How to select a SASE edition - Secure Access Service Edge

Secure Access Service Edge (SASE) charges you based on the protection capabilities that are provided for private access and Internet access, log storage capacity, file storage capacity, and subscription duration. This topic describes the billing of SASE, including the billable items, billing method, overdue payments, and renewal.

Editions

Editions for private access

Edition	Scenario	Limit	Core feature	Billing dimension
Private Access VPN	Small- and micro-sized enterprises need to support lightweight remote work. Enterprises need to support secure user access to applications and resources that are deployed on Alibaba Cloud, on other public clouds, or in data centers.	The number of employees is less than or equal to 100. The maximum number of virtual private cloud (VPCs) for which you can enable network connections is 2. The maximum number of connectors that you can create is 2. Connectors are used to connect to business resources outside Alibaba Cloud. The office bandwidth is less than or equal to 10 Mbit/s.	Identity authentication: Lightweight Directory Access Protocol (LDAP) identity providers (IdPs) of the Windows AD and LDAP types, DingTalk IdPs, and Lark IdPs can be connected. Two-factor authentication: Text message-based verification codes, email-based verification codes, and one-time password (OTP) tokens are supported. OTP tokens include built-in tokens of SASE and third-party tokens.	You are charged based on the subscription duration. The minimum subscription duration is one month.
Private Access Basic	Medium- and large-sized enterprises need to support remote work. Enterprises need to support secure user access to applications and resources that are deployed on Alibaba Cloud, on other public clouds, or in data centers. The office bandwidth is greater than 10 Mbit/s.	The number of employees is greater than 100 but less than or equal to 500. The maximum number of VPCs for which you can enable network connections is 5. The maximum number of connectors that you can create is 5. Connectors are used to connect to business resources outside Alibaba Cloud. The office bandwidth that is provided varies based on the account quota that you purchase. For example, if you purchase an account quota of 200, SASE provides an office bandwidth of at least 200 Mbit/s.	Identity authentication: LDAP IdPs of the Windows AD and LDAP types, DingTalk IdPs, and Lark IdPs can be connected. Two-factor authentication: Text message-based verification codes, email-based verification codes, and OTP tokens are supported. OTP tokens include built-in tokens of SASE and third-party tokens.	You are charged based on the account quota and subscription duration. The minimum account quota is 100. Note The account quota is deducted by one for a user regardless of whether the user registers one or more terminals.
Private Access Advanced	Large-sized enterprises need to support remote work. Enterprises need to use Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) to implement network access control on users in office zones. Enterprises need to use more bandwidth resources and support secure user access to applications and resources that are deployed on Alibaba Cloud, on other public clouds, or in data centers. Enterprises need to accelerate access from global users to office applications and resources.	The number of employees is greater than 500. The maximum number of VPCs for which you can enable network connections is 10. The maximum number of connectors that you can create is 10. Connectors are used to connect to business resources outside Alibaba Cloud. The office bandwidth that is provided varies based on the account quota that you purchase. For example, if you purchase an account quota of 500, SASE provides an office bandwidth of at least 500 Mbit/s.	Identity authentication: LDAP IdPs of the Windows AD and LDAP types, DingTalk IdPs, Lark IdPs, and WeCom IdPs can be connected. Network access control: Password-free access to office networks is supported. Global office: Users outside the Chinese mainland can access services in and outside the Chinese mainland, and senior management who travel for work can also access services in the Chinese mainland.	You are charged based on the account quota and subscription duration. The minimum account quota is 100. Note The account quota is deducted by one for a user regardless of whether the user registers one or more terminals.

Editions for Internet access

Edition

Scenario

Limit

Core feature

Billing dimension

DLP

This edition integrates the office security capabilities of Alibaba Group and the cloud DLP architecture to offer a lightweight solution for office data detection and help enterprises monitor outbound transfers of sensitive data.

Only Windows, macOS, and Elastic Desktop Service (EDS) are supported.

Sensitive file detection: Outbound file transfers by using specific methods can be detected based on sensitivity levels. The methods include instant messaging tools, emails, and browsers. Instant messaging tools include WeChat, WeCom, DingTalk, and Tencent QQ.
Peripheral management: Office device ports such as USB ports, Bluetooth, and AirDrop can be managed.
Watermark management: Screen watermarks and printer watermarks are supported.

You are charged based on the account quota and subscription duration.

The minimum account quota is 100.

Note

The account quota is deducted by one for a user regardless of whether the user registers one or more terminals.

Billing method and billable items

SASE supports only the subscription billing method. The following table describes the billable items.

