Licensing

This section includes:

About licenses

The Licenses page lets you see details about the current licenses for your organization. The licensing information is typically used for billing purposes. All the information in the Licenses page is read-only - you can't modify any of the information that appears in the page.

To open the Licenses page:

In FortiMail Workspace Security, in the left navigation menu, select Settings > Licenses.

The Licenses page is available to admin users with the "Admin" role only.

Note: The Licenses page is available to admin-users in all organization-types - except for MSSP Customer organization-types. [See Organization types]

Viewing license details

The format of the Licenses page depends on whether the current organization in FortiMail Workspace Security is a parent organization or a child organization:

Parent organization: Shows licensing information combined for the current [parent] organization and for all child organizations; and also lets you drill-down to see licensing information for individual child organizations.
Child organization: Shows licensing information for the current [child] organization only.

Licenses page - for a child organization

The Licenses page for a child organization includes the following:

General Information

Some of the options below may not be visible.

Organization name

The name of the organization.

Parent organization

The name of the parent organization.

Organization type

All organizations that have one of the following organization types, is a child organization, and therefore can't have any child organizations of their own.

Direct customer

Has no parent organization and no child organizations.

MSSP customer

This is a child organization under an MSSP parent organization.

An admin-user in an MSSP customer organization won't have access to the Organizations page and the Licensing page in FortiMail Workspace Security.

Indirect customer

Contract type

POC

Proof-of-Concept:

Typically indicates that the organization is currently being used for trial purposes.
The organization will not be billed.
When you add a new organization, by default the "Contract type" will be "POC".
An organization can be moved from POC to Commercial by the Customer Success Manager. Contact your Customer Success Manager for details.
The "Self Analyze" feature is not available to admin-users in PoC organizations.

Free

Not currently used.

Commercial

The organization is a fully-fledged billed customer.

An organization is moved from POC to Commercial by the Customer Success Manager. Contact your Customer Success Manager for details.

You can include the text template below in your email:

Subject: Changing PoC to Commercial

Hi Perception Point - Customer Success Team,

Please can you change the license status from PoC to Commercial for the following organization:

Organization name: <Your organization name> as it appears in FortiMail Workspace Security

Please let us know when this has been done.

Thank you

NFR

Not-for-resale:

If the Contract Type is set to NFR, then the organization is awarded 15 "free" licenses.

If the "license source" is Integration, then the number of billed licenses is reduced by 15.
If the "license source" is Reported or Purchased, then the number of billed licenses is not reduced - as it is assumed that the Customer Success Manager has already taken this into account.
The "Self Analyze" feature is not available to admin-users.

NFR is typically used to experiment with different scenarios, and for demo purposes. It is typically given by vendors to their channel partners for testing.

Active since

The date on which the Status of the organization was set to Active in FortiMail Workspace Security. [See Account - General - Account]

Commercial since

The date on which the Contract type of the organization was set to Commercial. [See above]

Assigned Bundles

Shows a list of all the bundles that are assigned to the organization.

Bundle

A list of the assigned bundles.

Billed licenses

The number of licenses for which the customer will be billed - or was billed - for the items that are included in the bundle. This number is based on the License Source.

For the current month: The time-stamp that is shown is the date and time of the displayed information - which is the most recent information.

Click the bundle name to display the number of Billed licenses at the end of the previous months - for the bundle. Information for a maximum of six months is displayed.

For previous months:

The date shown is the last day on which billing information is available. This is typically the last day of the month.
The value of the license source on the last day on which billing information is available, is used as the number of Billed Licenses for the month. This takes care of fluctuations in the value of the License Source during the month.
A trend indicator icon indicates if the number of billed licenses increased [] or decreased [] relative to the previous month.

Note: When the "Other" email integration method is implemented, and the License Source is Reported seats, then an error [] may appear under Billed Licenses. This is the expected behavior - and there is no error. The number of Billed Licenses will be the value that is set for Reported seats.

