Philip is spot on with everything he mentioned above. I will add a few points as well. My intent is not to place any blame. Rather just hoping to fill in some areas that might not be fully understood and hopefully it can help anyone that lands on this thread in the future. Also, it might give you some ideas on how to improve some areas of config in your org. This doc covers how SAML/SSO and email alerts work. It matches what Philip stated about needing at least one local admin account. As soon as licensing is oversubscribed it will place an org into an out of compliance/warning state and initiate the 30 day grace period. Also, devices only consume a license when placed in a network. Unused devices in the org inventory don't consume a license. I do also see your org has 8 local admins with write or read access. All of them appear to be partners/providers based on their email domains. They should have all been receiving these emails multiple times during the 30 day grace period (at 30, 21, 14, 7, and 1 days). Based on how your admin list is set up it appears no employees are local admins and therefore no one at your company would have received a license alert email. Another thing I noticed. The missing license that caused the compliance issue was emailed to you. However, the email it was sent to is different from what I see in your SAML login history. So, I'm not totally sure if you received the original order email with the license that should have been claimed back in November. Orders going to bad email addresses happens quite a lot as it depends on the partner/reseller that placed the order entering a legit address. I see typos at times or many times it's sent to someone outside of IT that will receive the email, but might have no idea what it is (like a Finance person, branch manager, etc). That reminds me of one more point. You should always be adding gear to orgs via the order number. That brings in the serials and license keys. In a case of just serials being added it can lead to this exact problem. I probably spend an hour or two every single week helping customers clean this up and it can all be avoided by claiming the order number to begin with. Bottom line, best practice is using SAML/SSO is totally fine. Just make sure you have at least one local admin configured with an email address (could be a mailing list) that people pay attention to. Having all your local admin accounts belonging to an external company isn't something I'd recommend (unless it's Meraki as a service and you don't own the hardware).
... View more
