AWS license-manager documentation change
Summary
Restructured documentation by removing detailed billing scenarios for RDS subscriptions and moving disassociate/unsubscribe procedures to dedicated pages. Added product-specific clarifications (Microsoft Office/Visual Studio) throughout.
Security assessment
Changes focus on clarifying proper user access management procedures to prevent unauthorized access, but no specific security vulnerability is mentioned. The added documentation emphasizes security best practices for access control.
Diff
diff --git a/license-manager/latest/userguide/usubs-manage-users.md b/license-manager/latest/userguide/usubs-manage-users.md index 51e6386ed..4abafaafa 100644 --- a//license-manager/latest/userguide/usubs-manage-users.md +++ b//license-manager/latest/userguide/usubs-manage-users.md @@ -5,2 +4,0 @@ -Subscription charges in License ManagerDisassociate users from an instanceUnsubscribe users - @@ -9 +7 @@ Subscription charges in License ManagerDisassociate users from an instanceUnsubs -To ensure the accuracy of billing and reporting for product subscriptions, and to prevent unauthorized access to subscription resources, you can manage user access for License Manager user-based subscriptions as follows. +To ensure the accuracy of billing and reporting for Microsoft Office and Visual Studio product subscriptions in License Manager, and to prevent unauthorized access to subscription resources, you can manage user access as follows. @@ -11 +9 @@ To ensure the accuracy of billing and reporting for product subscriptions, and t -Disassociate users from an instance +[Disassociate users from an instance](./usubs-disassociate-users.html) @@ -14 +12 @@ Disassociate users from an instance -Disassociate a user from an instance that hosts a License Manager user-based subscription to remove access to the resource. +Disassociate a user from an instance that hosts a License Manager user-based Microsoft Office or Visual Studio product subscription to remove access to the resource. @@ -16 +14 @@ Disassociate a user from an instance that hosts a License Manager user-based sub -Unsubscribe users +[Unsubscribe users](./usubs-unsubscribe-users.html) @@ -19 +17 @@ Unsubscribe users -Unsubscribe users from user-based subscriptions in AWS License Manager to stop incurring subscription charges for those individuals. +Unsubscribe users from user-based Microsoft Office or Visual Studio product subscriptions in AWS License Manager to stop incurring subscription charges for those individuals. @@ -23 +21 @@ Unsubscribe users from user-based subscriptions in AWS License Manager to stop i -Deleting a user from Active Directory will not alter user associations or subscriptions. You must disassociate the user in License Manager from the subscription product details page to remove their association with an instance. Then you must unsubscribe the user. +Deleting a user from Active Directory will not alter user associations or subscriptions for Microsoft Office and Visual Studio products. You must disassociate the user in License Manager from the subscription product details page to remove their association with an instance. Then you must unsubscribe the user. @@ -27,61 +25 @@ This topic does not cover Active Directory administration. -## Subscription charges in License Manager - -Subscription and billing in License Manager varies based on the subscription product that's used. - -**Microsoft Office and Visual Studio subscriptions** - - -For Microsoft Office and Visual Studio subscriptions, billing stops as soon as you have disassociated the user from all instances that provide the subscription product, and unsubscribed them from the product. - -**Microsoft Remote Desktop Services (RDS) subscriptions** - - -Microsoft RDS is billed on a per user, per month basis based on a combination of the user subscription and the client access license (CAL) token that's issued from the license server when the user connects to an instance that provides the subscription product. - -### Microsoft RDS billing in License Manager - -Microsoft RDS billing begins when the Active Directory user is subscribed through License Manager, and ends after the client access license (CAL) token expires, 60 days from the date it's issued, with no proration for partial months. Billing continues until the token expires, even if you unsubscribe the user. - -###### Note - -If an unsubscribed user continues to log in after the license token expires, they are automatically re-subscribed, and billing continues until they are again unsubscribed and their token expires. - -Similarly, if a user who has never subscribed, but logs into an instance that is associated with the license server, License Manager automatically subscribes them and begins RDS billing. Billing continues until they are unsubscribed and their token expires. - -To stop billing for a user at the end of the current month, after you disassociate and unsubscribe the user, you must also remove that user from the Active Directory that's configured for the license server. - -The following example scenarios demonstrate how RDS billing works. - -The following scenario shows a standard set of actions that affect billing for an Active Directory (AD) user who is subscribed on 12/15/2024, but never accesses a subscription instance. - -_Action:_ If the user never unsubscribes, billing continues indefinitely. - -AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends ----|---|---|---|---|---|--- -12/15/2024 | 12/15/2024 | \-- | N/A | \-- | \-- | \-- - -_Action:_ The user is unsubscribed on 1/15/2025. - -AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends ----|---|---|---|---|---|--- -12/15/2024 | 12/15/2024 | \-- | N/A | `1/15/2025` | `No` | `1/31/2025` - -The following scenario shows how the license token expiration affects the user subscription for an Active Directory (AD) user who is subscribed on 9/15/2024 and logs into a domain-joined subscription product instance the same day. - -_Action:_ Initial subscription and login for AD user. - -AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends ----|---|---|---|---|---|--- -9/15/2024 | 9/15/2024 | 9/15/2024 | 11/15/2024 | \-- | \-- | \-- - -_Action:_ The same AD user is unsubscribed on 10/19/2024. However, since the user wasn't removed from the directory, billing continues until the end of the month during which the license token expires. - -AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends ----|---|---|---|---|---|--- -9/15/2024 | 9/15/2024 | 9/15/2024 | 11/15/2024 | `10/19/2024` | \-- | `11/30/2024` - -_Action:_ After unsubscribing the AD user, the AD administrator removes the user from the directory on 10/20/2024. In this case, billing stops at the end of the month during which the user is removed from the directory. - -AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends ----|---|---|---|---|---|--- -9/15/2024 | 9/15/2024 | 9/15/2024 | 11/15/2024 | 10/19/2024 | `10/20/2024` | `10/31/2024` +###### Contents @@ -89 +27 @@ AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscrib -The following scenario shows how an unsubscribed Active Directory (AD) user whose license token has expired is automatically resubscribed when they access a domain-joined subscription product instance. + * [Disassociate users from an instance](./usubs-disassociate-users.html) @@ -91,62 +29 @@ The following scenario shows how an unsubscribed Active Directory (AD) user whos -_Action:_ Initial subscription and login for AD user. - -AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends ----|---|---|---|---|---|--- -9/15/2024 | 9/15/2024 | 9/15/2024 | 11/15/2024 | \-- | \-- | \-- - -_Action:_ The same AD user is unsubscribed on 10/19/2024. However, since the user wasn't removed from the directory, billing continues until the end of the month during which the license token expires. - -AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends ----|---|---|---|---|---|--- -9/15/2024 | 9/15/2024 | 9/15/2024 | 11/15/2024 | `10/19/2024` | \-- | `11/30/2024` - -_Action:_ The same AD user accesses a domain-joined subscription product instance after their previous license token expires but before billing ends. Billing continues until the user is unsubscribed again and their new token expires. - -AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends ----|---|---|---|---|---|--- -`11/20/2024 (re-subscribed)` | `billing continues` | `11/20/2024` | `1/20/2025` | \-- | \-- | \-- - -The following scenario shows how an Active Directory (AD) user who was never subscribed to RDS SAL is automatically subscribed when they log into a domain-joined subscription product instance. - -_Action:_ An AD user who was never subscribed to RDS SAL logs into a domain-joined subscription product instance on 9/15/2024, and is auto-subscribed. Billing begins, and continues until the user is unsubscribed and their new token expires. - -AD user subscribed | Billing starts | CAL issued | CAL expires | User unsubscribed | User removed from AD | Billing ends ----|---|---|---|---|---|--- -9/15/2024 (auto-subscribed) | 9/15/2024 | 9/15/2024 | 11/15/2024 | \-- | \-- | \-- - -For more information about how Microsoft RDS per user CALs work, see the **Per User CALs** section in the [License your Remote Desktop deployment](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-client-access-license) article on the _Microsoft Learn_ website. - -## Disassociate users from an instance that provides user-based subscriptions - -To remove user access to an instance that provides License Manager user-based subscriptions, you can disassociate the subscribed user from that instance. This change does not affect the user's subscription status. To unsubscribe a user and stop subscription charges for that individual, see Unsubscribe users from user-based subscriptions in License Manager. - -###### Disassociate subscription users from an instance - - 1. Open the License Manager console at [https://console.aws.amazon.com/license-manager/](https://console.aws.amazon.com/license-manager/). - - 2. In the left navigation pane, under **User-based subscriptions** , choose **User association**. - - 3. Select the instance that you want to disassociate users from. - - 4. Select the user names to disassociate, then choose **Disassociate users**. - - - - -## Unsubscribe users from user-based subscriptions in License Manager - -You must unsubscribe a user from user-based subscription products to stop incurring charges for them. - -###### Important - -You must first disassociate the user from all instances where they are currently associated before you can unsubscribe them. - -###### To unsubscribe users from user-based subscriptions - - 1. Open the License Manager console at [https://console.aws.amazon.com/license-manager/](https://console.aws.amazon.com/license-manager/). - - 2. In the left navigation pane, under **User-based subscriptions** , choose **Products**. - - 3. Select the product that you want to unsubscribe users from. - - 4. Select the user names to unsubscribe, then choose **Unsubscribe users**. + * [Unsubscribe users](./usubs-unsubscribe-users.html) @@ -165 +42 @@ Modify firewall settings for Microsoft Office -Deregister Active Directory +Disassociate users from an instance