What Happens When a Carbon Black Cloud License Expires

Products

• Carbon Black Cloud Audit and Remediation
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Managed Detection and Response
• Carbon Black Cloud Managed Threat Hunting
• Carbon Black Cloud Workload

Issue/Introduction

What happens when a Carbon Black Cloud license expires?

Environment

• Carbon Black Cloud Console: All versions

Resolution

Stage 1: Grace Period

• Upon expiration, your Carbon Black Cloud organization will enter a 30-day renewal grace period. During this time, you will maintain uninterrupted access to all services and data, and you can still renew your subscription. A notification banner will appear in the console UI to track the exact end date of this window.

• • If you believe your license has not expired and this banner is visible:
    1. Confirm you have followed the Tenant Hold Process
    2. Open a Non-Technical case to have your license validated.
       • If a valid license is not found you may be asked to contact your Account Director, Catalyst Partner, or Reseller
  • If you believe your license has expired, but this banner is not visible:
    • This means that there has been a mistake with the automated decommissioning process and the org is not currently marked for removal. A manual audit will catch any orgs that have not yet been marked. See How To Request a Carbon Black Cloud Org be Decommissioned OR contact your Account Director, Catalyst Partner, or Reseller for renewal. 

Stage 2: Waiting Period

• If your product license is not renewed by the end of the renewal grace period, your services will enter a 30-day waiting period. During this phase, you will lose access to all services and data, and the console will attempt to switch all sensors into bypass mode. Your data is preserved with the exception of any data that exceeds your data retention limits. Your data will continue to be deleted over time, according to your data retention settings. You can still renew your subscription to regain access.

Stage 3: Decommission / Deletion

• If your product license is not renewed by the end of the waiting period, all data will be deleted and all sensors will be marked for deregistration (uninstall). This deletion is permanent, and your Org cannot be recovered at this point.

Additional Information

• Any sensors that do not receive the automated deregistration request must be uninstalled manually. If the "Require code to uninstall sensor" setting was enabled in the asset's policy, you will need the company deregistration code to complete the uninstallation. To find your company deregistration code before the organization is deleted, see Require Codes to uninstall Sensors at an Endpoint.
• Some add-on features, such as Managed Detection and Response or Extended Detection and Response (XDR), can expire individually and stop functioning even though the base features such as Endpoint Standard or Enterprise EDR continue to function.