Juniper Mist AI subscriptions are the cloud-service licences for the Juniper Mist platform. The platform manages Juniper access points, EX and QFX switches (and HPE Networking CX switches), SRX firewalls, Session Smart Routers and some MX and ACX routers from the Juniper-hosted Mist cloud. Mist is “a subscription-based service”.[4] Its subscriptions cover the wireless, wired and WAN domains and are sold as standalone subscriptions or bundles with 1, 3 or 5-year terms.[1] Each subscription is counted per device of the relevant kind (access point, switch or WAN edge) or per active client. It is tied to a device count, not to device serial numbers.[2][4] Juniper includes Mist Wi-Fi, Wired and WAN Assurance in the standalone software group of the Juniper Flex licence model.[10]
Editions
| Subscription | Counted per | SKU pattern (vendor) | Notes |
|---|---|---|---|
| Wireless Assurance | Access point or beacon point | SUB-MAN-1Y/3Y/5Y[1] | Mandatory for Juniper access points[4] |
| Marvis for Wireless, Premium Analytics, User Engagement, Asset Visibility | Access point | SUB-VNA, SUB-PMA, SUB-ENG, SUB-AST[1] | Associated subscriptions that need SUB-MAN; bundles SUB-1S/2S/3S and SUB-AI; AP-plus-subscription combo SKUs MIST-APxx-…[1] |
| Mist Edge | AP tunnelling to a Mist Edge | S-ME-S-1/3/5[1] | Count must match the APs that tunnel[1] |
| Wired Assurance | Switch, by class | SUB-EX12/EX24/EX48-1S; S-SW-S-C4 to C8[1] | Classes 1 to 3 by port count; Classes 4 to 8 for larger switches |
| Marvis for Wired | Switch, by class | SUB-EX-VNA; S-SW-WA-VNA-C4 to C8[1] | Needs Wired Assurance[1] |
| Flex term subscriptions for switches | Switch, by class | S-EX-A/P-Cn-1/3/5[1] | Wired Assurance, Marvis and the Junos Advanced or Premium tier together[1] |
| WAN Assurance for SRX and vSRX | WAN edge, by class | S-WAN-C1 to C6[1] | vSRX classes C2 to C5 by vCPU count[1] |
| WAN Assurance for Session Smart Routers | WAN edge, by bandwidth tier | S-WAN-A1/A2/P1/P2-xxxxM; AIWAN SaaS bundles S-AIWAN-…[1] | Bandwidth tier must match the SSN on-premises licence[1] |
| Access Assurance (NAC) | Active client | S-CLIENT-S/A-1/3/5/7[1] | Standard and Advanced; Site Survivability add-on S-CLIENT-SS[1] |
| Marvis Client | Client | S-VNACLIENT-S-1/3/5/7[1] | Agent on Android, Windows and macOS[1] |
| Routing Assurance | Router, by class | S-RA-S-C2/C3/C4; add-on S-RA-A-…[1] | ACX7000 and MX models; terms up to 7 years[1] |
Many switch SKUs carry a suffix that adds hardware support and Advanced Care or Premium Care, for example -CAC or -NP. The same subscription can therefore be ordered with or without support.[1]
Metrics
The Mist documentation states the usage basis of each subscription:[2]
- Access point (Mist). Number of APs or beacon points. Used for Wi-Fi Management and Assurance, Marvis for Wireless, Asset Visibility and vBLE Engagement. Mist Edge counts the APs that form tunnels.
- Switch (Mist). Number of switches. Used for Wired Assurance, Marvis for Wired and Premium Analytics (Wired). SKUs are split by device class.[1]
- WAN Edge (Mist). Number of WAN edges. Used for WAN Assurance, Marvis for WAN and Premium Analytics (WAN).
- Active client (Mist). Number of active clients using NAC (Access Assurance), or number of clients (Marvis Client).
Counting / floors
Device count, not serial numbers (as retrieved 2026-09-30). Mist subscriptions “are associated with the device count, not devices”. They are hardware-agnostic and not bound to device serial numbers.[4] A failed device can be swapped for an RMA unit or a spare without a new subscription, and devices can move between sites, as long as the number of active devices does not exceed the number of subscriptions.[4] The FAQ likewise says subscriptions apply to organizations rather than to specific devices, and do not need to be assigned to devices.[3] Catalog proof: Mist subscriptions count devices, not serial numbers.
