MDR Email & Productivity Suites is licensed on a per-account basis. Because the number of monitored accounts can fluctuate and you might have multiple integrations active simultaneously, we use the following calculation:
Every day, we count the number of active accounts in each of your MDR Email & Productivity Suites integrations
Suspended, archived, or administratively-disabled accounts which can't log in are excluded
Identities which are members of an out-of-scope group are excluded
Every month, we calculate the median daily count for each integration
We take the integration with the highest daily median and use that count as the “Total Monitored Accounts" number for the month
Note
If you have multiple integrations with non-overlapping groups of users, we may add those counts together to more accurately represent the unique accounts being monitored.
Viewing Recent License Usage
You can see a summary of your monthly license usage in the Red Canary portal. You can also review the raw license count data if necessary.
Click your user icon at the top right of the portal, then go to License Usage.
On the License Usage page, select the MDR Email & Productivity Suites source.
Expand the View Data Table section to see your monthly Total Monitored Accounts statistics.
If you need to review the raw data for your monthly usage, click to generate a CSV file.
FAQ
What if I exceed my license amount?
If you exceed your license amount, Red Canary continues processing the data from all your systems to make sure an increase in usage doesn’t compromise your security. We also typically forgive any small temporary overages that might occur.
Every three months, we review your usage and true everything up at that time. If you did have an overage, we calculate the difference and you can either increase your license amount (prorated for the remainder of your contract) or you can pay a one-time overage fee. Increasing your license count is a good way to take advantage of volume discounts when available.
Why do my summarized license counts look inconsistent?
Counts may appear higher if a new identity provider was onboarded late in the month. You can reconcile these numbers by generating a CSV from the License Usage page to review the raw data.
Why is my MDR Identities license count higher than my MDR Email and Productivity Suites count?
This is due to object counting differences. MDR Identities (Entra ID) counts both User and Application objects, while MDR Email and Productivity Suites (Office 365) counts only User objects.