Credit requirements for Email and Collaboration Security

Views:

Understand what features or apps are provided in the Email and Collaboration Security packages and how many TrendAI Vision One™ credits are required to enable each feature or app.

You can deploy Email and Collaboration Security in two independent ways, and credits are counted separately for each deployment:

Cloud Email and Collaboration Protection: an API-based deployment that protects cloud email and collaboration services, such as Microsoft 365, Google Workspace, Box, and Dropbox.
Cloud Email Gateway Protection: an MX-based deployment that filters inbound and outbound email at the gateway.

You can also add XDR for Email and Collaboration for cross-layer detection and response. If you use both deployments, TrendAI Vision One™ calculates each deployment's credits using its own rules and then adds the results together.

The following table summarizes the available Email and Collaboration Security packages and their credit requirements. Credit requirements are calculated using the rules described in each deployment section later on this page.

Package	What it provides	Credit requirement
Email and Collaboration Security - Core	Standard email and collaboration protection on your chosen deployment: the API-based (Cloud Email and Collaboration Protection) or MX-based (Cloud Email Gateway Protection) deployment.	Monthly: 2.08 credits per user Yearly: 25 credits per user
Email and Collaboration Security - Essentials	Standard protection plus advanced protection on your chosen deployment.	Monthly: 4.17 credits per user Yearly: 50 credits per user
Email and Collaboration Security - Pro	Advanced protection on both the API-based and MX-based deployments, plus XDR for Email and Collaboration.	Monthly: 8.75 credits per user Yearly: 105 credits per user
XDR for Email and Collaboration	Add TrendAI Vision One™ XDR to correlate email threats with broader attack patterns and stop phishing, business email compromise (BEC), and malware before they spread. Available on its own or as part of the Pro package.	Monthly: 0.42 credits per user Yearly: 5 credits per user

The total number of monthly credits required for each deployment is calculated by multiplying the required credits per unit by the number of eligible unique users or email addresses in each deployment.

Email and Collaboration Security captures daily snapshots of how many units of the solution you are using. Your credit drawdown for the month corresponds to the snapshot with the highest usage, after excluding the highest 15% of outlier snapshots. For more information, see How TrendAI Vision One™ calculates your credit usage.

Tip

Your usage and credit information updates daily at 5:00 (UTC).

To view the latest estimated total credit drawdown for the current month, go to the corresponding feature or app and click Manage usage. You can also go to Platform Usage and Credits → Credits overview → Credit usage overview.

Credits are counted differently for each deployment. Read the deployment section that matches how you have deployed Email and Collaboration Security.

	Cloud Email and Collaboration Protection	Cloud Email Gateway Protection
Deployment method	API-based	MX-based (mail gateway)
How credits are counted	Users that are targets of enabled policies	Active users, unique active email addresses, or both (three modes)
Advanced protection charge applies to	Only users in policies that have an advanced protection feature enabled	All eligible users or email addresses on all managed domains, after any advanced protection feature is enabled

Cloud Email and Collaboration Protection (API-based deployment)

The following table describes the available features of the Cloud Email and Collaboration Protection deployment.

Features	Description
Standard protection	Standard protection for your email and collaboration services, including services in Microsoft 365 and Google Workspace, Box, and Dropbox
Advanced protection	Advanced protection features including: Exchange Online (Inline Mode) Gmail (Inline Mode) Virtual Analyzer for URLs (URL sandboxing)

The following table describes the credit requirement for each protection level.

