QS-WAN · Profiles and devices

User management software that counts devices, not seats

User management software in QS-WAN gives each person one profile and as many devices as they need. Every device carries its own certificate, can be attached to several gateways, and shows its own status badge. The licence counter sits on screen the whole time: devices used out of devices allowed.

What it is

The problem is the person with four machines

A directory that thinks in seats tells you Ana has an account. It will not tell you Ana has a work laptop, a desktop in the lab, and a spare machine she carried to a client site last March. All three hold a valid certificate. All three can still open a tunnel. Then Ana leaves. You disable one account and feel finished, and three certificates disagree with you. Access was never granted to Ana. It was granted to a device she happened to be holding, and a device does not resign when its owner does.

One profile, many devices, a certificate each

A profile is the person. Under it sit their devices, each with its own certificate and its own gateway membership. Revoking a laptop does not touch the desktop, and adding a second machine does not mean a second identity for the same human being.

A counter that does not hide

Written as devices used out of your maximum, and always on screen. It is not buried in a billing tab, because the number you never look at is the one that surprises you.

A list that does three plain things

Filter by gateway, so who can reach the Lisbon site is a click rather than a query. Search. And export to CSV, the format an auditor asks for nine seconds in.

The same arithmetic turns up on the invoice. Licences here are counted by device, not by profile, so the question is not how many people you employ. It is how many machines you need to let connect, and whether you could name them.

The mechanism

Disable the profile, and watch how little happens

Three certificates carry on being valid, because they were never Ana. Each one has to be revoked on its own, and the counter beside them says how many are left. Then queue a machine for removal and watch which badge wins the colour.

profile active, 3 certificates can open a tunnel

One profile, Ana Ribeiro, with four devices under it: a work laptop that is online and connected, a lab desktop that is online, a spare laptop last seen in March that is enrolled but offline, and a tablet whose invitation has not been used. Each device carries its own certificate and its own gateway membership, and the licence counter reads devices used out of devices allowed, because licences count devices and not seats. Disabling the profile changes the profile and nothing else: three certificates are still valid and can still open a tunnel, which is the point. Revoking the spare laptop takes one of them away. Queueing the lab desktop for removal gives it a pending removal badge, and that badge outranks the green of online, because the colour precedence runs pending removal, revoked, expired, online, VPN connected.

Why this exists

Four things that go wrong without it

Seat counting undercounts what can connect

It is out by whatever your average devices per person happens to be, and that is rarely one. The number on the invoice and the number that can open a tunnel are different numbers.

Disabling an account is not revoking access

The certificate is on the machine, not on the person. The leaver process that stops at the directory leaves the machines behind.

Green is the badge you skim past

A machine that is online and queued for removal will read as healthy if the pleasant badge wins the colour, which is exactly when it should not.

A device that is off cannot be told anything

Every product in this category has that physics problem. The difference is whether the screen admits it or paints the row green immediately.

What you get

One list, and the two numbers people argue about

The person who runs the fleet wants to know what can connect. The person who signs wants to know what is being paid for. Counting devices puts both answers on the same screen.

For the fleet

Revoking one machine leaves the others alone

Each device has its own certificate and its own gateway membership, so the spare laptop can go without anybody losing their desk.

Who can reach the Lisbon site is a click

The list filters by gateway, searches, and exports to CSV. None of those three is exciting and all three come up in the first week.

An inventory that starts from the person

There is a drill-down into the activity of one user, rather than a log you have to reconstruct a person out of.

For the business

The licence number is the ceiling on your exposure

Because licences count devices, the tier you buy is also the most machines that can ever connect. The counter reads devices used out of devices allowed, so the ceiling and the use of it sit on one screen.

Pending removal stays until the removal lands

A machine in a drawer finds out later, and the badge says so rather than going green the moment somebody pressed delete.

The inventory has a switch the person can see

Sharing is a single toggle in their own settings, and the console asks for a snapshot when it needs one instead of streaming a live feed of a laptop.

How it works

Three steps, and the third is the one people skip

A person gets a profile, and their machines get certificates

The profile is the human being. Under it sit the devices, each with its own certificate and its own gateway membership, each issued through enrollment with a single-use token. Adding a second machine does not create a second identity for the same person, and the counter on screen goes up by one, because licences count devices.

The row tells you the truth, in a fixed order

Six badges: online, VPN connected, pending removal, revoked, PQ enrolled and PQ pending, plus the declared asset the device belongs to. When more than one applies, the colour precedence runs pending removal first, then revoked, then an expired certificate, then online, then VPN connected. Bad news outranks good news, because green is the badge you skim past.

