Licenses, contracts and delivery

Screen: Licenses (SAM) (1/2)



Screen: Licenses (SAM) (2/2)

Governance › Licenses puts side by side what the company bought (rights of use), what each SKU's metric consumes in the inventory, what is really used in the last 30 days, and the keys and activations the agents see. The screen has ten tabs: Position, Rights of use, Purchases import, Keys & activation, Key × contract, Editions, Microsoft 365, Idle licenses, Servers and databases and Concurrency. Every number is calculated by the platform. You need licenses:admin to change anything; with assets:read only you can look.

See, per SKU, the acquired quantity, the consumption by the metric, the real use and the balance, with the cost of a shortfall, of idle installations and of licenses left on the shelf.

Register rights of use by hand, or import purchases from CSV, XLSX or NF-e XML and curate unknown codes once.

Check keys and activation (not activated, reused key, OEM from other hardware, unknown KMS, public key) and reveal a full key for 30 seconds with an audited permission.

Cross the key on each computer with the installed edition and the purchased program (Key × contract).

Compare the installed edition and version with what was bought, respecting downgrade rights (Editions).

Read Microsoft 365 subscriptions: purchased × assigned × used, idle assignments and the contract × tenant difference.

Reclaim licenses installed but not used and follow the saving (Idle licenses).

See SQL Server, Oracle, PostgreSQL, MySQL, Db2 and SAP instances with the licenses their metric needs (Servers and databases).



Compare the monthly simultaneous peak with the concurrent licenses (Concurrency).

Open the product view: everything about one product on one page.

The four cards at the top are Idle cost (installed without use plus bought and not installed), Unused installations (no use measured in 30 days: candidates to reclaim), Deficits (with the cost to regularize) and No license registered.

The Position by SKU table has, for each SKU: Acquired (rights of use in force today), Consumed (by the SKU's metric), Used (30 d) (from usage metering), Balance and Cost. How the metric consumes:

An installation only counts for a SKU when its edition is the SKU's edition or one of its downgrade rights.

A negative balance turns the row red with a Shortfall pill ("shortfall of N licenses — cost"). Click the SKU name to open Who consumes (asset, user, edition, cores). Commercial products installed with no right at all are listed below the table, each with Register right of use.

The agent reports Windows, Office and firmware (OEM) keys with only the last 5 characters, the channel (Retail, OEM, OEM (OA3), Volume (MAK), KMS client, Subscription), the activation state and the KMS host. Use Filter by problem and Search device, product or last characters. When the system exposes the full key (the OEM key in the firmware, for example), it goes to the vault: Reveal (audited) shows it for 30 seconds to profiles with the See license keys permission, and every reveal is recorded.

Register your company's KMS servers in KMS hosts (Register host, or Mark as known on a host seen in the fleet). The "Unknown KMS" check only starts after the first host is registered; from then on, any other host is flagged.

For each Windows computer, the key the agent saw (edition and channel) is crossed with the installed edition and with the program of what was purchased. The findings are: Key from another channel, Volume without agreement (KMS/MAK without a volume agreement), Key of another edition, Edition not purchased, Upgrade without base (Enterprise by upgrade or subscription without the qualifying Pro license on the hardware), Evaluation key and No right registered. Click a finding chip to filter the list.

Installed edition against what was bought shows each installation as Covered, Covered by downgrade, Divergent ("edition above the one bought" or "version above the one bought") or Edition unknown (not compared, no alert). Subscription and Software Assurance cover newer versions. Exposure is the price difference to the right edition, when both prices are in the rights of use. The check runs every day; Check now runs it at once and opens or closes the system alert Upgrade without base license. The SKU lifecycle panel lists bought SKUs with an end of sale or support.

With Microsoft Entra ID connected and the administrator consent given, Hive reads the tenant (read-only) together with the Entra import, at most every 6 hours. The tab shows, per Subscription: Purchased, Assigned, Used in 30 days, No use, Disabled account, Registered contract (the rights of use of the matching SKU; "contract X × tenant Y" when they differ) and Waste / month (assignments without use, in disabled accounts or not assigned, times the average unit price). Below come the people with idle assignments and the computers with Microsoft 365 Apps whose user has no license that includes the apps. This tab needs licenses:admin.

