Cisco Umbrella DNS Security

[a-almoghrabi]

Hello,

I have a Cisco Umbrella DNS Security license for 200 users.

What happens if the number of active users exceeds the licensed count of 200 users?

Will Cisco Umbrella stop protecting additional users, generate a warning, or continue operating while reporting a license overconsumption?

I would appreciate clarification regarding how Cisco Umbrella handles this situation.

Thank you.

[Ken Stieers]

My experience was that I got emails about usage, not users. 

We had 5000 dns lookups per licensed user per day, and we started getting emails.

I found a few things that were noisy (Cisco Secure Client/NVM for one), and put them in the “internal domains” list and that cut down how many hits I was getting.

[a-almoghrabi]

Thanks

[Marvin Rhoads]

There's no cessation of protection as long as you have an active subscription. Cisco will eventually send you some "friendly reminder" emails if the usage remains above what's expected for the number of licensed users.

[a-almoghrabi]

Thanks bro 

[Philip D'Ath]

If you go to Admin/Licencing:

You can see your DNS query usage.

You are allowed to use 5,000 DNS queries per day per licensed user.  If you had 10 licenced users, you are allowed an average of 50,000 DNS queries per day.  After that, you can get a tap on the shoulder.
https://securitydocs.cisco.com/docs/umbrella-dns/gov/olh/154141.dita

[a-almoghrabi]

Thanks for the breakdown, bro!

To clarify my question: What happens if I have a license mismatch? If I buy licenses for 100 users but deploy it for 150 users, does the system strictly block the extra 50 users from working?

[Marvin Rhoads]

As I noted earlier, "There's no cessation of protection as long as you have an active subscription." 

You would be violating the terms and conditions of your End User Licensing Agreement however. That is a legally binding agreement.