Organization or site scope. An organization-level subscription “is not tied to any specific hardware or site”. Each licence raises the number of devices that can use the feature anywhere in the organization. A site-level subscription affects only the sites where it is enabled, and every AP at those sites consumes it.[2] Wireless Assurance, User Engagement and Asset Visibility are site-level subscriptions whose count must match the number of APs at the site.[1] Catalog proof: Mist subscriptions apply at organization or site level.
Entitled versus Usage. For each subscription type, the Subscriptions page shows Entitled (the active subscriptions) and Usage (the APs at sites where the feature is enabled). When usage exceeds entitlement, the dashboard shows a warning. Juniper recommends buying the missing quantity.[3]
Base subscription required. Associated subscriptions need a base Assurance subscription. A Marvis subscription cannot operate without an active Wired Assurance subscription.[1] A customer needs both an Assurance subscription and a Marvis subscription for each device.[1] Catalog proof: Mist add-on subscriptions require a base Assurance subscription.
High availability. In an HA pair of Session Smart Routers, the secondary node needs its own SSN licence and WAN Assurance subscription. Marvis and Premium Analytics must also be bought twice.[1]
Floors. No minimum quantity is published. Terms are 1, 3 or 5 years. Some bundles run 7 or 10 years, and Access Assurance and Marvis Client run up to 7 years.[1]
Term, renewal and expiry
The subscription term starts when Juniper ships the order or emails the activation code, not when the code is claimed.[3] One activation code can cover several devices and subscriptions. Claiming it activates the subscriptions and claims the devices into the organization.[5] Juniper sends the first expiry notice 90 days before the end of the term, and the Add/Renew workflow lists expired, exceeded and soon-to-expire subscriptions.[3][5] Subscriptions can be co-termed.[3] Catalog proof: Mist subscription term starts at shipment or code email.
When subscriptions expire or are insufficient, the devices keep operating. If expired subscriptions are not renewed, access to the Mist portal is disabled, and the network can no longer be monitored or reconfigured.[3] Juniper reserves the right to terminate the organization dashboard, and inactive subscriptions get no support.[3] Under the reinstatement policy, lapsed cloud subscriptions are backdated to the day after expiry. After a 30-day lapse, access may be disabled or limited, and a new subscription may be required.[7] Catalog proof: Expired Mist subscriptions disable portal management; Lapsed support is backdated up to 365 days with a 3% late fee.
Virtualization & partitioning
Mist subscriptions are not counted by processor, core or virtual machine. The one virtual case is WAN Assurance for vSRX, which maps vSRX sizes to device classes: C2 for 2 vCPU cores, C3 for 5, C4 for 9 and C5 for 17.[1] Organizations and sites are administrative scopes, not licensing partitions. Subscriptions can move between organizations if the administrator is a Super User in both.[3]
Cloud / BYOL
Mist is a Juniper-hosted cloud service, and BYOL does not apply. Moving subscriptions from the global cloud to the EU cloud means deleting them in one environment and reclaiming them in the other through the API.[3] The JPLA forbids the customer to let any third party access the Cloud Services.[9]
Programs
- Trials. A trial subscription comes with a new organization. The 90-day free trial starts when the organization is created.[3]
- Bundles. Subscription bundles (SUB-1S/2S/3S, SUB-AI), AP combo SKUs, and Flex term subscriptions for switches combine several subscriptions in one SKU.[1]
- Portal visibility. The Juniper Agile Licensing portal does not display Mist entitlements.[6] Mist subscriptions are managed on the Organization > Admin > Subscriptions page of the Mist portal.[4]
- Second-hand hardware. Mist access points, Mist Edge and Session Smart Router hardware bought outside Juniper’s authorized channels cannot have support reinstated.[8]
Out of scope
- Prices, which are not published in the retrieved documents.
- HPE Aruba Networking Central and other HPE cloud services.
- Junos tier licences on switches and firewalls that are not managed by Mist.