License source

Integration

[Microsoft 365; Google Workspace; Microsoft Collaboration]

Microsoft 365

FortiMail Workspace Security analyzes the organization's Microsoft account. FortiMail Workspace Security tries to identify the users in the account, to determine the "integration number".

What's excluded

The following are excluded from the integration number - based on the Microsoft license:

Non-email-type Microsoft licenses
Removed [unassigned, not-enabled, disabled, deactivated] Microsoft licenses [often used when an employee leaves an organization]

Not-enabled Microsoft email addresses

Note: If FortiMail Workspace Security is used to specify domains, groups, or users that are protected, then users that are not included in these specified entities are not included in the integration number.

Shared mailboxes
Groups [which typically don't have Microsoft licenses]
When aliases are used, only one email address for each user is included in the integration number

Google Workspace

FortiMail Workspace Security examines the organization's Google Workspace account, and counts all included licenses [regardless of the license-type], to determine the "integration number".

More Info

The integration number is determined every day, but the number on the last day of the month is passed on as the value for Billed licenses.
This option is available for Microsoft 365 Inline and API integrations and Google Workspace integrations only.
This option is not available for Microsoft Exchange and "Other" integrations.

Browser Extension: The integration number is determined by the number of unique end-users that are signed-in to the extension on the last day of the month.
OneDrive: All users in the Microsoft account are protected and are therefore included in the integration number. Partial protection is not available. Email-only Microsoft licenses are excluded. The integration number on the last day of the month [on which usage information is available] is used for the billing number.
SharePoint: All users in the Microsoft account are protected and are therefore included in the integration number. Partial protection is not available. Email-only Microsoft licenses are excluded. The integration number on the last day of the month [on which usage information is available] is used for the billing number.
Teams: All users in the Microsoft account are protected and are therefore included in the integration number. Partial protection is not available. Email-only Microsoft licenses are excluded. The integration number on the last day of the month [on which usage information is available] is used for the billing number.

Microsoft endpoints

FortiMail Workspace Security uses the following Office 365 endpoint to extract the required user lists:

https://graph.microsoft.com/v1.0/users

FortiMail Workspace Security applies the filters that are required to extract only active and relevant users.

Google Workspace endpoints

FortiMail Workspace Security uses the followingGoogle Workspace endpoint to extract the required user lists:

https://admin.googleapis.com/admin/directory/v1/users

FortiMail Workspace Security applies the filters that are required to extract only active and relevant users. The filters are based on the domain name associated with the organization in FortiMail Workspace Security.

Reported seats

You specify how many users [seats] are protected by FortiMail Workspace Security. This option is for companies that report their number of seats, and don't have a direct contract with Fortinet. This option is mainly for Acronis organizations and MSSP children.

You can [must] adjust the number of reported seats as the number of protected users changes. Make sure that the number is correct on the last day of the month.

To adjust the number:

Go to Account > Bundles and Channels.
Under Assigned Bundles, locate the required bundle, and click Bundle Settings.
In the Bundle Settings pane, click Edit.
Enter the number of Seats.

More Info

This option is available for all integration types.

About billing

When an organization uses the Reported Seats method to specify the number of users that are protected by FortiMail Workspace Security, the billing procedure is as follows:

You specify the Reported Seats number.
FortiMail Workspace Security compares the Reported Seats number with the Usage number. [See Usage]
1. If there is a difference of LESS THAN 10% between the Reported Seats number and the Usage number, then the Reported Seats number is used as the Billed Licenses number.
2. If there is a difference of MORE THAN 10% between the Reported Seats number and the Usage number, then the Usage number is used as the Billed Licenses number.
  
  For example:
  - If the Reported Seats number is 250 and the Usage number is 270, then the Billed Licenses number will be 270.
  - If the Reported Seats number is 250 and the Usage number is 280, then the Billed Licenses number will be 280.

Assigned since

The date on which the bundle was assigned to the organization.

Channel Usage

Let's you see calculated and actual usage details for each channel in your organization.

Channel

A list of the channels that are included in all the assigned bundles in the organization. Only active channels are displayed - inactive channels are not displayed.

