> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/administration/manage-licenses.md).

# Manage Licenses

Material lists every account in your Google Workspace or Microsoft 365 tenant. Only licensed accounts sync data, receive protections, and count toward your license usage.

You choose which accounts get a license. Use this page to understand how licenses are assigned, check which accounts are using one, and change who gets a license.

## How licenses work

Licenses are an account setting, so they follow the same [settings hierarchy](/administration/settings-hierarchy.md) as your other account settings. You can assign a license at the global, tenant[^1], group, or account level, and each level inherits from the level above it unless you set a custom value.

Each account has two license settings:

| Setting                                                                   | Options                                   | What it does                                                                                                     |
| ------------------------------------------------------------------------- | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| [**Material Essentials and Advanced**](https://material.security/pricing) | **Essentials**, **Advanced**, or **None** | Sets which Material features are available to the account. An account can have Essentials or Advanced, not both. |
| [**ATO Resilience**](https://material.security/pricing)                   | **On** or **off**                         | Adds features that detect, respond to, and mitigate account takeovers.                                           |

Options that aren't included in your contract may appear in the list but can't be selected.

### The default license assignment

By default, the license you purchased is set in **Default Account Settings** at the Global level (or at the tenant level if you're on a shared instance). That means every account in your tenant gets a license automatically, including new accounts as they're created in Google or Microsoft. This ensures new accounts are protected without you having to take any action in Material.

To view your default license assignment:

1. From the top bar, click **Settings**, then click **Default Account Settings**.
2. Review the **Licenses** section.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FuROAYHx9jHT9uKetZdiK%2Fimage.png?alt=media&amp;token=9c26c860-4f88-43cb-83cc-cf5c946cc998" alt="" width="563"><figcaption></figcaption></figure>

***

## Review your license usage in Material

If your license usage is higher than you expect, start by finding the accounts that count toward your usage.

<details>

<summary><strong>View a summary on the Usage page</strong></summary>

1. From the top bar, click **Settings**, then click **Usage**.
2. Under **Account Settings**, review the **How are licenses assigned?** chart. Hover over a bar to see the number of accounts with each license.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FHbm94lFaU38m2gGzm24K%2Fimage.png?alt=media&amp;token=34098e36-24c1-47f6-8a3a-7e1fc82e889b" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary><strong>Find the accounts that count toward your usage</strong></summary>

To see the list of active accounts with a license:

1. From the left navigation, expand **Explorer** then click **Accounts**.
2. Confirm the **Provider Status** is **Active** filter is applie&#x64;**.** Suspended, deleted, and archived accounts can show a license in Material, but they don't count toward your usage.
3. Add the filter **Active Features** > **Licenses**.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FMpKe7xgNXUI5z7MrdUJt%2Fimage.png?alt=media&amp;token=c3e19021-6eab-47b5-8305-27eaf54214b2" alt="" width="375"><figcaption><p>The account count displays on top</p></figcaption></figure>

If you have more than one tenant, you can also see the number of licensed accounts in each tenant. From the left navigation, expand **Explorer**, then click **Tenants**, and review the **Licensed Accounts** column:

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FBLaAfVzSfswG19rT20k3%2Fimage.png?alt=media&amp;token=75457fb9-e9b7-4a49-8f68-a5153e6dab77" alt=""><figcaption></figcaption></figure>

To compare your accounts in a spreadsheet, click **Export as CSV** after you apply your filters. Use the `Connection` column: `Connected` means the account has a license. You can export up to 20,000 accounts at a time. If you have more, apply filters to narrow the list, then export each set.

</details>

{% hint style="info" %}
If needed, compare this list with the account lists in Google Workspace or Microsoft 365.
{% endhint %}

***

## Manage your license usage

Material protects more than email: it also covers file security, posture management, and account takeover detection. That's why accounts without a mailbox get a license by default. However, you can change this behavior.

Once you know [which accounts are using a license](#review-your-license-usage-in-material), decide whether they all need protection.

{% hint style="danger" %}
Setting an account's license to **None** disconnects Material from that account entirely. If Sensitive Email Redaction or ATO Resilience is on for the account, restore its messages to the mailbox **before** you remove the license. If you don't, you can lose access to those messages.

Follow the steps in [Off-board Users](/administration/off-board-users.md) to remove a license safely.
{% endhint %}

If you don't need coverage for every account, you can change who gets a license in a few ways:

<details>

<summary>Exclude accounts without a mailbox</summary>

[In Settings](#the-default-license-assignment), turn on **Require mailbox for license assignment** so Material only assigns a license to accounts that have a mailbox in Google or Microsoft. When it's on, accounts without a mailbox don't get a license, regardless of the Licensing settings.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FONcaBEIyMK4CsETLvynu%2Fimage.png?alt=media&amp;token=2d363396-4c01-4bd9-97b3-b85cc77418be" alt="" width="375"><figcaption><p>Settings > Default Account Settings</p></figcaption></figure>

</details>

<details>

<summary>Exclude accounts from receiving licenses using groups</summary>

Instead of assigning a license to every account, you can exclude members of specific groups.

To exclude the license per group:

1. Confirm your [Global license is set to your preferred choice for defaults](#the-default-license-assignment).
2. From the left navigation, expand **Explorer** then click **Groups.**
3. Select the group(s).
4. From the bottom toolbar (or using **⌘K**), click **Edit Group Settings**.
5. Under **Licenses**, select **Override** then **None**
6. Click **Save**.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FTThJJp3eI0VpX28YajoE%2Fimage.png?alt=media&amp;token=079cd013-9852-42df-b6af-757355fc168e" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
To manage licenses exclusively by adding them to groups, you can set your default license to none. **However**, assign the license to the group before you change your default to **None**. If you change the default first, accounts outside any licensed group lose their license and Material disconnects from them. Review [how to remove a license safely](#manage-your-license-usage) first.
{% endhint %}

</details>

<details>

<summary>Assign licenses to accounts using groups</summary>

Instead of assigning a license to every account in the Default Account Settings, you can assign one only to accounts in designated groups.

To assign the license per group:

1. From the left navigation, expand **Explorer** then click **Groups.**
2. Select the group(s).
3. From the bottom toolbar (or using **⌘K**), click **Edit Group Settings**.
4. Under **Licenses**, select **Override** then the license you want to apply to this group
5. Click **Save**.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FTThJJp3eI0VpX28YajoE%2Fimage.png?alt=media&amp;token=079cd013-9852-42df-b6af-757355fc168e" alt=""><figcaption></figcaption></figure>

6. Set the Global default setting to **None**. See the [default license assignment](#the-default-license-assignment) above.

{% hint style="warning" %}
To manage licenses exclusively by adding them to groups, you can set your default license to none. **However**, assign the license to the group before you change your default to **None**. If you change the default first, accounts outside any licensed group lose their license and Material disconnects from them. Review [how to remove a license safely](#manage-your-license-usage) first.
{% endhint %}

</details>

<details>

<summary>Remove the license from specific accounts</summary>

For a small set of accounts, such as a few shared mailboxes or service accounts, remove the license from each account directly.

1. From the left navigation, expand **Explorer** then click **Accounts**.
2. From the bottom toolbar (or using **⌘K**), click **Edit Settings**.
3. Under **Licenses**, select **Override Material Essentials and Advanced**, then select **None**.
4. If the account has ATO Resilience, turn **ATO Resilience** off.

</details>

[^1]: for dedicated instances that support multiple tenants


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.material.security/administration/manage-licenses.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.