Meraki licensing looks simple on the surface — per-device, per-year, three tiers — and is therefore one of the most over-bought lines in the Cisco portfolio. Buyers approve Advanced Security on switches that never see Internet traffic, accept SD-WAN Plus on MX devices that route only intra-office, and let co-term anniversaries drift until the contract has eight separate renewal dates inside a calendar year. This article walks through how Meraki licensing actually works, where the upsell pressure originates, and the renewal moves that hold Meraki spend to 20-30% below the standard Cisco proposal.
Every Meraki device — MX security appliances, MR access points, MS switches, MV cameras, MT sensors — requires a valid licence to function. Licences are sold per-device on annual subscriptions, 1, 3, 5, 7 or 10-year terms, with longer terms attracting modest discounting (typically 4-8% on a five-year versus annual purchase). Within each device family there are tiers — for MX, Enterprise and Advanced Security; for MR, Enterprise and Advanced; for MS, Enterprise. Each tier upgrade attaches additional feature entitlement at additional cost. Buyers who accept the default Cisco tier recommendation almost always end up paying for feature classes they will not deploy.
In our experience across 340+ engagements, the MX Advanced Security upsell is the single largest source of unnecessary Meraki spend — frequently applied to MX devices that act as simple branch routers without Internet egress, where the Advanced Security feature set adds no functional value. Right-tiering the MX estate alone typically recovers 15-25% of Meraki spend.
Tier rationalisation is the single largest source of recoverable spend on most Meraki estates.
Meraki licences default to co-termination — every licence in the organisation ends on the same anniversary date regardless of when individual devices were added. This is administratively convenient and economically opaque. Devices added mid-cycle are pro-rated to the co-term date at standard list, with no opportunity to renegotiate. The blended price-per-device across the estate is therefore impossible to read without modelling — which is exactly what Cisco prefers.
The negotiation move is to demand the licence-by-licence renewal proposal from Cisco rather than the consolidated co-term number. Without per-device line items, no rationalisation analysis is possible. With them, the over-licensed devices stand out within minutes.
Includes Meraki tier rationalisation framework, co-term renegotiation moves and Cisco EA structural tactics.
Cisco aggressively positions multi-year Meraki licences at modest list discounts. The economics work where the hardware will indisputably remain in service for the licence term. They do not work where there is meaningful uncertainty about the future of the device — branch consolidation, M&A, network architecture refresh. Multi-year licences on retired hardware become stranded assets with no refund mechanism. We have audited estates with eight-figure stranded Meraki entitlement on hardware that left the network three years before the licence ended.
The buyer-side discipline is to align licence term with hardware refresh cycle plus, at most, six months of buffer. Anything longer is a bet on infrastructure stability that rarely pays off. Aligning term to refresh cycle is one of the highest-yield moves in any Meraki software license optimization exercise, and it costs nothing to model before you commit.
Cisco's SD-WAN Plus tier and the broader Cisco+ Secure Connect bundle attach to the Meraki MX product line and are positioned as natural progressions. They are not natural progressions — they are material price-per-device step-ups that should be deployed only where the SSE and SASE feature sets are actively used. We routinely see buyers accept SD-WAN Plus on the back of an architectural roadmap that has not yet been validated, attaching 30-50% incremental licence cost to every MX in the estate. The discipline is to license SD-WAN Plus only on MX devices where the deployment is active and producing demonstrable security or routing benefit.
We model per-device entitlement against actual deployment and produce a rationalisation list within two weeks.
The device continues to operate for a grace period (typically 30 days), then enters a degraded state with reduced functionality and finally cloud-management cut-off. Operational risk is real — but it is also leverage. Cisco does not want devices in grace and will negotiate accordingly if the licence lapse is approached deliberately.
Not directly — the tier is fixed for the licence term. The recovery happens at renewal: tier-down at anniversary and pay for the tier you actually need going forward. Some buyers also negotiate licence credit for over-tiered devices that have not used the higher-tier features — this is bilateral and account-team-dependent, but achievable on strategic accounts.
They can be — Cisco offers Meraki licensing within the Cisco EA construct, with EA-style multi-year economics and true-up mechanics. Whether the EA is the right vehicle depends on overall Cisco spend; for Meraki-only estates the standalone Meraki licensing path is often cheaper.
For prepared buyers running a rationalisation analysis and bringing a credible competitive alternative: 20-30% off list across the estate. Multi-year commitments with no rationalisation typically produce 8-12% — which is what the Cisco proposal will offer by default.
Independent Meraki tier rationalisation — per-device entitlement against actual deployment, co-term renegotiation and a target price that holds Cisco to 20-30% below their opening number.
Weekly compliance intelligence for IT leaders.