Billable item	Description
Private access	The account quota is deducted by one for a user regardless of whether the user registers one or more terminals. The fee varies based on the edition. Private Access Basic The fee is USD 5.5 per account-month. Note For example, if you purchase Private Access Basic and an account quota of 100, you can register up to 100 accounts for your enterprise. If the number of registered accounts reaches 100, you can no longer register new accounts. Registered terminals are not affected.
Internet access	Internet Access DLP is offered. The fee is USD 4.5 per account-month. Note For example, if you purchase Internet Access DLP and an account quota of 100, you can apply access control policies for Internet access to up to 100 accounts. If the number of accounts reaches 100, you can no longer create access control policies for Internet access or modify the effective scope of existing access control policies.
File storage service	If you purchase Internet Access DLP, you can enable the feature of file storage service to store files for more than 30 days. If you enable the feature of file storage service, you must specify the file storage capacity. The fee is USD 75 per TB-month. The minimum storage capacity that is supported is 1 TB.
Log storage service	If you enable the feature of log storage service, you must specify the log storage capacity. The fee is USD 0.08 per GB-month. You can purchase log storage capacity in increments of 500 GB.
Subscription duration	The subscription duration. You can select 1 Month, 2 Months, 3 Months, 4 Months, 5 Months, 6 Months, 1 Year, 2 Years, or 3 Years.

Service purchase

Log on to your Alibaba Cloud account and go to the SASE buy page.

Configure the parameters based on your business requirements. The following table describes the parameters.

Parameter	Description
Region	The region in which you want to use SASE. SASE is available in the following regions: China (Beijing), China (Shanghai), China (Shenzhen), China (Hangzhou), China (Chengdu), Singapore, Germany (Frankfurt), US (Silicon Valley), and US (Virginia).
Private Access	The feature that provides protection for internal network access.
Internet Access	The feature that provides protection for Internet access. By default, detection results are stored for 30 days. If you want to store detection results for a longer period of time, you can specify File Storage Capacity.
Log Service	By default, logs within the last seven days are stored. If you want to store logs for a longer period of time or meet Multi-Level Protection Scheme (MLPS) requirements, we recommend that you set Log Storage to Yes and configure the Log Storage Capacity parameter.
Duration	The subscription duration. You can select Auto-renewal based on your business requirements. Note The auto-renewal cycle varies based on the unit of the subscription duration. For example, if you set Duration to 1 Month and select Auto-renewal when you purchase SASE, SASE automatically renews your subscription for one month after the subscription expires.

Click Buy Now and follow the on-screen instructions to complete the payment.

Overdue payments

If you have overdue payments, the use of SASE is affected. We recommend that you top up your account at the earliest opportunity.

Subscription expiration status	Description
Seven days before the expiration date	The system sends renewal notifications by text message, email, or internal message. If you do not renew the subscription before the subscription expires, SASE stops providing protection after the expiration date.
Within seven days after expiration	The system retains all your feature configurations and data in SASE. If you renew your subscription or purchase SASE within seven days after expiration, SASE retains existing feature configurations and historical data.
Seven days after expiration without renewal	You can no longer use SASE. To use SASE, you must purchase SASE. If you do not renew your subscription or purchase SASE seven days after expiration, SASE deletes existing feature configurations and historical data.

Renewal

To ensure the availability of SASE, we recommend that you renew your subscription before the subscription expires. SASE supports manual renewal and auto-renewal.

Manual renewal

Log on to the SASE console.
In the upper-right section of the Overview page, click Renew.
On the Renew page, specify the subscription duration based on your business requirements.
Read and select Terms of Service, click Buy Now, and then follow the on-screen instructions to complete the payment.

Auto-renewal

To ensure smooth work experience within your enterprise, we recommend that you enable the auto-renewal feature the first time you purchase SASE.

The following list describes the rules of auto-renewal:

SASE automatically deducts the renewal fees from your account balance nine days before the expiration date. To ensure successful renewal, make sure that you have a sufficient balance in your payment account.
If the auto-renewal fails one day before the expiration date, you must manually renew the subscription.
If you manually renew the subscription before the automatic deduction date, the next automatic deduction date changes accordingly. SASE automatically deducts the renewal fees based on the new expiration date.
Auto-renewal takes effect the day after you enable it. Auto-renewal supports coupons.
Important
If you want to request a refund for the subscription that is automatically renewed by using coupons, the coupons cannot be returned.

Upgrade and downgrade

Description

Upgrade
SASE calculates the price difference of an upgrade by using the following formula: (Fee for the private access edition that you purchased + Fee for the Internet access edition that you purchased) × Account quota × Remaining subscription duration in days + Fee for the incremental log storage capacity + Fee for the incremental file storage capacity.
Downgrade
You can downgrade SASE only before its expiration date. After the expiration date, you cannot downgrade SASE. If you want to downgrade SASE whose subscription has expired, you must renew the subscription and then perform the downgrade. You can also purchase SASE of the required specifications after the subscription expires.
Important
Refunds are unavailable for downgrade operations. Downgrade operations cannot be rolled back. Proceed with caution.

Procedure

Log on to the SASE console.
In the upper-right section of the Overview page, click Upgrade Now.
On the Upgrade/Downgrade page, upgrade or downgrade the SASE specifications that you purchased based on your business requirements.
Read and select Terms of Service, click Buy Now, and then follow the on-screen instructions to complete the payment.

Refund policy

SASE provide a 5-day money-back guarantee. Refunds are unavailable after five days.