Licensing & Plans

Overview

Every GraphnAI deployment runs on a plan. The plan decides two things: which advanced features are unlocked, and how many users your license covers. Signing in, the identity graph, dashboards, posture scoring and directory sync work the same on every plan.

Features your plan doesn't include stay visible, marked with a lock, so you can see what an upgrade adds. A few safety controls never depend on the plan. See What always works.

Prerequisites

Viewer role or above to see the license banner and which features are locked.
Admin role to open Admin > License and apply or renew a license.
Nothing else to set up. The plan applies as soon as a license is imported.

What always works, whatever your plan

Your plan never restricts these:

Signing in and out, and your own sessions.
Users and identity providers, so you can always add teammates and keep sign-in working.
Everything you can see: the identity graph, search, dashboards, security posture, stale identities, over-permission analysis and Identity Inventory.
Directory sync, scheduled and manual, within the license limits described below.
The automation kill switch, which stops automatic actions.
Undo of an action you already ran. An action you ran while it was licensed can be undone on any plan. See Remediation Reversibility and Undo.

An expired license is a separate case. It turns the platform read-only, which blocks every change, undo and the kill switch included. See Read-Only State.

What a locked feature looks like

A feature you haven't bought stays in the product with a lock:

In the sidebar, a locked item keeps its place with a lock icon. Its tooltip says an upgraded plan includes it, for example "Detections are available with an upgraded plan." Detection Alerts also keeps its count of open alerts.
A locked page names the feature, says what it does, and lists what you'd gain. It links to Read the docs and See plans.
A locked control, such as a button or a mode toggle, looks dimmed but still responds. Its tooltip carries the same note. Select it to open a dialog with the page's details and links.

If GraphnAI can't check your license, for example after a network error, a locked page shows "Couldn't check your license" with Retry. A locked control shows "License check failed". Neither offers an upgrade, because the feature may already be yours.

What your license counts

A license counts enabled user accounts in Active Directory and Entra ID. A user synced from AD to Entra ID counts once.

These count:

Enabled AD user accounts and enabled Entra ID member users.
Service accounts that are AD user accounts, including accounts GraphnAI shows as service accounts.

These don't count:

Computers, groups, OUs, containers and GPOs.
Service principals, managed identities, applications, devices, roles, Conditional Access policies and certificate templates.
Guests and disabled accounts.
gMSA, sMSA and dMSA accounts.
Interdomain trust accounts.

Only directories you currently have connected count. Objects left over from a removed bridge or Entra ID connection don't. GraphnAI refreshes the count each time a sync finishes. To check the number yourself, see How the user count is measured.

Licenses issued before the user count keep counting directory objects, called identities, exactly as before. Admin > License shows which one yours uses: the row reads Users or Identities. See Licenses that count identities.

A preview license has no user limit. Its Users row shows the count, so you know the number a quote uses.

The Current license card shows your plan name: Preview, Design Partner, Enterprise, Community, Exposure or Complete.

Going over your user limit

What happens depends on your plan.

Paid licenses

On a paid license the user count is a soft limit. Collection never stops.

Administrators see a dismissible banner: "{current} users. Your license covers {max}. Collection continues, and the difference is settled at renewal." It comes back if the count grows further.
The Users row on Admin > License reads "Over your license. Collection continues, and the difference is settled at renewal."

Community Edition

Community Edition is the only hard cap: 1,000 users and 2 directory sources.

Syncs keep running when your directory first grows past the limit.
A 14-day grace window starts. A yellow banner reads "Your directory has grown past your license: {current} of {max} users. Collection pauses {date} unless the license is upgraded."
New collection pauses if you're still over the limit when the window ends. The red banner reads "Collection is paused. Your directory has more users than your license covers. Your data is intact and analysis keeps running." Syncs stop starting, but a sync that's already running finishes.
Everything already collected stays. Nothing is deleted, hidden or partly collected, and every analysis keeps running on the data you have.

To clear the countdown during the grace window, bring your user count under the limit and let a sync finish. Once collection has paused, only a license with a higher limit resumes it. Apply that license and collection resumes at the next sync, with no restart.

GraphnAI checks the grace window once an hour, so the pause can start up to an hour after the date on the banner.

A directory that's only half collected understates your exposure. Accounts, groups and computers would be missing, and the posture you see would be wrong without saying so. Pausing new collection keeps what you already have complete and accurate.

