Huntress Managed EDR, Managed ITDR and Managed ISPM are the endpoint and identity products of the Huntress managed security platform. Each is sold with 24/7 SOC monitoring included, and each is priced per unit per month: per endpoint for EDR and per licensed identity for ITDR and ISPM.[1] The unit counts are not self-evident. For EDR the count is of active agents on a specific day; for ITDR the count depends on licences and account types in the customer’s identity provider tenant. This article sets out what the Huntress documents say about each count, and where a licence manager is left to interpret.
Managed EDR
Price and what it includes
The pricing page lists Managed EDR at an MSRP of USD 8.99 per endpoint per month, with example pricing of USD 7.99 for 100 endpoints, and lists 24/7 threat detection and response, fast active remediation, custom incident reporting, “free managed Antivirus” and SOC-managed EDR technology as included.[1] The listed prices exclude deployment, integration and the day-to-day portal management that partners can provide.[1]
Counting endpoints
The Huntress support documentation defines billable EDR sources as “any active Agents in organizations where EDR is enabled”.[4] For service providers, the timing of the count is specific:
- Agent counts can fluctuate through the month, but Huntress does not prorate invoices for agents that were installed or uninstalled mid-cycle, and “only bills for the number of agents on the last day of the billing cycle”.[2]
- Invoices are generated on UTC time, so the agent count may be collected earlier than the invoice date in other time zones.[2]
- The article suggests that a provider who does not wish to be billed in full for agents installed mid-month should wait until the next invoice is generated before installing new agents.[2]
- A service provider’s billing cycle starts on the day its 14-day free trial ends, and billing is monthly in arrears, so the first invoice covers the preceding month.[2]
For resellers, the reseller billing article states that if multiple accounts under one reseller dashboard belong to the same pricing tier, their agent counts are aggregated in that tier and shown as the total of all plans in the tier.[6] Annual billing accounts show as USD 0 in the reseller invoice view because they are paid up front, though the data remains useful for usage auditing.[6]
The documents read do not define what makes an agent “active” beyond the phrase quoted above, so the quantity on an invoice should be reconciled with the agent list in the Huntress portal as at the last day of the cycle.
Direct and MSP billing examples
For direct customers, the pricing page gives an example: if the licence minimum is 250 and 275 endpoints are deployed, the customer on monthly billing is billed for 275; on annual billing, the customer pays the committed minimum once and is billed monthly for the 25 overage endpoints.[1] For MSPs, usage above the committed minimum is “not currently auto-billed and is handled manually”, and an MSP can increase its minimum commitment mid-term to reach a lower rate, which restarts the 12-month term from the new signing date.[1] These are summarised in the partner channel and contract terms article.
Software licence and removal
For products that require installed software, the Terms of Service grant a limited, non-transferable right to install and execute the object code “up to the Licensed Units in the Subscription” for internal business purposes or, if applicable, with Customer Clients.[5] Upon expiry or termination the customer must uninstall the software and, if requested, confirm that to Huntress by email.[5] The Terms also note that the Services may include software functionality that modifies or disables access to a computer system to respond to a security incident.[5]
Managed ITDR
Price and unit
Managed ITDR is listed at USD 4.80 per licensed identity per month at MSRP, with an example of USD 3.60 at 100 identities, covering Microsoft 365 and Google identities and environments.[1]
Billable identities
Huntress “primarily bills for unique, human-controlled identities”, and every successfully onboarded identity receives monitoring and protection from the SOC whether or not it is billed.[3] The methodology reviews all identities in an onboarded Microsoft 365 or Google Workspace environment and evaluates billing status from licence and identity-mapping data.[3]
| Account type | Billing status |
|---|---|
| Standard employee account | Billable |
| Shared mailbox without a paid licence | Not billed |
| Shared mailbox with a paid licence | Billable |
| Room or resource mailbox | Not billed |
| Unlicensed admin account | Not billed |
| Disabled or suspended user with a licence | Billable |
Source for the table: Huntress support article “Billable and Non-billable Identities”.[3] The same article adds:
- Disabled Microsoft 365 identities and suspended Google Workspace identities are still billed if they keep a valid billable licence, while archived Google Workspace identities are not billed.[3]
- If the same person exists in both Microsoft 365 and Google Workspace and both identities are mapped to the same Huntress organisation by email address, Huntress bills one identity; the tenants must be mapped to the same organisation for de-duplication to apply.[3]
- Unlicensed administrative roles and application service accounts are not billed provided no valid billable licence is assigned.[3]
- Specific identities cannot be selectively excluded from protection, because identity providers do not exclude identities from their audit logs, so Huntress monitors all identities in an onboarded environment.[3]
- Student identities can be excluded from both billing and protection “under special circumstances” at a partner’s request.[3]
- Microsoft 365 has approximately 800 SKUs, so unusual licences may be misclassified; a partner that believes an account was billed incorrectly asks its account manager for a SKU review, and a list of excluded licences is published.[3]
The billable count can be seen in the Command Center dashboard (Billable Identities tile), on the Identities page filtered to Billable or Not Billed, and programmatically through the billing reports endpoint of the Huntress API.[3] A licence manager can therefore reconcile the invoice quantity with the portal rather than rely on the identity provider’s raw user count, which will differ because of shared mailboxes, unlicensed accounts and cross-tenant duplicates.
Managed ISPM
Managed ISPM is listed at USD 4.00 per licensed identity per month at MSRP, with an example of USD 3.40 at 100 identities, for hardening a Microsoft 365 environment.[1] The pricing page uses the same phrase, “licensed identity”, but the documents read do not set out a separate counting method for ISPM. It would be prudent to confirm with the account team whether the ITDR billable-identity rules apply to ISPM, and whether an identity covered by both products is counted once per product.
Organisation entitlements
The Manage Billable Products feature provisions purchased products at organisation level. A purchased product “defaults to Enabled for all organizations”, and an Admin must manually disable it where an organisation should not have it.[4] Disabling EDR for an organisation stops collection by existing agents there while keeping artefacts such as incident reports, and an agent installed in an organisation without EDR enabled triggers an email to account admins and provides no EDR protection, so the article recommends uninstalling it.[4] Managed SAT and Managed ITDR are purchased and managed at account level, not at organisation level, because they collect and process data across the account and inherit user grouping from the identity provider.[4]
For MSPs the practical point is that entitlements should be set before agents are deployed in a client organisation, and that ITDR is account-wide, so the billable identities of all client tenants mapped to the account are drawn from one account-level product.
Delinquency
The service-provider article states that providers have at most 90 days, equal to three unpaid monthly invoices, before the account is locked and deleted, after which all outstanding invoices must be paid and a new contract and account set up.[2] Payment is by card on file, with ACH or wire available for USD subscriptions with a 500 endpoint minimum or above.[2]
Out of scope
This article does not cover Managed SIEM, Security Awareness Training, or product capabilities. It relies on support articles that show relative update ages instead of dates, so retrieval date 2026-10-08 is the only date that can be attached to the counting rules above.