License Expiration - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR licenses are valid for the period of time associated with the license purchase. After your Cortex XDR license expires, Cortex XDR allows access to your tenant for an additional grace period of 48 hours. After the 48-hour grace period, Cortex XDR disables access to the Cortex XDR app until you renew the license.

For the first 31 days of your expired license, Cortex XDR continues to protect your endpoints and/or network and retains data in the Data Layer according to your data retention policy and licensing. After 31 days, the tenant is decommissioned and agent prevention capabilities cease.