Each paid product shows how many installations are Without use for its period (Days without use, from 30 to 365, default 60) and the Idle cost per year by the price in the rights of use. An installation is only "without use" when the agent has measured its use for longer than the period: otherwise it shows Measuring or Use not measured and never counts as idle.

The agent recognizes database servers by their services and processes (no table data is read) and reports engine, instance, version, edition, cores and whether it is running. Licenses per product sums what the metric needs against the rights of use: SQL Server per core with a minimum of 4 per server, Oracle Enterprise per processor (cores × 0.5); free editions (Express, Developer, Free) need none; other metrics stay Not calculated. With a read-only account, databases, tables and offenders also shows database sizes, largest tables, the costliest queries and blocked sessions.

For products with usage metering or concurrent licenses, the chart shows the highest simultaneous use per month in 12 months against the licenses valid in the month; red bars passed the limit. Create an alert rule for simultaneous use opens the alert rule wizard.

In Position, the product view link next to a SKU opens one page for that product: Position (acquired, consumed, used, balance), Contracts and rights (quantity, SKU, type, program, end, vendor), Edition divergences, Key × edition × contract and, for Microsoft 365 Apps, the Microsoft 365 panel.

The company bought 200 Microsoft 365 E3 licenses at R$ 180.00 each until 31/12/2026, and the agents found Microsoft 365 Apps on the computers of 214 people.

Microsoft Visio is installed on 40 computers; 12 have had no use for more than 60 days, and Visio costs R$ 1,100.00 per year per license in the rights of use.

Three servers run SQL Server: SQLPRD01 (Enterprise, 8 cores), SQLAPP02 (Standard, 2 cores) and SQLDEV03 (Express). The company bought 6 packs of SQL Server Standard (2-core pack).

Rights of use count only between Starts and Ends; an expired subscription leaves the position at once.

"Used (30 d)" and the idle lists need usage metering on the agent. Without it, nothing is called idle.

CAL metrics are not measured by the inventory; their consumption shows as not measured.

On Position, an Express installation counts against a Standard per-core SKU (Express is in its downgrade list), with the minimum of 4 cores; Servers and databases treats free editions as



needing no license. Compare both tabs before buying.

The Microsoft 365 tab is empty until Entra ID is connected with consent; the read is at most every 6 hours.

A recovery takes up to 500 installations at a time; "Open removal ticket" needs a connected ITSM tool.

Removing a right of use recalculates the position at once; the action is audited.

Contracts

Step by step: SAM and HAM reports

Software catalog

Software usage

Integrations center

AI recommendations

Screen: Contracts (1/2)



Screen: Contracts (2/2)

Governance › Contracts keeps every contract in one place with the dates that matter (end, notice deadline, true-up, price adjustment, warranty, leasing), the SKU lines that become rights of use, the documents and amendments, and the renewal decision. The screen has four tabs: Dashboard, Contracts, Warranties and coverage and Types. Viewing needs licenses:admin or audit:read; creating and changing contracts needs licenses:admin.

Follow expiries and notice deadlines on a calendar, and the committed value per period and vendor.

List, search and filter contracts, and export the list to CSV.

Register a contract with the six-step wizard.

Attach documents with versions, and register amendments that change the end, the value or the lines from a date on.

Record a renewal decision backed by the usage data, approved by a second license manager.

Receive alerts before each deadline, sent to the owner and the substitute.

See which hardware is covered by warranty, support, maintenance or leasing.

Create your own contract types, with custom fields and default alert days.

