Restrictions Tab

IT Asset Management (Cloud)

The following restriction controls can be defined on this tab:

For the majority of applicable licenses, use this tab to apply legal restrictions on where a license may be consumed.
For a small set of licenses, you may also limit the types of operating system where the license can be applied.
Link a report to a license to only allow inventory devices or users in that report to consume from that particular license. For example, you can link a report containing numerous Windows Server devices to a license, and subsequently that license will only allow computers in that report to consume against it. See here for more information.

Each of these is described separately below.

Note: Restrictions are not a form of assignment or prioritization. They never cause installations to preferentially consume from the restricted license. (Use individual allocations, group assignments, and license priorities to control the likely licenses from which an individual installation/user may consume.) Restrictions are simply a one-way exclusion: nothing outside the boundary may consume from the restricted license. The following example illustrates:

The full set of licenses for MyApp, in priority order	License A License For India (restricted to location India and its children) License C
An installation for a computer outside India sees only this list to choose from:	License A License C
An installation for a computer inside India sees the full list to choose from:	License A License For India (restricted to location India and its children) License C

The result is that both computers will consume from License A, while that has remaining capacity (the restriction did not change priority). If License A does not have remaining capacity, both installations choose their second priority licenses (License for India for the Indian computer, and License C for the one outside India).

If, instead, you want to enforce that computers in India should first consume from License For India, use group assignments. These change the priority ordering, but only for the target groups.

If you want both outcomes, that Indian computers consume from License For India and no one else may do so, use both group assignment and a restriction. The group assignment changes the priority (for the target groups) so that the example now becomes:

The full set of licenses for MyApp, in priority order (shown for a computer in India)	License For India (restricted to location India and its children, plus group assignment) License A License C
An installation for a computer outside India sees only this list to choose from:	License A License C
An installation for a computer inside India sees the full list to choose from:	License For India (restricted to location India and its children, plus group assignment) License A License C

Now, because the group assignment elevated the priority (for this group), Indian computers consume from License For India until it is exhausted, and then switch to License A. Because of the restriction, outside computers start consuming from License A.

Restrictions by geography or groups

Use the Restrictions tab to limit the consumption of this license strictly to the enterprise groups (and their descendents) that you specify.

Tip: If you specify more than one enterprise group, the restricted scope is treated as a logical-OR. For example, if you restrict a license to both your Australia location and your Switzerland location, then users and devices from either of these (or from any of their descendant groups) can consume from the license. This prevents you accidentally locking out all consumption of a license (since there would be very few devices simultaneously in both Australia and Switzerland, as required by a logical-AND). However, the use of a logical-OR means that you cannot specify an 'intersection' between different kinds of enterprise groups. For example, you cannot restrict a license to "the Chicago marketing team" by specifying location of Chicago and a cost center of Marketing. If you made those two settings, the license is accessible to anyone in Chicago (including the CEO and anyone else outside the marketing team) plus anyone in Marketing, worldwide.

The Restrictions tab is rarely used, as it should only reflect the occasional legal restrictions placed on license consumption. For example, some vendors allow heavily discounted license prices within specified African nations, on condition that the licensed software may not be operated outside the licensed country. You can track such restricted consumption by having an enterprise Location representing the correct geography, and then restricting the license to that Location. Only computers assigned to that location (or any of its descendents) are permitted to consume from the scoped license. (Of course, this does not restrict or detect the physical movement of the computer on which the software is installed, although you may be required by the terms of the license to separately track such movement.)

Tip: Do not use the Restrictions tab to enforce corporate accounting categories (such as the responsible cost center) on a license. Instead, use the Ownership tab for that purpose. As well, keep these legal restrictions separate from group assignment.

A scoping restriction takes effect only in the compliance calculation process. This means:

Any installations of the licensed application outside the scope defined on this tab do not consume from this license when FlexNet Manager Suite calculates license compliance. If there is an alternative license for the same application, the installations may be attributed to the alternative; otherwise look for them under License Compliance > Unlicensed Installations.
Because the restriction is only applied during calculations, you are not prevented from making either individual allocations or group assignments from this restricted license to groups outside its restricted scope. However, any installations related to those allocations or assignments outside the restricted scope of the license are ignored in compliance calculations — and an allocation also prevents the allocated computer/user consuming from any other license. You should look for any such installations under License Compliance > Unlicensed Installations. For a license with restrictions, then, be careful to apply allocations or assignments only to users within the same enterprise group(s).

Applying a group or location scope to a license is particularly useful for Enterprise, Site, and Device licenses. The tab offers a search to identify the enterprise group(s) to which this license should be restricted, and a list of existing restrictions. The columns available in the list are shown below.

Restrictions for User licenses

For most of the applicable license types, the restriction test is applied to the inventory device: that is, if a license is restricted to your location called London, it can be consumed only by inventory devices assigned to the London location (and its descendants). However, with the User license type, the group assignment of the inventory device is irrelevant; and instead, it is the group assignment of the individual user that is checked.

Remember: If an installation of User-licensed software is found on a device for which there is no associated user nor usage record, the installation itself counts as one user entitlement; and in the absence of any users to consider, the group assignment of this 'floating' device is still taken into account.