Protection level	Corresponding package	Credit requirement
Standard protection	Email and Collaboration Security - Core	Monthly: 2.08 credits per user Yearly: 25 credits per user
Advanced protection	Email and Collaboration Security - Essentials	Monthly: 4.17 credits per user Yearly: 50 credits per user

The users counted in the credit usage calculation are as follows:

Microsoft 365 services: The unique users that are added as targets of enabled policies for Exchange Online, OneDrive, or Teams Chat
Microsoft 365 services (SharePoint Online or Teams only): The users that are synchronized from your organization's identity provider if only policies for SharePoint Online or Teams (Teams) are enabled
Box, Dropbox, Gmail, Google Drive: The unique users that are added as targets of enabled policies for each service
Certain users are excluded from credit usage calculation, for example, unlicensed users, guest users, disabled users, and shared mailboxes in Microsoft Entra ID.
Policies include Advanced Threat Protection policies and Data Loss Prevention policies.
For advanced protection charges, only users that are added in the policies with an advanced protection feature enabled are counted.

Advanced protection charges occur when any of the advanced protection features is enabled. Enabling multiple advanced protection features still costs 4.17 credits per user. If you do not want to use advanced protection, disable all advanced protection features.

For example, your organization uses Exchange Online and SharePoint Online and has 500 users stored in Microsoft Entra ID. You add 100 users in several policies for Exchange Online without Virtual Analyzer for URLs enabled, another 100 users in other policies for Exchange Online with this feature enabled, and 2 SharePoint sites in several policies for SharePoint Online. The total number of credits for the daily snapshot is calculated as follows: 2.08 × 100 + 4.17 × 100 = 625

Important

If you updated from Cloud App Security and used Virtual Analyzer for URLs, advanced protection is automatically enabled after the update, with credits for advanced protection automatically drawn down on the first of the following month.

If you no longer need to use Cloud Email and Collaboration Protection, disable all Advanced Threat Protection and Data Loss Prevention policies.

Cloud Email Gateway Protection (MX-based deployment)

The following table describes the available features of the Cloud Email Gateway Protection deployment.

Features	Description
Standard protection	Standard protection to safeguard your email messages against phishing, ransomware, business email compromise (BEC), other advanced email threats, and spam
Advanced protection	Advanced protection features including: Virtual Analyzer for URLs (URL sandboxing) Email Encryption Email Continuity Extra Large Message Size DMARC Report Analysis

The following table describes the credit requirement for each protection level. A unit is an active user or a unique active email address, depending on your user directory integration (see below).

Protection level	Corresponding package	Credit requirement
Standard protection	Email and Collaboration Security - Core	Monthly: 2.08 credits per unit Yearly: 25 credits per unit
Advanced protection	Email and Collaboration Security - Essentials	Monthly: 4.17 credits per unit Yearly: 50 credits per unit

Depending on whether you have integrated your user directories (Microsoft Entra ID, Active Directory on-premises, Google Cloud Identity, Okta, or OpenLDAP) with TrendAI Vision One™ through Workflow and Automation → Third-Party Integrations and synchronized users, one of three credit usage calculation modes applies. The modes use different units: active users, unique active email addresses, or both.

Mode	User directory integration	Credit usage calculation unit	Description	Example
Active users mode	Fully integrated	Active user	A user is treated as an active user if: The user exists as an active account in your integrated user directory, and The domain part of the user's email address is added to and managed by Cloud Email Gateway Protection, and At least one email has been successfully delivered to or sent from the user's email address over the past 30 days. Certain users are excluded from the credit usage calculation. The excluded users depend on the integrated directory service (see the table after this one).	You have added four domains to Cloud Email Gateway Protection and integrated the user directories for these domains with TrendAI Vision One™. There are 1,000 active users on these domains. Credit usage calculation units: 1,000
Active email addresses mode	Not integrated	Unique active email address	An email address is treated as a unique active email address if: The domain part of the email address is added to and managed by Cloud Email Gateway Protection, and Duplicate email addresses with the same local part are removed. For example, the following two email addresses are treated as one email address for credit usage calculation: john.doe@example.com, john.doe@example.jp, and The email address matches one of the following conditions: At least three email messages have been delivered successfully to the email address over the past 30 days At least one email message has been sent successfully from the email address over the past 30 days	You have added four domains to Cloud Email Gateway Protection but have not integrated the user directories for these domains with TrendAI Vision One™. There are 2,000 unique active email addresses on these domains. Credit usage calculation units: 2,000
Mixed mode	Partially integrated	Active user and unique active email address depending on user directory integration	For domains with user directory integrated: Follow the active users mode. For domains without user directory integrated: Follow the active email addresses mode.	You have added two domains to Cloud Email Gateway Protection and integrated the user directories for these domains with TrendAI Vision One™. There are 500 active users on these domains. You have added another two domains to Cloud Email Gateway Protection but have not integrated the user directories for these domains with TrendAI Vision One™. There are 1,000 unique active email addresses on these domains. Credit usage calculation units: 500 + 1,000 = 1,500