Dashboard: a banner lists the notice deadlines in the next 7 days. The cards show Committed in 12 months (in BRL, converted by the PTAX), Without owner, Recovered licenses and AI recommendations. Expiries and deadlines shows expiry, notice deadline, true-up, price



adjustment, end of warranty and end of leasing by Month or Quarter, as a calendar or a list (red: 30 days or less; yellow: up to 90 days). Committed amount groups the value by period and vendor; other currencies are converted by the Central Bank closing PTAX, read every 12 hours (Read the PTAX now reads it at once).

Contracts: Search (number, vendor, object), Type, Situation (Active, Notice soon, Renewed automatically, Ended), Only without owner and Export CSV.

Warranties and coverage: hardware Covered, Coverage ended or Never covered, by contract or by the warranty entered on the device, with the upcoming deadlines.

Types: the twelve built-in types (from Perpetual license to Outsourcing) and New type, with Covers hardware, custom fields (text, number, date, list) and Alert days before the deadline.

Click New contract. The wizard has six steps; each Next checks the step before moving on, and nothing is saved until Create contract.

Choose the type. The type decides the fields and the default alert days (120, 90, 60 and 30 days for the built-in types). Software types turn SKU lines into rights of use; hardware types add the end of warranty and of leasing and the Covered assets tab.

Fill Contract number and Vendor or reseller (required; the number must be unique for that vendor), and optionally Manufacturer, Object and Cost center. Choose the Owner, who receives the deadline alerts, and a Substitute. Without an owner, the alerts go to the license managers.

Set Start (required) and End (empty for no end), the Notice period (days), Currency (BRL, USD, EUR…), Total value, Adjustment index and Adjustment date, True-up date and, for hardware, End of warranty and End of leasing. The box below shows the calculated notice deadline (end minus the notice period). Turn on Renews automatically when the contract renews by itself if nobody gives notice. The step blocks an end before the start, a notice period without an end and a notice period longer than the term.

Add one line per SKU with Add line: SKU or reseller code, Quantity, Unit price, Kind of license and, if different from the contract, Line start and Line end. Each line becomes a right of use in the license position. An unknown code becomes "SKU pending curation" in the purchases curation queue; the right of use is created when the code is resolved. A contract can have no lines (services, hardware).

Use Add documents for the contract, proposal, invoice or amendment (PDF, DOCX, XLSX, PNG or JPG, up to 50 MB each) and set the Kind of document of each file. The files are sent right after the contract is created.

Review Alert days before the deadline: days before the end, separated by commas, from 1 to 730 (for example 120, 90, 60, 30). The alerts go to the owner and the substitute through the notification channels. Click Create contract; then Open the contract or Back to the list.



Summary: the dates, the notice deadline ("date (N days before the end)"), the value, the owner and, in the Renewal decision panel, the unused licenses of each line, the idle cost and the suggestion from the data.

Lines: add, change or remove lines. A reduction that leaves installations without license asks for confirmation ("This change leaves a deficit").

Consumption: who consumes each line, by cost center, by business service and on virtualization hosts.

Documents: download (every download is audited) or remove; the same name sent again becomes a new version.

Amendments: New amendment with Takes effect on, New end, New total value, the document and what changes in the lines. See the contract on a date shows it as it was then; Back to today returns.

Covered assets (hardware types only): Link devices by pasting serial numbers; at the end of a leasing the device enters the return list.

Recommendations: the AI renewal recommendations for this contract.

Edit and Remove (removing also removes the documents and the rights of use created by the lines).

Hive checks the contracts every hour and sends each milestone once, by the alert engine and by e-mail:



Of each group only the closest milestone is sent: a contract registered late does not receive a burst of old alerts. Contract notice deadlines in the next 30 days without a decision also appear in Decisions.

The infrastructure team signs a yearly support contract for the storage arrays with Datacenter Services Ltda, from 01/03/2026 to 28/02/2027, R$ 96,000.00, renewing automatically, with 90 days' notice to cancel. Today is 22/10/2026.

Without an End, there is no notice deadline and no expiry alert.

The notice period cannot be longer than the term, and the same number cannot be used twice for the same vendor.

