How Identity Licensing and Usage are Determined

MDR Identities is licensed on a per-identity basis. Because the number of monitored identities can fluctuate and you might have multiple integrations active simultaneously, we use the following calculation:

• Every day, we count the number of active identities in each of your MDR Identities integrations

  • Suspended, archived, or administratively-disabled identities which can't log in are excluded

  • Identities which are members of an out-of-scope group are excluded

• Every month, we calculate the median daily count for each integration

• We take the integration with the highest daily median and use that count as the “Total Monitored Identities" number for the month

Note

If you have multiple integrations with non-overlapping groups of users, we may add those counts together to more accurately represent the unique accounts being monitored.

Viewing Recent License Usage

You can see a summary of your monthly license usage in the Red Canary portal. You can also review the raw license count data if necessary.

1. Click your user icon at the top right of the portal, then go to License Usage.
   

2. On the License Usage page, select the MDR Identities source.

3. Expand the View Data Table section to see your monthly Total Monitored Identities statistics.
   

4. If you need to review the raw data for your monthly usage, click to generate a CSV file.

Exceeded Your License Amount?

If you exceed your license amount, Red Canary continues processing the data from all your systems to make sure an increase in usage doesn’t compromise your security. We also typically forgive any small temporary overages that might occur.

Every three months, we review your usage and true everything up at that time. If you did have an overage, we calculate the difference and you can either increase your license amount (prorated for the remainder of your contract) or you can pay a one-time overage fee. Increasing your license count is a good way to take advantage of volume discounts when available.

Inconsistent Numbers?

Sometimes the summarized license counts may not look right. For example, onboarding a new identity provider at the end of the month might have caused the counts to go up. Usually, generating the CSV will give you the data you need to reconcile the numbers .

If you still have questions about your licenses after reviewing the raw data, let us know and we'll get to the bottom of it.

Counting Identities in Entra ID

For MDR Identities customers who integrate with Entra ID, Red Canary periodically calls the getUsers endpoint on the Microsoft Graph API to count the monitored identities in your environment. Be aware that Microsoft Graph only returns users who exist in Entra ID, which doesn’t automatically include users in an on-premise Active Directory (AD) environment. In order for all users to exist in Entra ID (and be discoverable by Red Canary), you need to configure Entra Connect to synchronize between AD and Entra ID.

Also, a trust relationship between forests in an on-premises AD solution does not automatically guarantee that all users from all trusted forests will be synchronized to Entra ID. If you have numerous domains within a forest, or trusts with other forests, and want all the users to exist in Entra ID, you must configure Entra Connect to specifically include these sources in its sync process.