# KeeperPAM Licensing

## KeeperPAM Licensing Requirements

In order to enable and use KeeperPAM, the following are required:

* [KeeperPAM](https://www.keepersecurity.com/privileged-access-management/) License or..
* [Keeper Business](https://www.keepersecurity.com/business.html) or [Keeper Enterprise](https://www.keepersecurity.com/enterprise.html) license with [Privileged Access Manager Add-On](https://www.keepersecurity.com/privileged-access-management/)

### Trial License

If you are not a Keeper customer or do not have the required license, you can start a [free KeeperPAM trial](https://www.keepersecurity.com/trial/pam-free-trial/).

## Features Included with KeeperPAM

With the purchase of the Privileged Access Manager add-on, the following features are included:

* Secrets Manager with Unlimited API Calls
* Unlimited Password Rotations
* Unlimited Privileged Sessions / Connections
* Unlimited Tunnels
* Unlimited Remote Browser Isolation
* Session Recordings and Playback
* Discovery
* Keeper Connection Manager (Self-Hosted)
* PAM Audit and Reporting

#### What is the difference between KeeperPAM and Keeper Connection Manager (Self-Hosted)?

KeeperPAM is a cloud-native privileged access solution that requires only a lightweight gateway installation, while Keeper Connection Manager (KCM) is a fully self-hosted solution. For more information, visit this [page](https://docs.keeper.io/keeperpam#keeperpam-vs.-kcm).

## KeeperPAM License Model

The KeeperPAM add-on license includes all the advanced PAM Features. The number of licenses for the enterprise license and the KeeperPAM license is based on:

<table><thead><tr><th width="311">License Type</th><th>License Model</th></tr></thead><tbody><tr><td>Business or Enterprise License</td><td>Number of Users using the Business or Enterprise Features</td></tr><tr><td>Privileged Access Manager Add-On</td><td>Number of Users using the Business or Enterprise Features AND PAM Features</td></tr></tbody></table>

#### Example

For example, if an organization has 100 Enterprise users and needs PAM functionality for only 10 of them, they would purchase:

* **100 Keeper Enterprise Licenses** for users who only need the enterprise features.
* **10 Privileged Access Manager** **Add-Ons**, to cover the 10 users that need PAM functionality.

## MSPs

Keeper’s [MSP Consumption Model](https://docs.keeper.io/enterprise-guide/keeper-msp/consumption-based-billing) allows MSPs and their Managed Companies (MCs) to allocate Keeper licenses to their users and pay only for used licenses at the beginning of the following month.

KeeperPAM is a [Secure Add-On](https://docs.keeper.io/enterprise-guide/keeper-msp/consumption-based-billing/secure-add-ons) that MSPs can add or remove at any time for their Managed Companies.

Features available with the KeeperPAM Add-On are listed [here](#features-included-with-keeperpam).

## Existing Customers - Updating KSM/KCM Add-Ons

For existing customers, the following existing Add-ons can be upgraded to the Privileged Access Manager Add-On:

* Keeper Secrets Manager Add-On
* KeeperPAM Add-On
* Keeper Connection Manager Add-On

Both the Keeper Secrets Manager and Keeper Connection Manager Add-Ons are included as part of the Privileged Access Manager Add-On.

### Upgrading from Keeper Secrets Manager Add-On

Upgrading to the Privileged Access Manager Add-On from the Keeper Secrets Manager Add-On will give you:

* Access to new KeeperPAM Features
* Unlimited API Calls

### Upgrading from Keeper Connection Manager Add-On

Upgrading to the Privileged Access Manager Add-On from the Keeper Connection Manager Add-On will give you new KeeperPAM Features which includes accessing both the cloud and self-hosted KCM.

## **Ready to Upgrade?**

To purchase, upgrade, or if you have any questions, contact your Keeper account manager or use our [online form](https://www.keepersecurity.com/contact.html?t=b\&r=sales).