LICENSEWARE
Contribute

FortiClient, FortiManager and FortiAnalyzer licensing

From the LICENSEWARE WikiLast edited 10 ReferencesCited

This article is about licensing the FortiClient endpoint agent with FortiClient EMS or FortiClient Cloud, and the FortiManager and FortiAnalyzer management and analytics products in hardware, VM and cloud form. For FortiGate security subscriptions see FortiGuard and FortiCare licensing.

On This Page

FortiClient, FortiManager and FortiAnalyzer licensing covers three Fortinet products that are licensed by different units: the FortiClient endpoint agent per managed endpoint, FortiManager central management per managed device or virtual domain, and FortiAnalyzer logging and analytics per gigabyte of logs per day or per logging device.[1][2][3] Each is sold as on-premises software, as a virtual machine or appliance, and as a Fortinet-hosted cloud service, and each can also be consumed through FortiFlex.[4][2][3][5] The products are licensed under the Fortinet EULA, which subjects use to the licence metrics in Fortinet Documentation, and their subscriptions and support are Service Contracts under the Fortinet Service Terms.[6][7]

Editions

FortiClient

The FortiClient ordering guide (29 April 2026) describes a device-based licensing model with three solution tiers, VPN/ZTNA, EPP/ATP and Managed, each sold for FortiClient Cloud (Fortinet-hosted EMS) and, except Managed, for on-premises EMS.[4] The EMS administration guide describes the feature split between the two main licences, and the ordering guide lists the Managed tier’s services:[1][4]

Tier Main capabilities Cloud SKU (500-pack) On-premise SKU (25-pack) 
VPN/ZTNA Fabric Agent telemetry, ZTNA posture tagging, IPsec and SSL VPN, vulnerability scan, web filter, sandbox integration (appliance only) FC2-10-EMS05-428-01-DD FC1-10-EMS04-428-01-DD 
EPP/ATP All ZTNA features plus antivirus, anti-ransomware, anti-exploit, cloud-based malware detection, application firewall, software inventory, USB device control, outbreak detection and FortiClient Cloud Sandbox FC2-10-EMS05-429-01-DD FC1-10-EMS04-429-01-DD 
Managed Managed FortiClient service delivered by Fortinet experts: endpoint onboarding, initial provisioning, Security Fabric integration, vulnerability and endpoint security monitoring FC2-10-EMS05-485-01-DD Not offered 

The EMS administration guide names the licences EPP, ZTNA, FortiSASE and the FortiGuard Endpoint Forensics Analysis add-on, and a separate licence covers Chromebook management.[1][8] FortiClient Standalone, an unmanaged VPN client without EMS, is licensed per user with a minimum order of 50 through FC1-10-FCTST-1284-02-DD, or with a minimum of five through FortiCloud Marketplace using FortiPoints.[4]

FortiManager

FortiManager is sold as hardware (200G to 3750G), as a VM subscription bundle with FortiCare Premium, as a VM perpetual licence with support bought separately, and as FortiManager Cloud.[2] The VM subscription (FC1/FC2/FC3-10-FMGVS-258-01-DD for 10, 100 or 1,000 devices) is fully stackable; the VM perpetual upgrade licences are FMG-VM-10-UG, -100-UG, -1000-UG and -5000-UG; and FortiManager Cloud multi-device subscriptions cover 3, 10, 100 or 1,000 devices/VDOMs.[2] Fortinet states that it has no current plans to end-of-life the perpetual VM SKU.[2]

FortiAnalyzer

FortiAnalyzer supports capital and operating expenditure models: perpetual licences for on-premises deployments and subscriptions for cloud and hosted environments.[3] The editions are hardware bundles, a VM subscription bundle including FortiCare Premium, IOC, outbreak detection and security automation services (FC1-10-AZVMS-465-01-DD for 5 GB/day, FC2 for 50 and FC3 for 500), VM perpetual licences from FAZ-VM-GB1 to FAZ-VM-GB2000 (for example FAZ-VM-GB5) with services a la carte, and FortiAnalyzer Cloud, licensed per device or by GB/day subscription.[3]

Metrics

Counting / floors

FortiClient

A licence must be bought for each registered endpoint. Each ZTNA licence manages one Windows, macOS, Linux, iOS, Android or Chromebook endpoint; the minimum purchase is 25 endpoint licences and the maximum term five years (rule).[1] The ordering guide sells packs of 25, 500, 2,000 and 10,000 devices; a 550-endpoint estate, for example, is bought as one 500-pack plus two 25-packs.[4]

EPP and ZTNA licences can be held in different quantities, and EMS applies licences according to the features enabled in each endpoint’s assigned profile (rule).[1] Fortinet nevertheless advises customers to use a single licence type and avoid mixing licences with different expiry dates.[4] Commentary: the profile, not the installed agent, therefore determines whether an endpoint consumes an EPP or a ZTNA licence, so a profile change can move endpoints between pools.

