August 8th, 2019
Is an Admin License Needed for a Cognos Services Account?
Recently, a Lodestar Cognos Analytics (BI) client reached out seeking clarification asking, “Is an admin license needed for a Cognos Services Account?” We realized this is a question many IBM Cognos Analytics (BI) clients might be wondering and it’s an important question because if you don’t do it correctly, you could have issues if you were to be audited by IBM. Or, you might be paying more for your IBM Cognos Analytics licenses then you should.
What is a Cognos Services Account?
Many Cognos BI clients determine it is important to set up a network service account for their IBM Cognos Business Intelligence. A network service account, sometimes called the Cognos Services account, is the built-in account NT AUTHORITY\NetworkService in the operating system. The benefit is that the administrators do not need to manage a password or maintain the account. The network service (Cognos Service) account under which IBM runs must have access to all required resources, like printers, and have the rights to log on as a service and act as part of the operating system. The network service account must also be a member of the local administrator group. For example, to print reports using a network printer, the account must have access to the network printer, or you must assign a logon account to the IBM Cognos service.
Do I need an IBM Cognos Administrator License for the Network Service Account?
The question a lot of clients ponder is whether under IBM Cognos licensing rules, does the client need to purchase an IBM Cognos Analytics administrator license for the Cognos Services Account?
Client’s Cognos Services Account Example
For the client that asked the question, their Cognos administrator had a Cognos analytics user license assigned to them, which was their primary account for 96% of what they did. The few times an administration action was required, the Cognos administrator signed in using the Cognos network service account, made changes, and then logged back out.
The client preferred that the Cognos administrator use the Cognos Services Account only for admin specific actions and not as their primary account. But what they didn’t realize was they were paying too much for their Cognos licenses. They were paying for a Cognos Analytic user license for the Cognos administrator and they were also paying for a Cognos Administrator license for the Cognos Services Account. The client wasn’t sure whether Cognos 'network service' accounts are treated as a separate user. So to be on the safe side they bought it an IBM Cognos administrator license, which is not cheap when they didn’t need to.
The Answer is Cognos Network Service Accounts Are Not Considered a Separate User
An IBM Cognos Analytics (BI) admin user can have multiple accounts that they logon with including a service account. So, if the Cognos administrator is the one who sets the network service account up and responsible for maintaining it, then all they need is a Cognos Administrator license for the administrator. The IBM Cognos Analytics (BI) Administrator license is licensed as an authorized user license. Under the IBM Passport Advantage Agreement an authorized user means that each person must have their own license, no sharing and it is not a concurrent license.
Why the client paid too much for Cognos Licensing
If the administrator of the Cognos BI system has a Cognos Analytics administrator license, there is no additional licensing required for the Cognos Services Account. So, in the example above they didn’t need the Analytic User license for their administrator, they just needed to give him the administrator licenses. It is common for admins to have multiple logins for Cognos, their everyday login, and the network service account. However, if you have other users who do not have administrator licenses, and you ask them to login with the network service account you would most likely be violating the IBM licensing and could fail an IBM licensing audit because the user was accessing admin functionality they did not own.
For more information on IBM audits visit:
What to know before IBM Audits Your IBM Cognos Analytics and Planning Analytics Licenses
What If 3 users Need to Access the Cognos Services Account?
If the client has the Cognos network Service account set up and they have 3 different administrators that need to log into that account periodically, and all of them have Cognos Analytics Administrator licenses then they still would not need to have a separate license for the Cognos Network service account. Basically, if everyone that logs into the network service account has their own IBM Cognos Administrator license, you are good.
You Must Restrict your Users
Now that you know how the licensing works around the Cognos Services Account, we recommend you do a licenses review and ensure your Cognos users are restricted properly. We recently had a client audited by IBM and they discovered their policies on setting up users for Cognos were not being followed and the person added new users accidentally and set up the users with all access. As a result, the audit showed they had 21 more administrator users than they had licensing for! Needless to say, that was a scary and potentially expensive mistake! So, the most important thing you must do is to make sure you have properly restricted users based on the Cognos Analytics licenses assigned to them.
If you need more information on how to restrict your users, check out IBM’s site on How to Restrict Your Cognos Users. Lodestar Solutions also recommends that every client turn on auditing for their Cognos BI environment. Here’s our earlier Blog on Turning on Cognos BI Auditing.
What capabilities does each Cognos Analytics license have?
Before you restrict the users, you should make sure you understand the capabilities of each of the IBM Cognos Analytics licenses. IBM has changed the licensing over the years so it’s best to discover the latest definitions. We believe every client should have a copy of the IBM Cognos Analytics Capabilities Matrix. (Sample above) To get your complete copy, email us at services@lodestarsolutions.com and request the IBM Cognos Analytics capabilities document that informs you of what components of the software are available to the various license types. For another resource to check out on Cognos licensing click here.
Need Help?
Lodestar Solutions is happy to educate you on the IBM license options and help you review your specific Cognos Analytics business intelligence entitlements. If Lodestar can’t answer your questions, we will find someone that can. Contact us at services@lodestarsolutions.com or 813-415-2910.