Documents: PDF, DOCX, XLSX, PNG or JPG only, up to 50 MB each; an empty file is refused. If a document fails after the contract is created, the contract stays and the failure is listed.

An unknown SKU code creates no right of use until it is resolved in the curation queue of Licenses › Purchases import.

A perpetual line stays valid after the contract ends, with the maintenance marked as expired; a subscription line ends with the term.

A type can only be removed when no contract uses it.

Without an owner and a substitute, the alerts go to the people with the License manager profile.

Step by step: register contracts



Licenses (SAM)

Decisions

Lifecycle

AI recommendations

Screen: Lifecycle, depreciation and responsibility terms

Governance › Lifecycle follows each device from the order to the disposal: the stage it is in, how much it is still worth, when it should be replaced, who signed for it and how its data was erased. It also shows the systems, software and hardware models that are past or near the end of support, and compares your fixed-asset register with what Hive discovered. Most actions on a single device are done on the device page, in Management › Location, purchase and lifecycle.

Stages: count the devices that are Ordered, In stock, In use, In maintenance, Retired and Disposed, and see what is in maintenance and when it should come back.

Lifecycle models: set, per kind and model of equipment, the useful life, the refresh period, the warranty and the depreciation method.

Depreciation: see the fleet's purchase value, book value and depreciation, the refreshes due in 90 days and the devices fully depreciated but still in use.

Responsibility terms: follow the delivery and return terms issued on devices and whether the person accepted them.



Sanitization: list the numbered sanitization certificates (NIST SP 800-88) issued before disposal or reuse.

Register conformance: import the fixed-asset spreadsheet and see what is registered but not found, discovered but not registered, and the differences.

End of support and Catalog: see what is out of support or about to be, and add your own end-of- support dates.

Open the device (Assets › All assets, click the name) and go to Management › Location, purchase and lifecycle. Three panels matter here:

Lifecycle stage: shows the Current stage: and every change with date, author and form. Change stage opens the form: New stage, Date (empty: today), the fields of the stage and a Note.

Ordered: Order or invoice.

In stock: Where it is stored.

In use: Who uses it.

In maintenance: Vendor or technician, Ticket, Expected return.

Retired: Reason (required, at least 3 characters).

Disposed: Destination (Sale, Donation, Recycling, Destruction, Returned to the lessor), Data wiped (required) and Certificate or document (optional).

Purchase, depreciation and documents: shows the purchase date, price, book value (and % depreciated), the lifecycle model, the refresh date and Warranty until. Its buttons are Purchase data, Responsibility term and Sanitization certificate.

Contracts, warranty and end of support: the contracts that cover the device, Set warranty for a warranty end without a contract, and what on the device is out of support.

Retired and disposed take the device out of the active estate (it stops counting in reports and alerts); moving it back to In use reactivates it. If the device is linked to a line of the imported register, that line follows the stage.

The most specific model applies to each device (kind and model > model > kind). On a device, Purchase data lets you fill Purchase date, Price, Invoice, the usage reading and choose a Lifecycle model other than Automatic (by kind and model). The book value never goes below the residual value. The refresh date is the purchase date plus the refresh months; the warranty is the one typed on the device or, without it, the purchase date plus the warranty months of the model.

Depreciation shows Purchased, Book value, Depreciated and Devices without purchase data, a note with how many devices have no model, the lists Refresh due in 90 days or overdue and Fully depreciated and still in use (up to 50 shown each) and the table of every device with a price.

Responsibility terms lists every term with Number, Device, Person and Status (Waiting for acceptance, Accepted or Cancelled, with the acceptance time). Document (PDF) opens the printable term in a new tab; save it as PDF from the browser.

On the device, Sanitization certificate asks Level (NIST SP 800-88) (Clear, Purge or Destroy), Technique and Performed by (both required), Tool, Verified by, Date (not in the future), Result (Passed or Failed) and Note. Issue certificate numbers it (SAN-year-sequence), attaches the disks known from the inventory and the content hash, and opens the document to print. The Sanitization tab lists all certificates.