Direct upgrades between on-premise (EMS04) and cloud (EMS05) SKUs are not supported, and legacy EMS01/EMS03 SKUs cannot be upgraded to the current ones and must be replaced at renewal (rule).[4] FortiClient licences do not include FortiToken for multi-factor authentication, which is bought separately.[4] Additions, renewals and upgrades use the co-term tool, which aligns all contracts to one expiry date.[4]

When an EMS licence expires, there are ten days to renew. After that, EMS enters unlicensed mode: administrator permissions become read-only except licence management, and new endpoints cannot register, although existing endpoints stay registered (rule).[8] An EMS licence must be activated before EMS can manage any endpoints; logging in to FortiCloud is the primary licensing method, and FortiCloud does not provide licence files for EMS 8.0.[9]

FortiManager

The FortiManager ordering guide sets out which devices consume a licence (rule):[2]

Counted Not counted 
FortiGate with VDOMs disabled: 1 licence Global VDOM 
FortiGate with VDOMs enabled: 1 licence per VDOM (root alone counts as 1) Secondary FortiGate of an HA pair 
Unregistered device in the root ADOM: 1 licence Hidden devices 
FortiAnalyzer managed by FortiManager: 1 device, plus its synchronised devices FortiAP, FortiSwitch and FortiExtender 
On hardware: FortiGates with FortiManager Cloud entitlements On VMs: FortiGates with FortiManager Cloud entitlements 

The FortiManager VM subscription includes five ADOMs.[2] Perpetual VM device add-ons also grant a logging allowance; FMG-VM-100-UG, for example, allows a total of 5 GB/day of logs.[2] On FortiManager 3000 Series hardware and above, devices are added in increments of 100 up to 100,000 with FMG-DEV-100-UG.[2]

When devices are added to a perpetual VM, the new device licences are bought as net-new SKUs, but the FortiCare tier covering the new total must be bought through a co-term agreement; subscription add-ons are also bought via co-term (rule).[2] In Fortinet’s example, adding 20 devices to a 100-device VM means two FMG-VM-10-UG licences plus a FortiCare contract for 1 to 310 devices.[2] High availability requires two FortiManagers of the same series and firmware.[2]

FortiAnalyzer

FortiAnalyzer VM perpetual licences are stackable GB/day licences (“Only GB/Day is stackable”); support and services are bought per tier band covering the total (1-6, 1-11, 1-26, 1-101, 1-501, 1-2001 GB/day and unlimited).[3] For every licence type, the add-on service tier must match the GB/day ingestion licensed, so a 5 GB/day licence needs a 5 GB/day service tier (rule).[3] In Fortinet’s example, a 10 GB/day deployment with security automation and Elite support buys two FAZ-VM-GB5 licences and the 1-11 GB/day tiers of both services.[3]

From FortiAnalyzer 7.6.7 the VM S-series no longer needs a separate ADOM subscription; the number of ADOMs follows licensed daily ingestion, from 10 ADOMs up to 5 GB/day to 1,200 above 5,000 GB/day.[3] ADOM add-ons for hardware are available on G-series 3000 models and above.[3]

FortiAnalyzer Cloud has two models (rule):[3]

  • Per-device subscription: each FortiGate or FortiWeb logging to FortiAnalyzer Cloud needs its own -585 subscription, which includes a default ingestion volume (for example 200 MB/day for a FortiGate-70G) and default retention of three months for analytics and twelve months for archive. Each FortiGate in an HA pair needs its own subscription.
  • GB/day subscription: shared capacity in 5, 50 or 500 GB/day tiers, pooled across all devices in the same FortiCloud account. It is required for FortiClient, FortiEndpoint, FortiMail, FortiNDR and third-party logs, and it absorbs FortiGate or FortiWeb volume above the per-device entitlement.

