GitLab refines Restricted Access to keep license costs in check

GitLab has updated Restricted Access, its mechanism for controlling license spending. It now covers more scenarios involving automatic user provisioning through third-party identity providers, reactivation of inactive accounts, and sign-in.

How Restricted Access works

Restricted Access is a seat-control feature available on GitLab.com and in the Self-Managed version. When it is enabled and all paid licenses are already in use, GitLab blocks new paid users from being added. This helps avoid unexpected cost growth until the subscription is renewed.

• The feature is available to instance administrators, group owners and billing managers
• When enabled, it blocks the addition of new paid users once licenses are exhausted
• It does not revoke or downgrade the permissions of existing paid members
• Users without access to projects can be assigned the free Minimal Access role
• The feature works both on GitLab.com and in GitLab Self-Managed

What changed in the identity provider integration

The key improvement concerns how the feature interacts with automatic user provisioning through SAML, SCIM or LDAP. Previously, when licenses ran out, such users could end up in paid roles unintentionally. Now, with Restricted Access enabled and no free seats left, GitLab automatically assigns them the free Minimal Access role, and synchronization with the identity provider keeps working without failures.

One important detail: Restricted Access only works going forward. If you enable it in a group or instance that is already over its limit, GitLab does not downgrade or remove the permissions of existing paid members. Administrators still have to bring the number of users in line with the license manually, or buy more seats.

What this means

For companies with many users and automatic provisioning through corporate identity systems, the feature reduces the risk of accidentally overspending on GitLab licenses. It does not fix any overage that has already built up, though, and that still requires manual cleanup by administrators.

Frequently asked questions

What happens to existing paid users over the limit?

Restricted Access does not downgrade or remove the permissions of existing paid members. Administrators must bring their number in line with the license themselves or buy more seats.

Where is Restricted Access available?

The feature works both in the cloud-based GitLab.com and in GitLab Self-Managed.