Licenses that count identities

A license issued before the user count counts every directory object GraphnAI collects: users, groups, computers, service accounts, OUs, containers and the other objects in the graph. The count is taken each time a sync finishes. It behaves as it always has. The banners say "identities" instead of "users", and the Identities row shows the count.

How the user count is measured

You can check the number against your own directory. Expect small differences if accounts changed since the last sync.

Active Directory

Run this in PowerShell with the ActiveDirectory module. Run it for each domain you've connected:

(Get-ADUser -Filter 'Enabled -eq $true' -Server <domain>).Count

Get-ADUser returns the same accounts GraphnAI counts, plus one interdomain trust account per domain trust. Their names end in $. Subtract them to match the license count. Get-ADUser never returns gMSA, sMSA or dMSA accounts.

Microsoft Entra ID

GraphnAI counts enabled member users, not guests. It then removes users synced from on-premises whose AD account is already counted.

To see the starting number, open the Microsoft Entra admin center, go to Users, and filter to Member and enabled. Or use Microsoft Graph with the ConsistencyLevel: eventual header:

GET /users?$filter=accountEnabled eq true and userType eq 'Member'&$count=true

Subtract the users that sync from on-premises Active Directory, because the AD count already includes them.

Directory sources

Your plan may also limit how many directory sources you connect. A directory source is:

One Active Directory domain, or
One Microsoft Entra ID tenant.

A hybrid environment, an on-premises domain plus its Entra ID tenant, counts as two sources. An Entra ID tenant configured more than once, for example under two identity providers, counts once.

Adding a source beyond your plan is refused when you try to add it: "The current plan covers N directory sources. Remove one or upgrade to add another." Your existing sources aren't touched.
Removing a source always works, even when you're over the limit.
If a new license covers fewer sources than you have, the sources you added first keep syncing. The rest stop syncing until you remove sources or raise the limit.

See Bridge Configuration and Domain Auto-Discovery to add and remove directory sources.

Renewing or changing your plan

A new plan takes effect at once, with no restart and no support ticket.

Sign in as an Admin and open Admin > License.
Under Apply a license, select Choose your license file, or drag the file onto the box.
Select Apply.

If your license has expired or none is applied, the banner and the License page show a Get a license link. It opens graphnai.com/pricing.

Once applied:

New features unlock in place. A page that showed a lock shows the real feature, with no reload.
A higher user limit, or none, clears the grace countdown or the pause at once. Collection resumes at the next sync.
A higher directory source limit, or none, lets you add the sources that were refused.

If the new license gives you less than your current one, a confirmation dialog lists what changes first. Plans with a yearly renewal, including free plans, renew the same way.

Locked features that already show a count

Some locked features show a live count before you've bought them:

Detection Alerts in the sidebar shows how many alerts are open. Its locked page reads "14 open detection alerts are waiting in your directory."
The Critical Junctions locked page reads "Your directory has 6 critical junctions." The Junction score card on the dashboard counts them too.

GraphnAI keeps evaluating detections and Critical Junctions on every plan. Only the detailed view is locked.

When you upgrade, nothing has to be found again. Everything found while the feature was locked is there the moment it unlocks, with no new scan or sync. Detection alerts are kept for a year.

Troubleshooting

A feature still shows a lock after you applied a new license

Cause: The new license doesn't include that feature, or the page hasn't refreshed its license status yet.
Fix: Open Admin > License and check the feature's badge. A lock there means the license doesn't include it, so ask whoever issued it. A check there with a lock on the page means the page is behind, so reload it.

Directory syncs stopped collecting

Cause: You're on Community Edition, your directory has more users than the license covers, and the 14-day grace window has ended. Licenses that count identities behave the same way.
Fix: Nothing is lost, and every analysis keeps running. Compare Users with its limit on Admin > License. Apply a license with a higher limit to resume collection.

Adding a domain or tenant was refused

Cause: It would put you over the number of directory sources your plan covers. A hybrid domain and tenant pair counts as two. A tenant that's already configured doesn't count again.
Fix: Remove a directory source first, which always works, or move to a plan that covers more sources.

You can't undo a remediation action

Cause: Your plan never blocks undo. The action may be outside its undo window, already undone, or no longer reversible. A read-only license also blocks undo.
Fix: Open the action's entry on the History tab of the Remediation page for the reason. If the banner says the license is read-only, apply a new license first. See Remediation Reversibility and Undo.