If ingestion exceeds the licensed capacity, logs may be throttled or dropped.[3]

Trials

The FortiClient EMS free trial manages three endpoints and three Chromebooks indefinitely, consumes one licence count per managed endpoint, must not be used in production, carries no support, and is limited to one per customer (rule).[10] The FortiManager-VM trial covers three devices/VDOMs and three ADOMs, and the FortiAnalyzer-VM trial 1 GB/day, three devices and three ADOMs; neither includes services or support, only one trial per product per account can be active at a time, and applying a purchased licence converts the trial into a production instance (rule).[2][3]

Virtualization & partitioning

The FortiManager and FortiAnalyzer ordering guides list VM platforms in private clouds (VMware, Citrix Xen, KVM, Microsoft Hyper-V, Nutanix AHV, Oracle Private Cloud, open-source Xen) and public clouds (Amazon AWS, Microsoft Azure, Google Cloud, Oracle OCI).[2][3] Neither is licensed by host processor: the VM metric is managed devices or GB/day, whatever the underlying hardware. ADOMs partition both products into separately administered tenants and are licensed as described above.[2][3] FortiClient EMS can be installed on a Linux server (7.4) or on a Windows Server (7.2 and earlier), on premises or in a public cloud.[4]

Cloud / BYOL

FortiClient Cloud is a Fortinet-hosted EMS instance that can manage up to 250,000 endpoints and does not require a FortiCloud Premium subscription.[4] FortiManager Cloud is sold by multi-device subscription including FortiCare Premium; the earlier per-FortiGate FortiManager Cloud SKUs are end of order, and a FortiManager Cloud instance’s data stays in the region where it was provisioned.[2] FortiAnalyzer Cloud is licensed as described above. FortiPoints can be used to renew or upgrade FortiAnalyzer VM and FortiAnalyzer Cloud SKUs.[3]

Programs

  • FortiFlex Enterprise and FortiFlex MSSP offer FortiClient EMS (25 to 85,000 endpoints), FortiManager-VM (1 to 100,000 devices), FortiAnalyzer-VM (5 to 8,300 GB) and FortiManager Cloud entitlements in points.[5] See FortiFlex and FortiPoints.
  • Co-term is used for FortiClient renewals and upgrades and for FortiManager and FortiAnalyzer support on added capacity.[4][2]
  • FortiCare Support Services apply to all three products; FortiCare Best Practices consultation for FortiClient is sold in endpoint bands (25-999, 1,000-9,999 and 10,000 or more endpoints).[4]

Out of scope

This article does not cover FortiEndpoint, FortiEDR, FortiSASE agent licences beyond their mention in EMS, FortiToken, FortiGuard Endpoint Forensics service terms, FortiAnalyzer and FortiManager hardware specifications, or FortiAI token top-ups.

References

  1. FortiClient EMS 8.0.0 Administration Guide: Windows, macOS, and Linux licensesPage not date-stamped. Catalog: FortiClient EMS 8.0.0 Administration Guide: Windows, macOS, and Linux licensesRetrieved 2026-09-30.
  2. Ordering Guide: FortiManagerDocument code FMG-OG-R29-20260626. Catalog: Ordering Guide: FortiManagerEffective 2026-06-26. Retrieved 2026-09-30.
  3. Ordering Guide: FortiAnalyzerDocument code FAZ-OG-R25-20260716. Catalog: Ordering Guide: FortiAnalyzerEffective 2026-07-16. Retrieved 2026-09-30.
  4. Ordering Guide: FortiClientDocument code FC-OG-R27-20260429. Catalog: Ordering Guide: FortiClientEffective 2026-04-29. Retrieved 2026-09-30.
  5. FortiFlex 26.3.1 Administration Guide: Service offeringsCatalog: FortiFlex 26.3.1 Administration Guide: Service offeringsEffective 2026-09-25. Retrieved 2026-09-30.
  6. Fortinet Product License Agreement / EULA and Warranty TermsDocument code September 2026 EULA. Catalog: Fortinet Product License Agreement / EULA and Warranty TermsEffective 2026-09-01. Retrieved 2026-09-30.
  7. Fortinet Service Terms & Conditions (FortiCare, FortiGuard and other Fortinet Service Offerings)Document code 875110-3.10. Catalog: Fortinet Service Terms & Conditions (FortiCare, FortiGuard and other Fortinet Service Offerings)Effective 2026-09-01. Retrieved 2026-09-30.
  8. FortiClient EMS 8.0.0 Administration Guide: License statusPage not date-stamped. Catalog: FortiClient EMS 8.0.0 Administration Guide: License statusRetrieved 2026-09-30.
  9. FortiClient EMS 8.0.0 Administration Guide: Licensing FortiClientPage not date-stamped. Catalog: FortiClient EMS 8.0.0 Administration Guide: Licensing FortiClientRetrieved 2026-09-30.
  10. FortiClient EMS 8.0.0 Administration Guide: Free trial licensePage not date-stamped. Catalog: FortiClient EMS 8.0.0 Administration Guide: Free trial licenseRetrieved 2026-09-30.

See also

Catalog Rows Cited

8SKUs5Metrics10Rules4Programs

Esc