Ivanti endpoint and patch management licensing covers Ivanti’s client management, patching and mobile device management products. These are Ivanti Endpoint Manager (EPM), Ivanti Security Controls, Ivanti Patch for Configuration Manager, the cloud-based Ivanti Neurons for Patch Management, and Ivanti Neurons for MDM, sold in Secure UEM packages. Contractually each product is sold under a License Model of the Ivanti End User License and Services Agreement (EULSA) that the Invoice names. The machine-counting models are Device-Based, Server-Based and Ivanti Neurons Device.[1] In practice each product counts use in its own unit: nodes, seats, devices or users. Several products report that count back to Ivanti. For the master agreement see Ivanti licensing.
Editions
| Product | Deployment | Unit the product counts | How it is activated |
|---|---|---|---|
| Ivanti Endpoint Manager | On-premise core server | Nodes; client and server licences[2] | Core Server Activation with Ivanti account credentials[2] |
| Ivanti Security Controls | On-premise console | Licence seats[6] | 25-character licence key, online or offline[5] |
| Ivanti Patch for Configuration Manager | Used with Microsoft Configuration Manager | Endpoint seats and remote console seats[8] | Ivanti license server credentials, or licence key[8] |
| Ivanti Neurons for Patch Management | SaaS | Platform fee plus device-based licences[9] | Neurons tenant |
| Ivanti Neurons for MDM | SaaS | User licences, up to five devices each[10] | Neurons for MDM tenant |
Neurons for Patch Management can be bought on its own or as part of a Secure Unified Endpoint solution package.[9] On the Neurons platform, which features are available on an endpoint running the Neurons Agent depends on the licence for the Neurons environment.[11] Patch for Configuration Manager also has a US Federal Edition. Its licence key unlocks Information Assurance Vulnerability Alert (IAVA) data.[8] Ivanti publishes no prices for these products.
Metrics
| Ivanti term | Catalog row | What the vendor says |
|---|---|---|
| Device-Based (EULSA) | Device-Based | Licences for each Registered Device or each Device with the Software deployed, physical or virtual[1] |
| Server-Based (EULSA) | Server-Based | Licences for each Server tracked, supported or managed by the Software, or running it[1] |
| Ivanti Neurons Device (EULSA) | Ivanti Neurons Device | Licences for each Registered Device and each Device with a supported OS tracked, supported or managed[1] |
| Node (Endpoint Manager) | Endpoint Manager node | The core reports “the precise number of nodes you’re using”; there are client and server licences[2] |
| Licence seat (Security Controls) | Security Controls license seat | Remaining seats fall by one for each deployment target[6] |
| Endpoint and remote console seats | Patch for Configuration Manager seat | Endpoints are managed client machines; remote consoles manage the same Configuration Manager environment[8] |
| User licence (MDM) | Neurons for MDM user license | Each Secure UEM or Secure UEM Premium user licence allows up to five devices[10] |
Counting / floors
Endpoint Manager
Node reporting (help page undated, retrieved 2026-09-27). Each core server must be activated with Ivanti credentials, or with a 45-day evaluation licence valid for 100 nodes.[2] The activation component periodically generates node count data. This covers the number of nodes in use, an encrypted hardware configuration, the Ivanti programs in use and general feature usage statistics.[2] If the data is not sent within a 30-day grace period after the first verification attempt, the core server may become inoperative until it is.[2] Cores without Internet access send the data by e-mail.[3] Each core needs its own authorized certificate, but several cores can report node counts to the same Ivanti account. The usage file is signed and encrypted, and manual changes invalidate it.[4] Catalog proof: Endpoint Manager cores must report node counts within 30 days; Endpoint Manager evaluation: 45 days, 100 nodes.
Client and server licences. Installing the Endpoint Manager agent on a server operating system consumes a server licence. Rollup core servers do not need activation.[2] Catalog proof: An agent on a server OS consumes a server licence.
No hard cap. The Product Licensing dialog shows the authorized nodes purchased, but “the core server doesn’t limit you to the number of authorized nodes you purchased.”[2] Over-deployment is therefore technically possible, and Ivanti receives the node count. Catalog proof: Endpoint Manager does not enforce the purchased node count.
Security Controls
A machine is recorded, and consumes one seat, the first time it is a patch deployment target. Each Security Controls Agent machine also consumes a seat. A machine managed both agentless and by agent counts once.[6] Seats used are shown under Help > About Security Controls.[6] The trial licence runs for 60 days and is limited to 50 seats. After it expires the data files stop refreshing.[5] Catalog proof: Security Controls consumes one seat per deployment target or agent; Security Controls trial: 60 days, 50 seats.