The channels that can currently appear are Email Service, Browser Security, OneDrive, SharePoint, and Teams.

Integration

The number of seats [licenses] identified by using the integration method - for each channel. [See License Source above]

Click the channel name to display the integration number at the end of the previous months. Information for a maximum of six months is displayed.

Note: When the License Source is Integration, then the Integration number is used for billing purposes, not the Usage number [See Usage below].

Usage

The number of unique recipient email addresses for which scans were performed during the month.

Note: The usage numbers may not be accurate, and are not used for billing purposes. The usage numbers are typically used for diagnostic purposes only.

The Usage numbers may be higher than the Integration numbers for the following reasons:

Aliases: When aliases are used, only one email address for each user is included in the integration number - but all aliases are included in the usage number.
Groups: Groups typically don't have Microsoft licenses, and aren't included in the integration number. However, groups are included in the usage number.
Shared mailboxes: Shared mailboxes aren't included in the integration number. However, they are included in the usage number.

Download

Generates and then downloads a CSV file that contains either:

Integration user list: A list of the users that are currently protected - as determined by the integration method. [See License Source above]

- or -
Usage user list: A list of the users [recipient email addresses] for which scans were performed during the month.

Each of the above download options is available only if the relevant Integration value or Usage value is greater than zero.

Generating a list of who is protected [Child organizations]

You can generate and download a CSV file that contains a list of the users that are protected by FortiMail Workspace Security.

In FortiMail Workspace Security, in the left navigation menu, select Settings > Licenses.
In the Licenses page, scroll down to the Channel Usage section at the bottom of the page.
In the Channel column, locate the required channel.
Click the channel title to display the number of active licenses for the channel at the end of the previous months.
For the required period, click the Download icon on the right, and then select Integration User List or Usage User List.
- Integration user list: A list of the users that are currently protected - as determined by the integration method. [See License Source above]
  
  - or -
- Usage user list: A list of the users [recipient email addresses] for which scans were performed during the month.
Each of the above download options is available only if the relevant Integration value or Usage value is greater than zero.

The specified list will be downloaded.

Licenses page - for a parent organization

Note: This page appears only if the current organization is a parent organization with one of the following organization-types: MSSP; Reseller; Distributor; Multi-organization

To view license details:

In FortiMail Workspace Security, in the left navigation menu, select Settings > Licenses.

The Licenses page for a parent organization includes the following:

Organizations

The number of child organizations that have a Commercial contract type and that have a value greater than zero for billed licenses [see below] - for the current parent organization.

The number of child organizations that have a PoC contract type is also displayed.

Top Bundles

The bundles that have been assigned to the most child organizations. The number of times that the bundles are assigned to an organization is shown for each bundle.

General Information

Organization name

The name of the current [parent] organization.

Organization type

MSSP	This organization is used to manage the child organizations. No scanning should be configured to occur in this organization. Scanning should be configured in child organizations only. Default child type: MSSP customer
Reseller	Default child type: Indirect Customer
Distributor	Default child type: Indirect Customer
Multi-organization	For direct organizations that have child-organizations for different business units, channels etc… Default child type: Indirect Customer

Contract type

POC

Proof-of-Concept:

Typically indicates that the organization is currently being used for trial purposes.
The organization will not be billed.
When you add a new organization, by default the "Contract type" will be "POC".
An organization can be moved from POC to Commercial by the Customer Success Manager. Contact your Customer Success Manager for details.
The "Self Analyze" feature is not available to admin-users in PoC organizations.

Free

Not currently used.

Commercial

The organization is a fully-fledged billed customer.

An organization is moved from POC to Commercial by the Customer Success Manager. Contact your Customer Success Manager for details.

You can include the text template below in your email:

Subject: Changing PoC to Commercial

Hi Perception Point - Customer Success Team,

Please can you change the license status from PoC to Commercial for the following organization:

Organization name: <Your organization name> as it appears in FortiMail Workspace Security

Please let us know when this has been done.

Thank you

NFR

Not-for-resale:

If the Contract Type is set to NFR, then the organization is awarded 15 "free" licenses.

