Limit”. The licensing topic describes the model as scaling through “edition enhancements (Professional, Premium Edition) and user packs”.[1] Catalog proof: Secret Server Vault includes 25 users; Professional and Platinum are per user.
Delinea Platform. “The Delinea Platform has two license types: Business User and IT User.” Delinea stresses that these “are not user classifications but rather license types”.[3] Catalog proof: IT User and Business User are licence types.
| Capability | Business User | IT User |
|---|---|---|
| Create, view, edit, share and launch secrets; request access to others’ secrets | Yes | Yes |
| Credential Manager and web templates | Non-IT resources only | Yes |
| View user audit logs; administer folders, discovery, engines, workflows | No | Yes |
| Configure password rotation and secret security | No | Yes |
| Launchers (including RAS), Connection Manager for RDP or SSH | No | Yes |
| Secret Server SDK or API | No | Yes |
Source: Platform License Types.[3]
Metrics
Secret Server user licence. “Secret Server ships with one free license for a single user.” Additional user licences are bought from Delinea. Entering licences through the Getting Started Wizard or the Licenses page allows more users and turns on edition features.[1] Under the MSLA, users of usage-based Solutions “may be human or non-human”.[9] Catalog proof: Secret Server includes one free user; SaaS grant covers subscribed systems, sessions, users, agents, hosts or secrets.
Secret Server support licence. Support licences give technical assistance and software updates, and “the number of support licenses and user licenses must match” for update eligibility.[1] Catalog proof: Secret Server support licences must match user licences.
IT User and Business User. These are named-user licences on the Delinea Platform, with the capabilities listed above.[3]
PRA concurrent user license. PRA “is a paid feature and entitles tenants to the number units of concurrent user licenses purchased”. A licence is consumed “by one user when they start their first remote connection”.[6]
Counting / floors
Membership type drives IT User consumption. Platform users have a Membership Type. Employee is the default, and Vendor covers external users such as contractors, consultants and partners. “The Vendor membership type exists so these users receive limited Vendor User capabilities and do not consume an IT User license.”[4] The reverse is the trap for licence managers. A user left at Employee “consumes one IT User (named-user) license—even if they only ever use Vendor-level capabilities”. “Consumption follows the membership type, not the roles or RBAC permissions you assign.”[5] Contractors onboarded without changing their membership type are therefore counted as IT Users. Catalog proof: Vendor membership does not consume an IT User license; Employee membership consumes an IT User license.
Service users. The Platform separates human users from “Service users”, meaning non-human, programmatic access through APIs and service accounts.[4] The reviewed documentation does not say whether service users consume IT User licences. The MSLA allows usage-based units to count non-human users, so the Ordering Document is the place to check.[9]
PRA sessions. “Each user is entitled to a maximum of 4 concurrent remote sessions.” The licence stays in use until the user’s last session ends and is then released for others. Each PRA licence also grants limited Vendor User capabilities in Secret Server, so “no additional Secret Server licenses are needed to exercise these capabilities”. PRA licences are consumed the same way whether the user has Vendor User or IT User entitlements.[6] Catalog proof: PRA user may run up to four sessions on one licence; PRA licences include Vendor User rights in Secret Server.
User substitution. For Licensed Software bought “on a per-usage basis”, a customer that ends one user’s access “may provide access to another Customer user”.[9] Catalog proof: Per-usage licences allow user substitution.
Monitoring consumption. The Platform’s Marketplace Subscriptions page lists “Consumed Licenses” and “Allocated Licenses” for each subscription, with start and end dates and trial or purchased status. This helps customers “Monitor license usage to ensure you stay within purchased capacity”.[8] Secret Server cloud customers can list active subscriptions under Licenses. On-premises customers find the purchased version on their executed order form.[10] Catalog proof: Platform subscriptions page shows consumed and allocated licences.
Activation and limited mode
On-premises licences must be activated. “If you fail to activate your licenses, your system is placed in limited mode”. Limited mode blocks Active Directory synchronisation, creating, editing and importing secrets, and web services for mobile applications.[1] Catalog proof: Unactivated Secret Server licences trigger limited mode.
Connection Manager. Connection Manager can connect to any Secret Server instance “licensed with the Connection Manager Add-on license for Secret Server”. A Platinum trial key added to a production instance runs alongside the existing licence and gives Platinum features until it expires. The instance then reverts to its existing licence.[7] Catalog proof: Connection Manager needs the add-on licence on Secret Server.
Virtualization & partitioning
Secret Server and the Platform count users, not the servers that host the vault. The MSLA does restrict gateway designs. Licensed Software may not be deployed “in a virtual or gateway-based (i.e., jump box) architecture” unless every computer or device audited through the gateway is licensed, plus the gateway itself.[9] Catalog proof: Gateway or jump box deployments must license all audited devices.
Cloud / BYOL
On-premises Secret Server falls under the MSLA Software Licenses section, and the cloud-hosted versions fall under the SaaS Subscriptions section. Each has its own grant, and there is no stated right to move licences between them.[9] For new customers, the Vault edition is offered in the cloud.[2] A SaaS Subscription includes standard support and updates. On-premises Licensed Software requires standard support to be bought for the Initial Term.[9]
Programs
- Evaluation Use. 30 days unless another period is stated. Evaluation versions may include automatic disabling mechanisms.[9]
- Standard, Premium and Premium Plus Support. Under the Support Policy, Secret Server and Connection Manager releases are each supported for 12 months.[11]
Out of scope
- Secret Server Cloud subscription capacities, which appear in each customer’s subscription rather than in public documents.
- Prices and part numbers.