Allocate ThreatSync+ NDR Users

Applies To: ThreatSync+ NDR This topic applies to ThreatSync+ NDR.

When a Service Provider activates a ThreatSync+ NDR license, the available license and user allocation appear in the Inventory page in WatchGuard Cloud. As a Service Provider, you can allocate users to your own account or to any account you manage from the Inventory page. You can allocate only one license of each type (term or subscription) to a Subscriber account. You can allocate more than one license of the same type to a Service Provider account that you manage.

When you select Overview from Account Manager, the Inventory > Summary page shows a summary of the users and devices in your inventory. On the Overview > Inventory > Summary page, the ThreatSync+ NDR section shows this information:

• Next License Expiration — Next license expiration date
• Allocated Users — Number of allocated term and subscription users

If you manage delegated accounts, the Overview > Inventory > Summary page does not include license information that the delegated accounts activated. To view inventory activated and allocated by a tier-1 Subscriber delegated account, you must select the account in Account Manager.

The Inventory > ThreatSync+ NDR > Licenses page shows the ThreatSync+ NDR license, license type (subscription, term, or trial), the license key, number of users (quantity), expiration date, and the account the license is allocated to. You can filter the list of licenses to view Expired or Active licenses only.

For information on trial licenses, go to About Trials in WatchGuard Cloud.

The Inventory > ThreatSync+ NDR > Allocation page shows the next license expiration date, as well as the number of users allocated to managed accounts and the number of unallocated users available in your account.

The Allocation page includes a table that lists your managed Service Provider and Subscriber accounts. Delegated accounts have a (Delegated) label next to the account name. To filter the table, from the drop-down list, select Subscribers or Service Providers. You can also enter text in the Search box to filter the table for a specific account.

To edit an existing allocation, select an account in the table. To allocate users to an account, click Allocate Users. When you allocate a term user to an account, you can link the expiration date to the license, or specify an allocation expiration date.

If you manage delegated accounts, you can edit the allocation for delegated tier-1 Subscriber accounts only (these accounts purchase and activate their own license). You cannot edit allocations for other delegated accounts. The allocation for other delegated accounts is read only. To view the inventory for tier-n delegated accounts, select the account in Account Manager.

If you cancel a license or a license expires, there is a seven-day grace period before ThreatSync+ NDR is disabled. For more information on expiration, go to License Expiration.

Allocation Types

When Service Providers allocate users from a license to their managed accounts, they select an allocation type which specifies how the managed account can use the users .

Term Allocation

When you allocate users as a term allocation, the managed account can allocate a specific number of users to an account for a set duration or term from a term license or MSSP points.

Subscription Allocation

When you allocate users as a subscription allocation, the managed account can allocate a specific number of users or an unlimited number of users . WatchGuard bills the account monthly based on the number of active users .

Linked to License

When you allocate users as Linked to License, the quantity and expiration date of the allocated users are linked to the quantity and expiration date of your term license.

On the Allocation page, the table includes an Allocation Type column that can show Term, Subscription, or Linked to License. You can allocate multiple allocation types to a managed Service Provider account. For example, an account could have a term allocation and a subscription allocation.

Service Providers can activate licenses for delegated tier-1 Subscriber accounts. If the Subscriber account already has a term license for the same product, then an Allocation Owner column also displays in this table to help you differentiate the licenses. When you allocate users to a tier-1 Subscriber account that has already allocated users to itself, the users you allocate are added to the total number of users that the tier-1 Subscriber account has.

You cannot allocate users to a managed Service Provider account with the same allocation type as an existing allocation. If you set the allocation type for a managed Service Provider to be a term allocation, you cannot add another term allocation (instead, edit the existing term allocation and change the quantity).

As a tier-1 Service Provider, you cannot edit the allocation type for users with a term allocation. To change the allocation type, you must deallocate the users with term allocation, and then reallocate the users with a subscription allocation. Before you deallocate the users with term allocation, we strongly recommend that you contact your managed Service Providers to make sure that their accounts do not become overallocated.

When a tier-n Service Provider allocates users to a managed account with the Linked to License allocation type, the tier-1 Service Provider account cannot edit the allocation for the managed account.

Allocate Users to an Account

Service Providers can allocate users as term, Linked to License, or subscription.

If your Service Provider account has term and subscriptions licenses and the managed accounts with term allocations become overallocated, their management UI becomes unavailable. The accounts with subscription allocations are not affected.

To allocate users to an account:

1. Log in to your Service Provider account.
   The Overview page for your Service Provider inventory opens.

2. Select Inventory > ThreatSync+ NDR > Allocation.
3. From the drop-down menu select Subscribers or Service Providers, depending on the account type you want to allocate users to.
4. To edit an existing allocation for an account, in the table, select the name of the account you want to update.
5. If the account does not have any users allocated, click Allocate Users.
   

6. From the Account Name drop-down list, select the account you want to allocate users to.
7. From the Product drop-down list, select the product you want to allocate to the account.
   The number of unallocated users available in the license shows in the upper section of the page.
8. From the Allocation Type drop-down list, select Term, Subscription, or Linked to License.
   If you select Linked to License, then from the Licenses drop-down list, select the friendly name of the license you want to link the account allocation to.The license key, quantity, and expiration date of the product show in the blue box.
   
9. In the Quantity text box, type the number of users you want to allocate to the account.
   If you selected the Linked to License allocation type, the quantity and expiration date are automatically linked to the selected term license.

10. By default, the expiration date for the allocation is set to Never. To specify an expiration date, select Custom.
11. Select an allocation expiration date for all users (1 month, 3 months, or a year). You can also select a date in the calendar.
12. Click Save.

Caution: If you allocate an unlimited number of subscription users to an account, your Service Provider account could become overallocated. If this happens, you cannot access the ThreatSync+ NDR management UI. For more information, go to Overallocation.

Remove the License or Deallocate Users

When you remove a license, the number of allocated users becomes 0. After you remove a license, there is a seven-day grace period until ThreatSync+ NDR data is deleted. For more information, go to About ThreatSync+ NDR Licenses.

When you deallocate users, you remove users in an account. If your account becomes overallocated, you can no longer access the ThreatSync+ NDR management UI. Tier-1 Service Provider accounts can become overallocated when an account they manage allocates more users than there are available in the license. For more information, go to Overallocation.

To identify accounts that are over their limit, review Subscriber dashboards and audit logs. When an account is overallocated, we recommend that you reduce the number of allocated users (deallocate), or increase the number of users in the license.

To deallocate users :

1. From the Allocation table, select the account you want to deallocate users for.
   The Edit Allocation page opens.
2. To remove all users , in the Quantity text box, enter 0.
3. Click Save.

To remove a license:

1. From the Allocation table, next to the account you want to remove the license from, click and select Remove License.

2. In the confirmation dialog box, click Remove License.
   When there are no licenses, the account displays an Unlicensed label.

Related Topics

About ThreatSync+ NDR Licenses

Activate a ThreatSync+ NDR License