Secure Access Service Edge (SASE) uses a subscription billing model. Billing is based on the editions, license count, storage capacity, and subscription duration you select.
Editions and features
Private Access
Edition | Use cases | Key features |
Private Access (Basic) | For medium to large enterprises with remote access needs. Provides secure access to applications on Alibaba Cloud, other clouds, or data centers. | Authentication: Integrates with corporate identity sources including Windows AD/LDAP, DingTalk, and Lark. Two-factor authentication: SMS and email verification codes, OTP tokens (SASE-provided or third-party). |
Private Access (Advanced) | For large enterprises that require EAP-TLS authentication, higher bandwidth, and global acceleration for office applications. | Authentication: Integrates with Windows AD/LDAP, DingTalk, Lark, and WeCom. Office network access: Enables passwordless network access for employees. Global office access: Supports overseas employees accessing local or mainland China services. |
Internet Access
Edition | Use cases | Key features |
DLP | Uses the Cloud DLP (Data Loss Prevention) architecture to monitor sensitive data exfiltration in real time. Supports Windows, macOS, and Wuying Cloud Desktop only. | Sensitive file detection: Detects files sent through instant messaging (WeChat, WeCom, DingTalk, QQ), email, and browsers. Peripheral control: Manages USB ports, Bluetooth, and AirDrop on office devices. Watermark management: Supports on-screen and print watermarks. |
Endpoint Protection
Edition | Use cases | Key features |
Anti-virus Edition | Provides real-time virus defense and endpoint security alerts by integrating with the Alibaba Cloud malicious file detection platform. Supports Windows, macOS, and Wuying Cloud Desktop only. | Supports automatic scan and removal, one-click scan and removal, and real-time defense. Detects and removes common malware including backdoors, trojans, hacking tools, ransomware, and worms. |
Agent Office Security
The Agent Office Security module provides AI asset management, AI service management, and SASE Agent management capabilities for enterprise endpoints. It helps enterprises maintain visibility of AI asset distribution on endpoints, control AI service access permissions, and centrally manage operations agents.
Feature | Business Scenario | Core Capabilities |
AI Asset Management | Maintain a complete inventory of AI agents, LLMs, MCPs, and Skills on endpoints, identify high-risk assets, and enforce controls. | Asset scanning: Automatically scan AI agents and related components on endpoints. Risk identification: Detect malicious skills, vulnerabilities, and other security risks. Security controls: Disable or prompt-control high-risk agents. |
AI Service Management | Implement zero-trust access control for large language model services. | LLM service access control: Manage AI service access permissions based on zero-trust architecture. |
SASE Agent Management | Centrally manage the deployment status and security policies of operations agents on endpoints. | Operations agent management: View deployment status and configure operations policies. |
Billing specifications
Private Access
Edition | Billing metric | Specifications | Supported PoPs and VPCs |
Private Access (Basic) | Billed based on the number of licenses and subscription duration. Each user account counts as one license, regardless of device count. If user accounts exceed the licensed amount, new users are blocked from logging in. | Supports 100 to 500 employees. Supports up to 5 VPCs and 5 connectors for non-Alibaba Cloud networks. | PoPs: VPCs: China (Hangzhou), China (Beijing), China (Shanghai), China (Shenzhen), China (Chengdu), and China (Ulanqab). |
Private Access (Advanced) | Billed based on the number of licenses and subscription duration. Each user account counts as one license, regardless of device count. If the number of user accounts exceeds the number of licenses, SASE blocks new users from logging in. | Supports more than 500 employees. Supports up to 10 VPCs and 10 connectors for non-Alibaba Cloud networks. | PoPs: VPCs: China (Hangzhou), China (Beijing), China (Shanghai), China (Shenzhen), China (Chengdu), US (Silicon Valley), US (Virginia), Germany (Frankfurt), Singapore, Japan (Tokyo), Hong Kong (China), UAE (Dubai) and South Korea. |
Internet Access
Edition | Billing metric | Specifications |
DLP | Billed based on the number of licenses and subscription duration. Each user account counts as one license, regardless of device count. If user accounts exceed the licensed amount, new users cannot activate Internet Access policies. Minimum purchase: 100 licenses. | Supports only Windows, macOS, and Wuying Cloud Desktop. |
Endpoint Protection
Edition | Billing metric | Specifications |
Anti-virus Edition | Billed based on the number of licenses and subscription duration. Each endpoint counts as one license. If endpoints exceed the licensed amount, additional endpoints cannot activate protection policies. Minimum purchase: 100 licenses. | Supports only Windows, macOS, and Wuying Cloud Desktop. |
Agent Office Security
Feature | Billing Dimension | Specification Limits |
Agent Office Security | Billed based on the number of licenses purchased and the subscription duration. | Only supports enterprise endpoints running Windows or macOS. |
Billing method and billable items
SASE uses subscription (prepaid) billing only. The following table describes each billable item.