If the "license source" is Integration, then the number of billed licenses is reduced by 15.
If the "license source" is Reported or Purchased, then the number of billed licenses is not reduced - as it is assumed that the Customer Success Manager has already taken this into account.
The "Self Analyze" feature is not available to admin-users.

NFR is typically used to experiment with different scenarios, and for demo purposes. It is typically given by vendors to their channel partners for testing.

Active since

The date on which the organization became active in FortiMail Workspace Security.

Commercial since

The date from which this parent organization has had a Contract type of Commercial.

Active licenses

Use the bundle selector control [] to select for which bundle to display the licensing information. The list of bundles includes all bundles that are assigned to any of the child organizations.

When you select a bundle, the table below shows details about all those organizations that have the selected bundle assigned to them.
Use the POC and Commercial filters as required.
Click Download CSV [located on the right of Active Licenses] to download a CSV file that contains license information for all bundles in all of the child organizations.

Organization

Lists the current [parent] organization, and all the child organizations.

Note: The current [parent] organization will appear in the list only if the organization has scans.

Billed licenses

The number of licenses for which the customer will be billed for the items that are included in the selected bundle. This number is based on the License Source.

The time-stamp that is shown is the date and time of the displayed information - which is the most recent information.

A trend indicator icon indicates if the number of billed licenses increased [] or decreased [] relative to the previous month.

Note:

Billed Licenses may appear as Error [] if the License Source is set to Reported Seats.
Billed Licenses may appear as Error [] for Exchange and "Other" integrations.

License source

Integration

[Microsoft 365; Google Workspace; Microsoft Collaboration]

Microsoft 365

FortiMail Workspace Security analyzes the organization's Microsoft account. FortiMail Workspace Security tries to identify the users in the account, to determine the "integration number".

What's excluded

The following are excluded from the integration number - based on the Microsoft license:

Non-email-type Microsoft licenses
Removed [unassigned, not-enabled, disabled, deactivated] Microsoft licenses [often used when an employee leaves an organization]

Not-enabled Microsoft email addresses

Shared mailboxes
Groups [which typically don't have Microsoft licenses]
When aliases are used, only one email address for each user is included in the integration number

Google Workspace

FortiMail Workspace Security examines the organization's Google Workspace account, and counts all included licenses [regardless of the license-type], to determine the "integration number".

More Info

The integration number is determined every day, but the number on the last day of the month is passed on as the value for Billed licenses.
This option is available for Microsoft 365 Inline and API integrations and Google Workspace integrations only.
This option is not available for Microsoft Exchange and "Other" integrations.

Browser Extension: The integration number is determined by the number of unique end-users that are signed-in to the extension on the last day of the month.
OneDrive: All users in the Microsoft account are protected and are therefore included in the integration number. Partial protection is not available. Email-only Microsoft licenses are excluded. The integration number on the last day of the month [on which usage information is available] is used for the billing number.
SharePoint: All users in the Microsoft account are protected and are therefore included in the integration number. Partial protection is not available. Email-only Microsoft licenses are excluded. The integration number on the last day of the month [on which usage information is available] is used for the billing number.
Teams: All users in the Microsoft account are protected and are therefore included in the integration number. Partial protection is not available. Email-only Microsoft licenses are excluded. The integration number on the last day of the month [on which usage information is available] is used for the billing number.

Microsoft endpoints

FortiMail Workspace Security uses the following Office 365 endpoint to extract the required user lists:

https://graph.microsoft.com/v1.0/users

FortiMail Workspace Security applies the filters that are required to extract only active and relevant users.

Google Workspace endpoints

FortiMail Workspace Security uses the followingGoogle Workspace endpoint to extract the required user lists:

https://admin.googleapis.com/admin/directory/v1/users

Reported seats

You can [must] adjust the number of reported seats as the number of protected users changes. Make sure that the number is correct on the last day of the month.

To adjust the number:

Go to Account > Bundles and Channels.
Under Assigned Bundles, locate the required bundle, and click Bundle Settings.
In the Bundle Settings pane, click Edit.
Enter the number of Seats.