An email is counted as successfully delivered when Cloud Email Gateway Protection relays the message to the receiving mail server and that server accepts it. Messages that permanently fail to deliver, such as bounced messages or messages that expire after all delivery retries, are not counted. A message that is deferred and later delivered on a retry is counted.

In active users mode, the users excluded from the credit usage calculation depend on the integrated directory service:

Directory service	Excluded users
Microsoft Entra ID	Guest users, disabled users, deleted users, unlicensed users (no license assigned, or no enabled Exchange plan), and shared mailboxes
Google Cloud Identity	Suspended users and deleted users
Active Directory on-premises	Disabled accounts and deleted users
OpenLDAP	Disabled accounts and deleted users
Okta	Deactivated or suspended users, and deleted users

You cannot view your current credit usage calculation mode directly in the console. You can infer it from your user directory integration: if all managed domains are integrated, you are using active users mode; if no domains are integrated, you are using active email addresses mode; and if only some domains are integrated, you are using mixed mode.

Note

After you configure user directory integration, the credit usage calculation mode switches within 1 to 2 days. Credit usage is recalculated once per day, starting at approximately 0:00 (UTC). The updated usage and credit information appears in the console after the daily refresh at 5:00 (UTC).

WARNING

In active email addresses mode, when no user directory is integrated, any email address that meets the activity conditions is counted toward credit usage. This includes system accounts such as postmaster, shared mailboxes, distribution lists, and even non-existent addresses that receive mail during Directory Harvest Attacks (DHA). To reduce unintended credit usage, integrate a user directory to use active users mode, and enable the Recipient Filter to reject messages addressed to invalid recipients before they are delivered.

Advanced protection charges occur when any of the advanced protection features is enabled on even one user and applies to all eligible users or email addresses on all managed domains. Enabling multiple advanced protection features still costs 4.17 credits per user or email address.

For example, you have added 3 domains with 500 users in Cloud Email Gateway Protection, 300 of which are active users over the past 30 days. You enable URL sandboxing and Email Continuity on one domain, which means that advanced protection is enabled on all active users of the three domains. Therefore, the total number of credits required for the daily snapshot is calculated as follows: 4.17 × 300 = 1,251

If you do not want to use advanced protection, disable all advanced protection features.

Important

If you updated from TrendAI™ Email Security and used Email Encryption, advanced protection is automatically enabled after the update, with credits for advanced protection automatically drawn down on the first of the following month.

If you no longer need to use Cloud Email Gateway Protection, delete all managed domains on the Domains screen.

XDR for Email and Collaboration (Email and Collaboration Sensor)

XDR for Email and Collaboration adds TrendAI Vision One™ XDR to correlate email threats with broader attack patterns and stop phishing, BEC, and malware before they spread. You can add it on its own or as part of the Email and Collaboration Security - Pro package.

The following table describes the available Email and Collaboration Sensor features and required credits.

Feature	Required credits
Email Sensor	Monthly: 0.42 credits per user Yearly: 5 credits per user
Collaboration Sensor	Monthly: 0.42 credits per user Yearly: 5 credits per user

The users counted in the credit usage calculation are the users added as Email Sensor targets in the Email and Collaboration Sensor app.