Billable item | Description |
Private Access | Required. Each user account counts as one license, regardless of device count. The final price on the purchase page reflects the license count and subscription duration. Check the purchase page for the final calculated price. |
Internet Access |
|
Endpoint Protection | Each endpoint device counts as one license. CNY 9.9 per license/month, with a minimum purchase of 100 licenses. |
File Storage service | If you subscribe to the DLP edition, you can enable the File Storage service to retain file information for more than 30 days. When you enable the File Storage service, you must specify a storage capacity. The price is CNY 300/ per TB/month. The minimum storage capacity is 1 TB. |
Log Storage service | After you enable the Log Storage service, you must set a storage capacity. The price is CNY 2.55 per GB/month. The minimum storage capacity is 500 GB. |
Agent Office Security | Provides AI asset management, AI service management, and SASE Agent management capabilities. Billed based on the number of licenses purchased and the subscription duration. See the purchase page for specific pricing. |
Subscription duration | Supported durations: 1, 2, 3, 4, 5, or 6 months, and 1, 2, or 3 years. |
Purchase a subscription
Log on to your Alibaba Cloud account and go to the Secure Access Service Edge (SASE) purchase page.
Select the services you need. At least one of the following is required: Private Access, Internet Access, or Endpoint Protection.
Parameter
Description
Private Access
Private Access
Secures private network access. Set to Yes to enable this service.
Edition
Select an edition: Private Access (Basic) or Private Access (Advanced).
number of licenses
The number of licenses for Private Access (Basic) or Private Access (Advanced).
Internet Access
Internet Access
Secures Internet access. Set to Yes to enable this service.
SASE retains source files that trigger sensitive data policies for 30 days by default. To extend retention, purchase the File Storage service.
Internet Access edition
Select an edition: Internet Behavior Management or DLP.
Number of licenses
Must be at least 100.
File Storage service
Retains source files flagged by sensitive data policies. Set to Yes to enable this service.
File Storage capacity
0 to 500 TB.
Endpoint Protection
Endpoint Protection
Enables real-time malware defense and endpoint security alerts. Set to Yes to enable this service.
Endpoint licenses
Must be at least 100.
Log Storage service
Log Storage service
SASE retains logs for 7 days by default. To extend retention or meet compliance requirements, purchase the Log Storage service.
Log Storage capacity
0 to 100,000 GB.
Agent Office Security
Agent Office Security
Provides AI asset management, AI service management, and SASE Agent management capabilities. Select Yes to purchase this service.
License Count
The minimum number of licenses is 100.
Subscription duration
Select a subscription duration. Optionally, enable auto-renewal.
The auto-renewal period matches your subscription duration. For example, a 1-month subscription auto-renews for one additional month.
Click Buy Now and follow the on-screen instructions to complete the payment.
After purchase, go to the Overview page and click Show Feature Description to view your license details.
Overdue payments
If your subscription expires without renewal, SASE services are suspended. Check the Expenses and Costs console to settle any outstanding balance.
Expiration status | Description |
7 days before expiration | SASE sends renewal reminders by SMS, email, and in-app notification. If you do not renew before expiration, the service stops the next day. |
Within 7 days after expiration | All configurations and data are retained during this 7-day grace period. Renewing or repurchasing within this period restores full service. |
More than 7 days after expiration | SASE permanently deletes all configurations and data. To resume service, you must repurchase a new subscription. |
Renewal policy
Renew your subscription before it expires to prevent service disruption. SASE supports manual and automatic renewal.
Manual renewal
Log on to the SASE console.
In the upper-right corner of the Overview page, click Renew.
On the Renew page, select a subscription duration.
Read and agree to the Terms of service, then click Buy Now and follow the instructions to complete the payment.
Auto-renewal
Enable auto-renewal during initial purchase to prevent unintended service interruptions.
Auto-renewal rules:
SASE attempts renewal 9 days before expiration. Make sure your account balance is sufficient.
If auto-renewal fails by one day before expiration, renew manually.
Manual renewal before the scheduled auto-renewal date resets the auto-renewal schedule to the new expiration date.
Auto-renewal takes effect the day after you enable it. Coupons can be applied to auto-renewals.
NoteCoupons applied to auto-renewed subscriptions are non-refundable.
For detailed instructions, see Auto-renewal.
Upgrades and downgrades
Configuration changes
Upgrade
Prorated upgrade cost = (Private Access cost + Internet Access cost) x licenses x remaining days + Log Storage add-on + File Storage add-on.
Downgrade
Downgrades are available only while your subscription is active. If expired, renew first then downgrade, or repurchase with the desired configuration.
WarningDowngrades are irreversible and non-refundable.
Procedure
Log on to the SASE console.
In the upper-right corner of the Overview page, click Change or Upgrade Now.
On the configuration change page, adjust settings as needed.
Read and select the Terms of service, then click Buy Now and follow the instructions to complete the payment.
Refund policy
SASE offers an unconditional refund within 5 days of purchase. After this period, refunds are not available. For more information, see Unsubscription Rules and Initiate Unsubscription.