Cloud Threat Analytics: Billable Accounts Definition
Description
Overview:
Our Cloud Threat Analytics offering determines billable status separately from monitoring. Non-billable accounts are still generating logs and appear in security reports. This document explains the criteria for determining which accounts are billable across all monitored products.
Note: Billing rules are subject to change as the platform Alerts continues to refine its policies. This document reflects the current implementation as of the date shown above. Partners will be notified of any significant changes to billing criteria.
Quick Reference: What's Billable vs Monitored
| Account Type | Billable | Logs Ingested? |
| Standard licensed user | Yes | Yes |
| Guest/External user | No | Yes |
| Non-licensed account | No | Yes |
| Suspended (Google) | No | Yes |
| Archived (Google) | No | Yes |
| Shared/Room mailbox | No | Yes |
| Service Account | No | Limited |
| Global Administrator | Yes (always | Yes |
General Billable Criteria (All Products)
An account is BILLABLE if ALL of the following are true:
- Account is enabled - Sign-in is not blocked
- Account is not deleted - No deletion timestamp
- Account has a partner domain - Properly associated with a customer
- Account is not a service account - Not a system/automation account
- Passes product-specific checks - See product sections below
- Does not match any billing exception - See Exceptions section
Microsoft 365 (MS365/Office 365)
Billable Accounts
A Microsoft Account is billable if
- Account is enabled (sign-in allowed)
- Account has a paid license assigned (at least one non-trial SKU)
- Account is not a guest/external user
- Account does not match any email pattern exceptions
Non-Billable Microsoft Accounts
| Category | How Identified | Logs ingested? |
| Guest/External Account | userType = 'Guest' or #ext# in UPN | Yes |
| Non-Licensed Account | isPaidLicense = false (no paid SKU assigned) | Yes |
| Sync Account | Email starts with "sync" or "adtoaadsyncserviceaccount" | Yes |
| Service Account | Flagged as service account | Limited |
| Shared/Room Mailbox | Exchange mailbox type is not UserMailbox | Yes |
| Health Mailbox | Email starts with "HealthMailbox" | Yes |
| System Mailbox | Email starts with "SystemMailbox", "FederatedEmail", "Migration", "DiscoverySearchMailbox" | Yes |
Microsoft Admin Roles
All Microsoft admin roles are treated identically for billing purposes. Admin role assignment does NOT affect whether an account is billable with the exception of Global Administrators. Global Administrators are always billable regardless of licensing status or other factors.
The following admin roles are billable (if the account meets standard billable criteria) AND monitored:
- Privileged Role Administrator
- User Administrator
- Groups Administrator
- Security Administrator
- Security Reader
- Compliance Administrator
- Compliance Data Administrator
- Exchange Administrator
- SharePoint Administrator
- Teams Administrator
- Intune Administrator
- Cloud App Administrator
- Application Administrator
- Billing Administrator
- License Administrator
- Service Support Administrator
- Global Reader
- Reports Reader
- Any other admin role
Microsoft License Determination
The system uses JSONata rules to evaluate Microsoft SKU assignments:
- An account is considered "licensed" if it has at least one non-trial, paid SKU assigned
- Trial SKUs alone do not count as licensed
- If any assigned SKU is paid (even if other trial SKUs exist), the user is licensed
- Common paid SKUs include: Microsoft 365 Business Premium, Microsoft 365 E3/E5, Office 365 E1/E3/E5, etc.
Exchange Mailbox Types (Non-Billable)
The following Exchange mailbox types are excluded from billing:
- DiscoveryMailbox
- EquipmentMailbox
- LegacyMailbox
- LinkedMailbox
- LinkedRoomMailbox
- RoomMailbox
- SchedulingMailbox
- SharedMailbox
- TeamMailbox
Recommendation: We recommend that whenever possible these mailbox types should have direct sign-in blocked, and users should access the mailbox through group membership permissions. See Microsoft's documentation on managing shared mailboxes.
Google Workspace
Billable Accounts
A Google Workspace account is billable if:
- Account is active (not suspended)
- Account is not archived
- Account is not a service account
Non-Billable Google Accounts
| Category | How Identified | Logs Ingested? |
| Suspended Account | isSuspended = true | Yes |
| Archived Account | isArchived = true | Yes |
| Service Account | Flagged as service account | Limited |
Note: Google archived accounts cannot sign in but are retained at reduced cost. These are non-billable in SaaS Alerts.
Salesforce
Billable Accounts
A Salesforce account is billable if:
- Account is enabled
- Account is not a service user type
- Account is not deleted
Non-Billable Salesforce Accounts
The following Salesforce user types are excluded:
- AutomatedProcess
- CloudIntegrationUser
- CsnOnly
- Service accounts
Slack
Billable Accounts
A Slack account is billable if:
- Account is enabled
- Account is not deleted
- Account is not a service account
Dropbox
Billable Accounts
A Dropbox account is billable if:
- Account is enabled
- Account is not deleted
- Account is not a service account
RMM and MSP Tools
The following integrations are never billable for MSP partners:
- Datto RMM
- Syncro RMM
- N-Central
- Kaseya VSA
- Kaseya VSA X
- ConnectWise Automate
- IT Glue
- Ninja One
Billing Exceptions (Email Patterns)
The following email patterns are automatically excluded from billing across all products:
| Pattern | Description | Example |
| HealthMailbox* | Microsoft health monitoring | HealthMailbox123abc@contoso.com |
| QBDataServiceUser* | QuickBooks service accounts | QBDataServiceUser01@contoso.com |
| *@app.sherpadesk.com | SherpaDesk MSP accounts | support@app.sherpadesk.com |
| package_* | Bulk Intune enrollment | package_abc123-def456@contoso.com |
| adtoaadsyncserviceaccount* | AD sync service |
adtoaadsyncserviceaccount @contoso.onmicrosoft.com |
| room*, shared*, noreply*, donotreply*, no-reply* | Shared/room mailboxes | shared.mailbox@contoso.com |
| SystemMailbox*, FederatedEmail*, Migration*, DiscoverySearchMailbox* | System mailboxes | SystemMailbox{GUID}@contoso.com |
Frequently Asked Questions
Are guest accounts still monitored?
Yes. Guest/external accounts are non-billable but continue to generate full audit logs. This is essential for security monitoring of external collaborators and potential threats.
Do non-licensed accounts generate logs?
Yes. The 'isBillable' flag is strictly for billing purposes. Non-licensed accounts are still:
- Generating audit logs
- Triggering alerts based on configured rules
- Visible in dashboards and reports
Are admin accounts treated differently?
Most admin roles follow the same billable rules as regular accounts. However, Global Administrator accounts are always billable for all partner types, regardless of license status. This ensures privileged accounts with tenant-wide access are always tracked.
What about other products (not listed)?
For any product not specifically listed, the general billable criteria apply:
- Account must be enabled
- Account must not be deleted
- Account must not be a service account