Set entitlement policies

Policies decide how an entitlement may be activated and for how long. You set them on an entitlement’s Policies tab (or capture them in an offer so every grant inherits them). They combine — a grant can be, say, a subscription with floating seats and a trial.

Seat allocation

How many devices or users may run at once, and how a seat is held.

• Maximum activations — the seat counter for the entitlement: how many devices may hold a license at once.
• Fixed vs. floating seats — fixed pins a seat to a device; floating lets devices take and release seats from a pool. A floating seat comes back when the application closes or the lease expires. Prefer floating on virtual machines: each activation counts separately even from an identical fingerprint, so each new VM copy consumes a fixed seat, even for the same person.
• Allow offline activation — lets you activate a machine that cannot connect: the customer sends a request file and you return a signed response from the Offline activation page. It is off by default, and an entitlement made from an offer takes the offer’s setting. While it is off, those requests are refused. Online activation is not affected. Combining it with floating seats has a cost: an offline device cannot return its seat, so the pool never learns it is free again.
• Lease — how long an activated session is valid before it must check in to renew. A perpetual license can still carry a lease, to force a periodic check-in.
• License grace period — how long a license stays usable past the entitlement’s expiry, so a customer isn’t cut off as soon as a term lapses. It extends the entitlement’s validity, not the lease — it has nothing to do with connectivity.

To change the seat count on a live entitlement, use Add Seats rather than editing the policy directly — see Renewals, credits & activations.

Activation

Who — and from where — may redeem this grant.

• Required authentication level — Anonymous (a code alone is enough), IdentityVerification (the redeemer must confirm an email-verification link), or IdentityProvider (the redeemer must sign in).
• IP allow-list — an IPv4 CIDR list; when set, activation is refused from any address outside it. The list fails closed: an entry that can’t be parsed blocks activation rather than letting it pass.
• Organization membership — optionally require the activating user to belong to the entitlement’s customer organization.
• Pre-registered devices — optionally allow activation only from devices you’ve registered in advance, on the entitlement’s Devices tab.

Plan changes

Whether a customer’s plan-change request needs a person to approve it. The default is RequireApproval — requests are held in the plan requests queue until decided. Switch to AutoApprove where self-serve moves are fine; a request row is still recorded for the audit trail.

Trial

A trial window that can start on grant or on first activation. Pair it with a subscription so a customer moves from trial to paid automatically. While in trial, the entitlement’s subscription status reads Trialing.

Time-restricted

Valid between two dates, or for a fixed period after first use. Good for time-boxed licenses, evaluations and event passes. Outside the window the license is Expired.

Not valid before and not valid after both default to not set, so a policy with only a duration is valid from whenever the customer first activates it.

The dates you pick are whole days in UTC: not valid before starts at the beginning of its day, and not valid after ends at the end of it. The period after first use ends at the end of a UTC day too, the day on which it runs out: 30 days from a first activation at 14:37 UTC on 1 March runs to the end of 31 March, UTC. The customer keeps the rest of that last day, up to a day more than the period itself, and a period of a few hours lasts to the end of the day it runs out on. When not valid after comes before the end of the period, the license ends then instead.

Allowed activation hours

Optionally, a recurring window on top of the dates: days of the week plus a daily open and close time, in a time zone you choose (empty means UTC). “Office hours” licensing — Mon–Fri 08:00–18:00 Europe/Stockholm.

• Activation outside the window is refused, and no seat is consumed.
• A license activated inside it expires when the window closes, and activates again in the next one. Your application needs no change: it already honours the license’s validity.
• A window whose close time is earlier than its open time spans midnight — 22:00–06:00 is the night shift — and belongs to the day it opens on, so a Friday night shift needs Friday selected, not Saturday.
• Days without times means those whole days; times without days means those hours every day.
• Leave it empty for a date-only restriction.

The time zone is what keeps “08:00–18:00” meaning the same thing to your customer across a daylight-saving change.

Subscription

Recurring periods with renewal and expiry. It can start now, or start itself on the customer’s first activation — useful when the grant is issued before anyone uses it. The renewal unit is a second, day, month or year, with up to 1200 periods per subscription. The subscription status (Active, Paused, Expired, Canceled) is computed from these dates and surfaced on the entitlement; renewals extend the current period — see Renewals, credits & activations.

When Stripe bills an entitlement as a subscription, Stripe decides when it ends, so neither that entitlement nor an offer billed that way takes a subscription policy or a time restriction with an end date; set its billing to managed by vendor to keep a renewal schedule of your own. An end date the entitlement already had when Stripe started billing it stays on the entitlement, but it no longer ends the license: the license ends when the Stripe subscription does.

Anonymous try

Opens an offer to visitors who have no account at all: the first request from a device earns that device its own short-lived licence, and the same one comes back while it lasts. It is set on the offer, not on an entitlement — the offer is what a visitor reaches — so you turn it on where the offer is authored rather than per grant.

How the licence behaves once issued, and what a visitor sees when the offer’s limits are reached, is on Try activation.

Activation-key format

The format of the codes themselves — prefix, sequence number, check character — is a policy of its own, with batch generation (up to 5000 codes per batch) and import. It has its own page: Key formats and batches.

How policies show up at runtime

Policies don’t act alone — they’re snapshotted into the session at activation, alongside the entitled features and the applied plan. The running license carries its own lease, trial and grace bounds, and the device checks in to renew the lease and checks out to release a floating seat. See Activation & sessions for the device side.

Next

• Issue the grant → Author & publish entitlements
• The model in depth → Entitlements & offers