AI Access Security licensing – concurrent users or named users?

[A.Jaramillo129558]

Hello everyone,

We recently purchased an AI Access Security license for a PA-440 firewall with 100 users.
However, the customer has 140 real users in their environment.

I would like to understand how the license assignment works:

• Is the license based on concurrent users?

• Or is it assigned to the first 100 users that authenticate/connect?

• What happens when user 101–140 try to access AI applications?

• Is there any visibility or alert when the user limit is reached?

Any clarification on how user licensing is enforced would be greatly appreciated.

Thank you in advance.

[JayGolf · Accepted solution]

Hi @A.Jaramillo129558 ,

AI Access Security is licensed per user per year, not based on concurrent usage. A “user” refers to an employee or contractor in the organization, and licensing is intended to cover the total potential user population, not just whoever happens to be accessing AI apps at a given moment.

If more users exist than are licensed (for example, 140 users with a 100-user license), the platform can still provide visibility into GenAI usage, including allowed and blocked activity. 

For best practice, the quantity licensed should be equal to the greatest number of users who are licensed for a sanctioned SaaS application in your org. 

Hope this helps!