End of support crosses the catalog with the inventory: operating systems, installed software and hardware models (manufacturer + model) past or near the end of support. Change Support ending within (days) (default 365) to widen or narrow it; the indicators show Items, Devices out of support and Devices at risk, and clicking the device count lists sample devices. Alerts go out 180, 90 and 30 days before and at the end.

In Catalog, Add entry asks Type (Operating system, Software or Hardware model), Item, Match (text or regular expression, case-insensitive), End of support and Note. Built-in entries are marked Built in; yours are marked Company and can be removed. An entry with the same name as a built-in one replaces it.

Worked example: hand a notebook to an employee with a signed term

Mariana Souza Lima joins Finance and receives the notebook FIN-NB-042 with a charger, a mouse and a backpack.

Worked example: an in-house application reaches end of support

Viewing needs permission to read assets; changing stages, models, purchase data, issuing terms and certificates and importing the register need permission to change assets.

The Kind of device of a lifecycle model matches synonyms: laptop matches the devices the inventory classifies as notebook , and desktop or computer match desktops and workstations. Virtual machines ( vm ) only match a model without a kind or with the model name.

Depreciation needs both the price and the purchase date (by usage, the price and a reading or agent hours); without them the book value stays empty.

The term is accepted once. A term already accepted or cancelled shows its state and cannot be accepted again; the console has no cancel button (the API does). The acceptance link has no expiry date.

The e-mail with the link goes only when an address is given and the e-mail service is configured; the link always appears in the issue window.

The term text is generated in the console language (English, Portuguese or Spanish) and is frozen with its hash when issued.

Each register import replaces the previous one. Lines without an asset tag, or with an unknown stage, are reported as warnings in the toast (a line with an unknown stage is kept as In use); up to 50,000 lines are read. Column names are accepted in English, Portuguese or Spanish.

The conformance table shows up to 1,000 findings; Export CSV exports all of the filtered ones.

Retired asks for a reason and Disposed asks for the destination and whether data was wiped; the date cannot be in the future.

Assets and inventory

Contracts

Step by step: SAM and HAM reports

Software usage

Organization structure

Screen: Software store (1/2)



Screen: Software store (2/2)

The Software store lets people install approved software on their own computer without being administrators. It is not a mass deployment tool: every install starts with the person acting on their own device. People reach it from the agent on their computer or, signed in to Hive, in Delivery › Portal; the people who approve requests use Store approvals. Packages get into the store through Packages.

Open the store from the computer (shortcut, tray icon or command) and install, update or uninstall approved software.

In the signed-in portal, ask for software that needs approval, with a reason, and follow it in My requests.

Cancel a request that is still waiting for approval.

As a manager or license manager, approve or deny requests in Store approvals, with the license availability at hand.

The agent installation creates the ways to open the store on each computer:

Windows (MSI, and install.ps1 or GPO), for all users: the Hive Store shortcut in the Start menu and on the Desktop. The Desktop shortcut is on by default; turn it off with STORESHORTCUT=0 in the MSI or -NoDesktopShortcut in install.ps1 .

Windows notification area: the Hive icon ( hive-agent tray ), started at logon from the Startup folder; it appears from the next logon. Its menu has Open Hive Store (the default item), Check

for surveys and About Hive agent (version, connected or not, last contact), in the language of Windows. Turn it off with TRAY=0 in the MSI or -NoTray in install.ps1 .

store.desktop ).

On any system, the command hive-agent store .

The icon (the "tray" module) is on by default on workstations and VDI; on servers only when requested; on Tier 0 devices it never exists, and there is no store there. Uninstalling the agent removes the shortcuts and the icon.

All of them open the local address http://127.0.0.1:47482/store . The agent asks the core for a personal link bound to that computer, valid for 8 hours, and the browser is redirected to it, with no sign-in. The page (Software store, "On this computer: name · user") shows:

the catalog of that device: only versions approved and published to the store channel, filtered by the package visibility and the device system;

My requests of that device, with Cancel while a request still waits for approval;

the quick surveys from IT that are open for that computer, if any.

