GitLab improves Restricted Access to keep license costs in check

GitLab has updated Restricted Access, its mechanism for controlling license costs. The feature now does a better job of covering three scenarios: automatic user provisioning through third-party identity providers, reactivation of inactive accounts, and sign-in.

How Restricted Access works

Restricted Access is a seat-control feature available on GitLab.com and in the Self-Managed edition. When it is enabled and every paid license is already in use, GitLab blocks new paid users from being added. That keeps costs from climbing unexpectedly before the subscription comes up for renewal.

• The feature is available to instance administrators, group owners, and billing managers
• When enabled, it blocks new paid users once licenses run out
• It does not revoke or downgrade the permissions of existing paid members
• Users who don't need project access can be assigned the free Minimal Access role
• The feature works on both GitLab.com and GitLab Self-Managed

What changed in the identity provider integration

The key change concerns how the feature handles users provisioned automatically through SAML, SCIM, or LDAP. Previously, once licenses ran out, these users could end up in paid roles unintentionally. Now, when Restricted Access is enabled and no seats are free, GitLab automatically assigns them the free Minimal Access role, and syncing with the identity provider keeps running without interruption.

One important detail: Restricted Access only applies going forward. If you enable it in a group or instance that is already over its limit, GitLab does not downgrade or remove the permissions of existing paid members. Administrators still need to manually bring the user count in line with the license or buy more seats.

What it means

For companies with large user bases and automatic provisioning through corporate identity systems, the feature reduces the risk of accidentally overspending on GitLab licenses. But it does not fix any overspending that has already accumulated, and administrators still have to clean that up by hand.

FAQ

What happens to existing paid users who are over the limit?

Restricted Access does not downgrade or remove the permissions of existing paid members. Administrators have to bring the count in line with the license themselves or buy more seats.

Where is Restricted Access available?

The feature works both in the cloud-hosted GitLab.com and in GitLab Self-Managed.