## Problem Restricted Access (RA) requires Minimal Access (MA) users to be non-billable on Premium subscriptions to function properly. RA uses MA as a fallback role when identity provider syncs (SCIM/LDAP/SAML) attempt to add users beyond the seat limit. Without this change, the RA feature cannot work as designed. Currently, MA users are: - **Non-billable** on GitLab.com Premium and Ultimate - **Non-billable** on Self-Managed Ultimate - **Billable** on Self-Managed Premium ← this needs to change ## Proposal Make Minimal Access users non-billable on Self-Managed Premium subscriptions to enable Restricted Access functionality. ## Context ### What is Minimal Access? Minimal Access is a highly limited role that can only be assigned at the top-level group (not in subgroups or projects). [Users with Minimal Access](https://docs.gitlab.com/user/permissions/#users-with-minimal-access) cannot access subgroups or projects within that top-level group, making it primarily useful for organizational visibility rather than active development work. [Quote from `@jrandazzo`](https://gitlab.com/gitlab-org/fulfillment/meta/-/issues/2321#note_2602003886), highlighting mine: > Minimal access **makes sense to be non-billable for all distributions. It is a way to provision users without assigning access**, especially on GitLab.com. As organizations come into the picture, I could see the concept of "Minimal Access" going away as users would be provisioned at Organizations without access, then assigned membership accordingly. We are far out on this though. ### Revenue Impact Analysis **GitLab.com data** (from [issue](https://gitlab.com/gitlab-data/product-analytics/-/issues/3018#note_2771960515)): - 2,066 users with MA role on Premium parent namespaces (as of December 15, 2025 - [spreadsheet](https://docs.google.com/spreadsheets/d/1R6le2hV-wSpbmJgigZHbdIaiOESVCGNjlYL6dfapGRU/edit?gid=16800792#gid=16800792)) - MA already non-billable on .com Premium → $0 revenue impact on .com **Self-Managed Premium data:** - Unknown MA user counts (no Service Ping data available) * MA currently billable on SM Premium, so usage patterns may differ * We manually collected data from [28 Self-Managed Premium customers](https://docs.google.com/spreadsheets/d/16Ng504IJ6G8moS6PG5HgcnJjwhQiHX3tifp6yRsjOaU/edit?gid=0#gid=0) (96,226 total billable seats): * 27 customers: 0 MA users * 1 customer: 2 MA users * **MA usage: 0.002% of licensed seats in the customer sample** - We're adding instrumentation to gather this data going forward ([issue](https://gitlab.com/gitlab-org/gitlab/-/issues/584109)), but won't have sufficient data soon enough (requires 18.8 upgrade + 75% Service Ping opt-in rate) ### Business Justification **Revenue protection from enabling RA:** - See [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/584275#note_2957339737) for data on failed QSR payments - Improved auto-renewal success rates **Operational cost savings:** - 50% reduction in billing-related support tickets - Reduced collections team effort on failed QSR recovery - Decreased finance team time on overage reconciliation See [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/584275#note_2957339737) for additional info. ### Technical Necessity Alternative solutions (failing IdP provisioning when seat limit reached) would require: - Significant re-work of existing RA implementation - Poor, inconsistent UX across different identity providers - Reverting completed work from milestone 18.7 See [Slack discussion](https://gitlab.slack.com/archives/C08U6JYCJCF/p1765812369791259?thread_ts=1765805018.843539&cid=C08U6JYCJCF) for technical details. ## Related Issues - [Revenue impact analysis](https://gitlab.com/gitlab-data/product-analytics/-/issues/3018). - #584109 - Add MA user count instrumentation to Service Ping - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/210596 - Original implementation (reverted) - https://gitlab.com/gitlab-org/gitlab/-/issues/330663+ - original issue, closed in favour of this one ## Implementation Notes This change aligns SM Premium billing behavior with GitLab.com Premium and SM Ultimate, where MA users are already non-billable. ## Approvals - [x] @courtmeddaugh - [x] @abhaskar-gl (based on [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/584275#note_3072761662)) - [x] @james.shen (based on [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/584275#note_3079495775) - [x] @spatching (see [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/584275#note_3070568560)) - [x] @manav-gl (based on [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/584275#note_3079515203)) - [x] @jlatendresse (based on [comment](https://gitlab.com/gitlab-org/gitlab/-/issues/584275#note_3079548084)) - [x] @dtuan (in place of @SeanHall, OOO)