Libraesva ESG License Accounting

Licensing Models

Email Address accounting model

The ESG accounting system is based on active recipient (or sender) addresses, which includes all email address that have successfully received (or sent) a scanned email. Extra automatic measures have been put in place to avoid paying for invalid email addresses.

The list of active recipients is created by searching for messages that have been successfully delivered from or to a configured relayed in "Admin > Mail Transport > Relay". This means that bounced deliveries or rejected emails are not accounted for.

Once a recipient is accounted for, it will remain accounted for until it naturally expires after 30 days of inactivity or is invalidated due to configuration control. For instance, if a configured relay use a "valid recipient list" to verify currently enabled email addresses, a license will automatically expire when its address is removed from the list.

The accounting process occurs every night but can be re-computed at will from the web UI.

Mailbox accounting model

Depending on your commercial agreement with LibraCyber, your licensing may be mailbox based.

The mailbox accounting model uses the same rule as recipient accounting to identify actively used recipient addresses. Once recipients have been collected, the system determines the active mailboxes by using the information available in ESG user manager (found under "Admin > Authentication > User Management > User"). The active mailbox appears in the list as "type = mailbox" with the user's primary address listed as the accounted address.

Mailbox accounting typically results in a lower license count as distribution lists and user secondary emails are immediately excluded from the computation. However, there may be exceptions to this rule, such as when a user receives email only through distribution lists. In this case, the user is considered active, even if their primary address is never used.

Starting with ESG 5.2, there is a new type of user called a "Functional User" that is not accounted for in mailbox licensing. These users can only be created automatically by the importer from Microsoft 365, Google Workspace, or LDAP and represent Shared Mailboxes or Groups that are not bound to any users. Functional users cannot log into ESG and have limited quarantine capabilities, just like the account in external environments.

NOTE: mailbox accounting is very precise in identifying active users, but requires administrators to properly manage users and integration layers. Please refer to the following paragraphs for additional details.

Licensing knowledge base

What are license types listed on license usage?

When accessing "Admin > Appliance > Licensing > License Usage," you may notice a "type" column in addition to the accounted license.

A license of type Recipient identifies a simple active recipient that is accounted for and is not bound to any user stored on ESG. Since this is an active recipient, it is accounted for in all licensing models.

A license of type Mailbox identifies an accounted active mailbox, and the email shown is the primary (and unique) address of the user. If your license model is simply recipient-based, this is exactly the same as a recipient license for a user's primary address. For mailbox accounting, this refers to an active user who has received at least one email to their inbox; to find details about which email they received, open the detailed view to see user information and quickly search the mail logs for hints.

A license of type Free identifies an accounted active mailbox or recipient address that has been discounted by LibraCyber ESG, either manually from Accounting support or remotely using code automation. These are not accounted for in final costs but are listed for transparency.

How can I configure email aliases as in ESG before 5.2

Starting with LibraCyber ESG 5.2, users have a primary and globally unique address that is used for domain attribution and license accounting. The concept of email aliases is no longer used. Instead, users may have one or more secondary addresses for the same mailbox.

The old email alias concept is similar to the new secondary email address system. However, the previous implementation had a long list of heuristics to discriminate an address from an alias, that were imprecise and not clearly visible from the user interface.

Our testing of the new licensing system has shown that it can identify mailboxes much better thanks to the user integration layer, configured by the administrators. This has resulted in lower average license accounting.

A note on Microsoft Shared Mailboxes on hybrid configuration

The Microsoft 365 integration layer has the capability to differentiate between real users and shared mailboxes by analyzing the licenses assigned to external users. Users without licenses are imported as "Functional users" in LibraCyber ESG, ensuring that both software have the same licensing.

However, the hybrid configuration can be more complicated due to the limited API provided by Microsoft. Even actual mailboxes may not have assigned licenses. To address this limitation, for synchronized hybrid users without licenses, we utilize the accountEnabled user property to distinguish between "Users" and "Functional Users".

As a result, there may be slight differences in accounting between ESG licensing and Microsoft Exchange licensing. To minimize this disparity, it is recommended that Hybrid Shared Mailboxes be configured with accountEnabled = $FALSE.

Maintenance of users when using an external integration

Mailbox accounting is much more precise when used in conjunction with external user imports, such as Microsoft 365, Google Workspace, and LDAP. However, these importers do not automatically remove mailboxes or valid recipients for security and stability reasons. Therefore, periodic maintenance is crucial, especially a few days before your next licensing cycle.

To make maintenance easier, here are a few helpful tips:

1. Ensure that all relays listed under "Admin > Mail Transport > Relays > Relays" are using the "Valid Recipient List" as the recipient verification method. Other methods may incur higher costs if an invalid address is mistakenly accepted by your server.
2. Access "Admin > Mail Transport > Valid Recipients > Cleanup Old Import" and delete any email addresses that are no longer updated by your configured external sets. If you manually import, ensure you execute all imports at least once before proceeding.
3. Access "Admin > Authentication > User Management > Cleanup Old Import" and remove any users that are no longer updated by your configured external sets. If you manually import, ensure you execute all imports at least once before proceeding.
4. Starting with ESG 5.2, the LDAP integration layers now support Group management, which allows for the assignment of group emails as a user's secondary address. Ensure your old configuration is updated accordingly.
5. If you come across any licenses that you do not recognize, access the detailed view for that license and click on recipient addresses to swiftly search for the accounted email. If you find any email that you do not want to receive or scan, take the appropriate action on the Web UI. This may include disabling a user's secondary email or updating your LDAP configuration.

If you have any additional queries or concerns, please contact our Customer Support for further assistance and information.