Click Install, Update to a version or Uninstall, then Confirm. The installation starts right away: through this link there is no per-request approval, because the version was already approved before it was published. The requester recorded in the audit trail is the computer's primary user (or the computer itself when no user is known).

People whose profile uses the store open Delivery › Portal ( /store ) in Hive:

Each package says who approves in Approval before installing: No approval, Manager, License manager or Manager and license manager.

Manager is the requester's manager in the directory (Active Directory or Entra ID) or a store administrator.

License manager is anyone whose profile manages licenses.

Approvers open Store approvals ( /store/approvals ). License managers and store administrators also find the requests in Delivery › Approvals (group Store requests) and in Home › Decisions. Each request shows the package, who asked, the device, the reason, your role ("as manager", "as license manager") and the licenses: "Licenses: N available (bought, in use)". Type a Message to the person and click Approve or Deny. The install starts as soon as every approval the package needs is in.

Ana Souza (Finance) needs Adobe Acrobat Reader on her notebook FIN-NB-014. The package "Adobe Acrobat Reader" is published to the store with Approval before installing = Manager and visible to the Finance department. Her manager in Active Directory is Carlos Lima.

Bruno, at the reception PC RCP-01, needs 7-Zip, which is published to the store channel with no approval.

The training lab has 24 shared Windows PCs (LAB-01 to LAB-24). IT wants the store available without cluttering the Desktop.

The icon appears only from the next logon after the installation. Servers have it only when requested; Tier 0 devices never have the store.

The personal link only works on the computer itself: the local address answers only on 127.0.0.1 and refuses navigation coming from another site. An expired link shows "This store link has expired": open the store again from the agent.

The link opened from the agent skips the per-request approval. If a package must be approved by the manager for each request, people must ask in the signed-in portal (Delivery › Portal).

The agent cannot open the store until the computer has sent its first inventory ("This agent does not open the store portal yet.").

Only versions published with the channel Authorized store only or Store and deployment appear; Deployment and patch only versions never show in the store.

With a License SKU on the package and no free license, the store refuses the install: "There is no free license for this software right now."

There is one open request per item and device ("There is already a request for this item on this device.").

Whoever asked cannot approve their own request. The directory manager is found by matching e- mails, so the directory must be connected and the manager's e-mail must be the one used to sign in to Hive.

Only a request waiting for approval can be cancelled. Uninstalling needs an uninstall command in the package.

Every store card shows the icon of its operating system (Windows, macOS or Linux), and a line at the top says which system the list is for, such as "Showing what runs on macOS" — the system of the computer the store was opened for. Items made for other systems do not appear.

Packages

Step by step: create a package and publish it in the Store

Third-party catalog

Decision queue and approvals

Deployments

Licenses

Screen: Packages and store catalog (1/2)

Screen: Packages and store catalog (2/2)

A package is a piece of software that Hive can install: the installer (or a package manager id), the silent commands, how Hive knows it is installed and who may see it. Each version goes through Send → Test→ Package → Approve → Publish before it reaches the store or a deployment. Packages are in Delivery › Packages; what people find in the store is in Delivery › Catalog.

Create a package and set its category, catalog product, approval, visibility, icon, license SKU and dependencies.

Add versions from an installer file or from winget, Chocolatey, Homebrew, apt or dnf.

Test each version on a pilot device, confirm the commands and the detection rule, and send it for approval.

Approve or reject a version (someone else) and choose its channel; publish, retire and restore versions.

See who has the software and offer the update to devices on older versions.

Check in Catalog what each person can find in the store.

Delivery › Packages lists every package with its lifecycle status: Draft (gray), In test (blue), In approval (yellow), Published (green) and Retired (red). The chips on top filter and count each status. You can also search, filter by category, system and channel (Clear filters resets them). The columns show the published versions with their channel, the versions in progress and their stage, who sees the package, the number of installations, the license (free of total) and the last change.