Do SAML or LDAP users count towards my premium feature subscriptions?

Auto-hébergement

Matomo premium feature subscriptions are based on the number of Matomo users registered on your Matomo instance. It does not include the number of users in your identity provider or LDAP directory.

Installing the LoginSAML premium feature or LoginLDAP plugin does not increase the number of registered users. A user only counts towards your subscription once a Matomo user account has been created.

How it works with LoginSAML

If JIT provisioning is disabled (default setting):

  • Users will need a Matomo user account before they can sign in using SAML.
  • That new Matomo account counts as one registered user.
  • Successful authentication with the identity provider does not create a new Matomo account.
  • If no matching Matomo user exists, the user cannot sign in.

If Just-in-Time (JIT) provisioning is enabled:

  • Users who exist only in your SAML identity provider (such as Keycloak, Okta, or Microsoft Entra ID) do not count towards your subscription. Learn more about enabling Just-in-Time (JIT) provisioning
  • When a user signs in to Matomo for the first time, Matomo automatically creates a user account.
  • That new Matomo account counts as one registered user.

How it works with LoginLDAP

LoginLDAP supports two ways of creating Matomo users:

If you use First Login provisioning, the behaviour is similar to LoginSAML:

  • Users who exist only in LDAP do not count.
  • A Matomo account is created when the user signs in for the first time.
  • The registered user count increases by one.

If you enable LDAP Bulk Synchronisation, Matomo creates user accounts for every matching LDAP user during the synchronisation process. These accounts count as registered users even if the users:

  • Never logged in to Matomo.
  • Do not have access to any websites.
  • Have never used a premium feature.

Note: If your LDAP directory contains many users, bulk synchronisation can cause your registered user count to exceed your premium feature subscriptions.

Why is a subscription marked as exceeded?

A subscription is marked as exceeded when the total number of registered Matomo users is greater than the number of users included with your premium feature subscription. This count applies across premium features that use registered-user licensing.

If you recently enabled LDAP Bulk Synchronisation, Matomo may have created accounts for every matching LDAP user. These accounts count towards your subscription even if the users have never signed in or accessed Matomo.

Next steps

If a premium feature subscription is marked as exceeded after enabling SAML or LDAP authentication, check the following:

  1. Review the list of registered Matomo users and remove any accounts that no longer require access.
  2. If you use LDAP with Bulk Synchronisation, configure your LDAP filters to synchronise only the users or groups that need access to Matomo.
  3. If all synchronised users require access, update your premium feature subscription to cover the additional registered users.