Patch for Configuration Manager
At activation the console can consume all entitled endpoint seats or a specified number, so an entitlement can be split across consoles. A remote console consumes one remote console seat, and an environment may have up to 10 remote consoles.[8] The trial runs for 60 days with 50 seats and allows only five different updates to be published.[8] The product warns when the key has expired or will expire within 60 days.[8] Certain Patch for MEM functions work by accessing Microsoft Intune through the Microsoft API, and the EULSA states that this does not remove the need for a valid Intune licence.[1] Catalog proof: Patch for Configuration Manager seats can be split across consoles.
Neurons for Patch Management and Neurons for MDM
Neurons for Patch Management is priced as a platform fee plus device-based licences.[9] The Ivanti Neurons Device model counts each Registered Device and each Device with a supported operating system that the Software tracks, supports or manages.[1] Catalog proof: Neurons for Patch Management is priced as platform fee plus devices; Ivanti Neurons Device counts every tracked or managed device.
In Neurons for MDM a user claims a licence when registering a first device and can register up to five devices on it. Registering more claims another licence. There is no enforced limit on the number of licences one user can claim, and licences are released when devices are retired or wiped.[10] The EULSA likewise counts a Registered Device until it is marked “removed”, “retired”, “wiped” or “deleted”.[1] Devices that are lost or out of use therefore keep consuming licences until they are retired. Catalog proof: A Neurons for MDM user licence covers up to five devices; Registered Devices count until marked removed.
Virtualization & partitioning
The EULSA Device definition includes virtual machines, and the Device-Based, Server-Based and Ivanti Neurons Device models count physical and virtual machines alike.[1] Security Controls counts a virtual machine once even when it is scanned both online (powered on) and offline (powered off). Virtual machine snapshots are not scanned or patched.[7] Two offline virtual machines cloned with the same domain and computer name appear as one machine in Machine View.[7] None of the retrieved documents offers host-based licensing for hypervisors. Catalog proof: A virtual machine scanned online and offline counts once; Device includes virtual machines and mailboxes.
Cloud / BYOL
Neurons for Patch Management and Neurons for MDM are SaaS Offerings governed by the EULSA and the SaaS Supplemental Terms. Ivanti may continuously monitor SaaS usage.[1] Endpoint Manager, Security Controls and Patch for Configuration Manager are customer-hosted. The retrieved documents contain no rule for running them on public cloud infrastructure, so the device and server definitions apply to cloud virtual machines in the same way as on-premises ones.[1]
Programs
- Maintenance and content. Ivanti’s Patch Management solutions depend on content feeds of new security updates. The cost of that content is included in the Maintenance/Support renewal.[12] Ivanti states that continuing to renew maintenance ensures these content updates keep arriving.[12] See Support and Maintenance Services.
- Trials. Endpoint Manager allows a 45-day, 100-node evaluation per core. Security Controls and Patch for Configuration Manager allow 60 days and 50 seats.[2][5][8] These sit under the EULSA’s Trial Software terms, which limit trials to non-production use.[1]
- Licence portal. Patch for Configuration Manager refers administrators to portal.ivanti.com for licence details and administrative functions.[8] Offline activation of Security Controls uses Ivanti’s activation web portal.[5]
Audits and compliance
Endpoint Manager node count data and on-premise telemetry give Ivanti usage information outside a formal audit. The EULSA states that on-premise Software “may gather and communicate telemetry data to Ivanti”.[1] Under EULSA §14 an underpayment found in an audit is charged at then-current list price, with up to three years of back subscription or support. Audit costs are added if the shortfall exceeds 5%.[1] Because Endpoint Manager does not cap nodes and MDM licences are released only when devices are retired or wiped, retiring stale devices and agents directly affects the count. Catalog proof: On-premise software may send telemetry to Ivanti; On-premise audit: once a year, 30 days, back fees up to three years. See Ivanti support, renewals and audit.
Out of scope
- Ivanti Endpoint Manager Mobile, Ivanti Neurons for UEM bundles and Ivanti Neurons for Risk-Based Vulnerability Management, whose product-specific licensing documents were not retrieved.
- Microsoft Configuration Manager and Intune licences, which customers need separately.
- Prices and package contents of Secure UEM and Secure Unified Endpoint packages.