Somebody leaves, and you work down the devices

Disabling the profile is not the end of it, because access was granted to machines. Each certificate is revoked on its own through the certificate lifecycle, and until a removal actually lands on a machine that was asleep, the row says pending removal rather than going quietly green.

Before you start

You need the console and the devices you already run. The useful preparation is knowing your real devices-per-person number, because that is what the licence counter is going to show you.

In detail

The inventory behind a row, and the blank you must not trust

Inventory

What the console can hold, and who agreed to it

Per device: operating system and build, processor, memory and disk, battery, network interfaces and addresses, graphics adapters and displays, installed and running software, theme and locale, and the client version.

Two things keep that honest rather than creepy. Sharing is a single toggle the device owner sees in their own settings, and the console asks for a snapshot when it needs one instead of the endpoint streaming a live feed of a laptop. If the toggle is off, the request comes back with nothing. It is also a support tool: fixing a problem for somebody starts with knowing what they are running.

On demand

A second path, and where it is still partial

The console can send a request through the gateway to the client and wait about thirty seconds. It can come back with location and a geocoded address, addresses, host and user names, operating system and architecture, client version, processor, memory and hardware, with application data as a separate request.

This one is partial, and here is the honest limit. When the request comes back empty, the console cannot reliably tell you why. A gateway that is offline, a client that cannot be reached, an unsupported path, a timeout, and a person who turned sharing off all look alike from where you are sitting. Treat a blank as ask again, never as that device is gone.

Where this earns its place

Four mornings this changes

Somebody leaves on a Friday

You disable the profile and then work down the devices, because the certificates are on the machines. The counter tells you when you are finished.

An auditor asks who can reach one site

You filter the list by that gateway and export it. Nine seconds, and the format they wanted.

The invoice does not match the headcount

It is not supposed to. Licences count devices, and the counter on screen shows how much of your tier is in use.

A machine is queued for removal and still online

The row shows the removal, not the green. Bad news outranks good news on purpose, because green is what people skim past.

Works better with

Where a device comes from, and what happens to it after

Certificate lifecycle management

Issuing, reissuing and revoking. The list on this page shows the state; that page is where the state gets changed.

Device enrollment

How a new machine gets under a profile in the first place: a single-use token and keys generated on the device.

Security policy management

What each of those devices is then allowed to do, as a signed policy rather than a visit to each desk.

Multi-factor authentication

The other half of the question. This page counts devices; that one is about proving the person holding one.

What this does not do

The limits, because they are what make the rest believable

It does not replace your identity provider

These are VPN profiles and device certificates. Deleting a profile here does not delete the company account of anybody.

It does not guarantee a change reached a sleeping device

What is stored in the console is authoritative; what reaches gateways and clients is best effort. A green response proves the intent was recorded, and the badges show you the difference.

It does not cover every platform equally

Windows is complete, Linux is a genuine port with gaps we declare rather than hide, and macOS and iOS are planned. An inventory is only as detailed as the agent underneath it.

Nobody here is watching your user list

This is a product you run on your own console. The only people reading it are the ones you gave a login.

Questions people ask

The ones that come up first

What is user management software in QS-WAN?

One profile per person and as many devices as they need under it. Each device has its own certificate and its own gateway membership, each shows its own status badge, and the licence counter reads devices used out of devices allowed.

Are licences per person or per device?

Per device. That is why the counter is always on screen rather than in a billing tab: it reads devices used out of devices allowed, so what is in use and what your tier allows sit side by side.

If I disable a profile, is access gone?

No, and this is the part worth reading twice. Access was granted to devices, and each one holds its own certificate. Disabling the profile does not revoke them, so you work down the devices and revoke each one.

Why does a device show pending removal instead of online?

Because the colour precedence puts pending removal first, then revoked, then an expired certificate, then online, then VPN connected. Bad news outranks good news, because green is the badge people skim past.

What do PQ enrolled and PQ pending mean?

Whether that device has registered its post-quantum keys yet, or is still holding an invitation. It is the difference between a policy and a fact.

The device intelligence request came back empty. What does that mean?

Ask again. The console cannot reliably tell you why: a gateway that is offline, a client that cannot be reached, an unsupported path, a timeout, and a person who turned sharing off all look alike from where you are sitting. Never read a blank as that device is gone.

Tell us how many devices your last leaver was holding.

We open a user list shaped like yours, disable a profile while you watch, and then count what can still open a tunnel. It is free, it lasts as long as you want, and there is nothing to sign.