More Info

This option is available for all integration types.

About billing

When an organization uses the Reported Seats method to specify the number of users that are protected by FortiMail Workspace Security, the billing procedure is as follows:

You specify the Reported Seats number.
FortiMail Workspace Security compares the Reported Seats number with the Usage number. [See Usage]
1. If there is a difference of LESS THAN 10% between the Reported Seats number and the Usage number, then the Reported Seats number is used as the Billed Licenses number.
2. If there is a difference of MORE THAN 10% between the Reported Seats number and the Usage number, then the Usage number is used as the Billed Licenses number.
  
  For example:
  - If the Reported Seats number is 250 and the Usage number is 270, then the Billed Licenses number will be 270.
  - If the Reported Seats number is 250 and the Usage number is 280, then the Billed Licenses number will be 280.

Contract type

POC

Proof-of-Concept:

Typically indicates that the organization is currently being used for trial purposes.
The organization will not be billed.
When you add a new organization, by default the "Contract type" will be "POC".
An organization can be moved from POC to Commercial by the Customer Success Manager. Contact your Customer Success Manager for details.
The "Self Analyze" feature is not available to admin-users in PoC organizations.

Free

Not currently used.

Commercial

The organization is a fully-fledged billed customer.

An organization is moved from POC to Commercial by the Customer Success Manager. Contact your Customer Success Manager for details.

You can include the text template below in your email:

Subject: Changing PoC to Commercial

Hi Perception Point - Customer Success Team,

Please can you change the license status from PoC to Commercial for the following organization:

Organization name: <Your organization name> as it appears in FortiMail Workspace Security

Please let us know when this has been done.

Thank you

NFR

Not-for-resale:

If the Contract Type is set to NFR, then the organization is awarded 15 "free" licenses.

If the "license source" is Integration, then the number of billed licenses is reduced by 15.
If the "license source" is Reported or Purchased, then the number of billed licenses is not reduced - as it is assumed that the Customer Success Manager has already taken this into account.
The "Self Analyze" feature is not available to admin-users.

NFR is typically used to experiment with different scenarios, and for demo purposes. It is typically given by vendors to their channel partners for testing.

Active since

The date on which the organization became active.

View details

Shows additional license details for the organization.

The "View Details" functionality is available for Contract-Type > Commercial organizations only.

Generating a list of who is protected [Parent organizations]

You can generate and download a CSV file that contains a list of the users that are protected by FortiMail Workspace Security. You can generate the report either for all child organizations, or for a specific child organization.

For all the child organizations:

In FortiMail Workspace Security, in the left navigation menu, select Settings > Licenses.
On the right of the Active Licenses section, click Download CSV.

The report will be downloaded.

For a specific child organization:

In FortiMail Workspace Security, in the left navigation menu, select Settings > Licenses.
In the Licenses page, locate the Active Licenses section.
In the Active Licenses section, locate the required organization.
Click View Details - located on the right side.
In the pane that opens on the right side, locate the Channel Usage section.
Locate the required channel, click the Download icon on the right side.
Select Integration User List or Usage User List:
- Integration user list: A list of the users that are currently protected - as determined by the integration method.
  - or -
- Usage user list: A list of the users [recipient email addresses] for which scans were performed during the month.
  Each of the above download options is available only if the relevant Integration value or Usage value is greater than zero.
  The specified report will be downloaded.

For details on what is included in the downloaded file, see Contents of a downloaded integration user list below.

Contents of a downloaded integration user list

When you generate and then download an integration user list, the CSV file may include some of the following fields:

Mail: The email address of the protected user inside Microsoft or Google Workspace.

[Appears for all integrations]
ID: The user-ID of the protected user inside Microsoft or Google Workspace.

[Appears for Microsoft 365 and Google Workspace integrations only]
Display name:

[Appears for Microsoft 365 integrations only]
Assigned Licenses:

[Appears for Microsoft 365 integrations only]

Note: All downloaded usage user lists include on the "mail" field.