What Happens When a CSE License Expires

Expiration notices, the 44-day grace period, tenant deletion, and why a serial number must never be deleted

  • Last validated: Nov 9, 2026
  • 5 minutes to read

Overview

A CSE tenant does not shut down the moment its license expires. It first enters a 44-day grace period, during which end-user services keep working but administrators lose access to the CSE Command Center. If no renewal is applied by the end of the grace period, the tenant is permanently deleted on Day 45.

To renew, apply a renewal activation key to the existing CSE serial number. See Renew, Upgrade, or Downgrade a CSE License.

Expiration notices

The primary account contacts receive automated email notifications as the expiration date approaches. The status and exact expiration date of each license are also shown on the CSE serial number, under My Workspace > Products.

The grace period and deletion timeline

Day 1 is the first day after the expiration date.

Period End users Administrators
Day 1 to Day 44 (grace period) Access continues. Users can authenticate to SPA services and remain protected by SIA. Locked out of the CSE Command Center. Admins cannot modify policies, adjust device trust scoring, view audit logs, or manage user directories until a renewal is applied.
Day 45 All connections end. The tenant is permanently deleted.

For example, if a license expires on October 16, the grace period runs from October 17 through November 29, and the tenant is deleted on November 30.

Data deleted 45 days after license expiration

If no valid renewal key has been applied by Day 45:

  • All user connections to CSE are ended.
  • The CSE backend is permanently deleted, including access policies, custom PKI and certificate authorities, and user inventories.
  • The CSE serial number is removed from MySonicWall or Unified Management.

Deletion on Day 45 cannot be undone. Apply the renewal key during the grace period to restore admin access and keep the tenant.

Never delete a CSE serial number

Do not delete a CSE serial number unless you intend to permanently destroy the tenant. Deleting the serial number bypasses the grace period entirely:

  • All SPA and SIA connections drop immediately.
  • The CSE backend, configuration, policies, and directories are scheduled for permanent purge.
  • SonicWall Support cannot recover the tenant. Recovery requires building a new CSE environment and re-enrolling every user.

To move CSE to a different tenant or organization, do not delete and re-register it. Use a product transfer, which moves the serial number without affecting the CSE backend or user connectivity. See Transfer CSE Product between Tenants or Organizations.

To stop billing for a service on a monthly subscription, set the service to expire or set it to None. See Changing a monthly subscription.

Was this page helpful?