Tracking the group assignments of users can lead to two (or more) users, who use the same software installed on the same inventory device, consuming from different licenses. For example, suppose that user Lorraine is assigned to your London location, and she may therefore consume from a license with a restriction to London. However, a visitor Vicki hot-desks into the same machine and uses the same software; but because she is not assigned to London, she cannot consume from the London-restricted license. If, for the same software, there is a second User license that has no restrictions, Vicki can consume from that unrestricted license; or, if there is a license restricted to Victoria and Vicki is also assigned to the location Victoria, she can consume from that. If the software is licensable only by a User license, then apart from those two User license possibilities, Vicki cannot consume, and so you should look for her in the Unlicensed Installations page – even though your User license restricted to London may have spare capacity.

Special properties for IBM PVU licenses

When you are working with locations, and only when IT Asset Management is the source of truth for IBM PVU sub-capacity consumption calculations, the search fly-down includes an extra column for IBM region. This may help you select the appropriate location(s), since IBM regions are mapped through locations and affect the calculation of peak points consumption; and the peak points consumption over a reporting period determines your liability on an IBM PVU license. However, since the IBM region value has no direct bearing on license restrictions, this column is not displayed in the listing of selected groups (below the search fly-down).

Remember: Do not use restrictions on this tab to limit consumption to inventory devices within one of the IBM regions. The principle is to have a single license for each IBM product (or a single multi-product license for each bundle) worldwide. IT Asset Management uses the ownership of inventory devices by locations to roll up points consumed into each of the mandatory IBM regions. For more detailed information, see the topic Configuring Regions for IBM in the IT Asset Management System Reference, available at https://docs.flexera.com/.

Limitations on restrictions

The Restrictions tab is available for many license types, but is not available for the following license types:

CAL Legacy
IBM Authorized User
IBM Concurrent User
IBM Floating User
Named User
Node Locked
OEM
Oracle Legacy
Tiered Device.

Restrictions by operating system

Attention: When applying a restriction by operating system, only operating systems that are locally installed on a device are considered when applying the restriction.

Certain license types, notably from Microsoft, can be consumed only for applications running on certain kinds of operating system. For the following license types, an additional field called Restrict to OS is displayed:

Microsoft Server Processor
Microsoft SCCM Client Device (read only value: Non Windows Server)
Microsoft SCCM Client User (read only value: Non Windows Server).
Microsoft Server Core
Microsoft Server/Management Core

For the Microsoft Server Processor license type, you may select one of four options:

All — No restriction is applied, and an application installed on any type of operating system may consume from this license.
Non Windows Server — This means the license may be consumed on any kind of Microsoft operating system other than a Windows Server. This value is typically applied only to Microsoft Client Management Licenses, either for users or devices, which are here given the license types Microsoft SCCM Client Device and Microsoft SCCM Client User (and have the value fixed).
Windows desktop — With this restriction, the license may be consumed for any applications installed on Microsoft desktop or mobile operating systems, but not on any Windows Server operating system.
Windows Server — With this restriction, the license may be consumed only by applications installed on a Microsoft Windows Server operating system.

Any restrictions you apply with this control take effect from the next compliance calculation.

Link a report to a license to only allow inventory devices or users in that report to consume from that license

In order to do this, a new report needs to be created. For existing reports, the starting object will need to be updated. Read on for more information.

Important: When configuring a new report, depending on what type of license you want to link the report to, the starting object of the report needs to be either Inventory device for device based licenses, or User for user based licenses.

In the Report Builder, if you inserted Inventory device or User more than once, only the devices or users from the initial Inventory device or Users columns will be in scope for consuming against the license.

Once you have added the starting object (either Inventory device or User), you can then add further objects to build out your report. The report is highly customizable, allowing you to add whatever objects you want to it. For example, for inventory device reports, you may want to add a cloud instance, followed by a filter applied to that cloud instance stipulating that only specific devices are allowed on this report, such as Windows devices.

Prior to saving the new report, select the Public permission. Private reports cannot be linked to licenses as they would not be visible to other operators.

Important: On saving an existing report, if you have made any changes resulting in the report becoming incompatible with the license that it's linked to (for example, changed the report to be based off of users when it was initially created for devices), you will be prompted that the restrictions applied to the linked license will no longer be applicable.

Linking a report to a license

Note: Not all license types support restrictions. For example, the Named user license does not support restrictions and therefore does not have a Restrictions tab in License Properties.

Also, some types of user based licenses, such as the "User" license, supports allocating both users and devices. In the case of applying the linked report restriction to the "User" license, any devices that are allocated in that license will not be allowed to consume. This is because the linked report restriction only allows users in that report to consume against the license.

To link a report to a license, navigate to License Properties for a license that supports restrictions, select the Restrictions tab, and then under Report restrictions select a report from the Device Group or User Group box.

On clicking the Search button, reports relevant to the type of license will populate the list. If it's a device based license, then you will only see public reports starting with Inventory device, and if it's a user based license, then you will only see public reports starting with User.

To add the report, select Add report and Save.

Entitlements under this license can be consumed only by devices or users which are returned in the linked report. If no report is linked, the license may apply throughout the enterprise.

Important: This linked report restriction applies in addition to other restrictions defined on the license. For example, if a location group restriction and a report have been linked to a license. Then that device or user would need to be located in the specified location and also included on the report, in order to consume against the license.

IT Asset Management (Cloud)

Current