Meraki license tiers, compared
easyMeraki — Meraki license renewals by Ineapple Corp., a Cisco partner.
Every Meraki product line sells more than one license edition, and the renewal question is always the same: do I need the more expensive one? These are the feature differences, taken from Cisco's own licensing documentation. Each matrix links to the source.
Prices for every edition are on the renewal price list.
MX and Z security appliance licensing
| Feature | Enterprise | Advanced Security | Secure SD-WAN Plus |
|---|---|---|---|
| Who it is for | All I require is Auto VPN and a firewall. | I connect directly to the internet, so I need a UTM too. | My business relies on SaaS, IaaS and data-centre apps. |
| Included in every edition | |||
| Centralized management, zero-touch provisioning and firmware updates | ✓ | ✓ | ✓ |
| 24x7 enterprise support, hardware RMA and open APIs | ✓ | ✓ | ✓ |
| Stateful firewall, VLAN routing and group policies | ✓ | ✓ | ✓ |
| Site-to-site Auto VPN and client VPN | ✓ | ✓ | ✓ |
| Automatic WAN failover, uplink load balancing and cellular failover | ✓ | ✓ | ✓ |
| Sub-second dynamic path selection and VPN failover | ✓ | ✓ | ✓ |
| Traffic shaping, policy-based routing and NBAR traffic analytics | ✓ | ✓ | ✓ |
| High availability, splash pages and configuration templates | ✓ | ✓ | ✓ |
| Security (UTM) | |||
| Content filtering, powered by Cisco Talos | — | ✓ | ✓ |
| Intrusion detection and prevention (IDS/IPS) | — | ✓ | ✓ |
| Advanced Malware Protection (AMP) | — | ✓ | ✓ |
| Geography-based firewall rules | — | ✓ | ✓ |
| YouTube content restriction and web search filtering | — | ✓ | ✓ |
| SD-WAN and application intelligence | |||
| Meraki Insight advanced analytics with machine learning | — | — | ✓ |
| Smart SaaS quality-of-experience monitoring | — | — | ✓ |
| ThousandEyes internet intelligence and outage detection | — | — | ✓ |
| Web App Health, WAN Health and VoIP Health analytics | — | — | ✓ |
| Smart breakout | — | — | ✓ |
- On co-term licensing the MX edition is uniform across the organization — you cannot run some appliances on Enterprise and others on Advanced Security.
- An Enterprise organization cannot mix editions at all. An Advanced Security organization can add Per-Device SD-WAN Plus licenses to upgrade specific networks without converting everything.
- Z-Series teleworker gateways can be added to an organization regardless of its current MX license edition.
- Secure SD-WAN Plus is licensed by appliance SIZE (XS–XL), not by model.
Feature list from Cisco’s licensing documentation — read the source. Cisco changes licensing; we re-check it.
MR wireless licensing
| Feature | Enterprise | Advanced |
|---|---|---|
| Who it is for | Standard cloud-managed wireless. | I want the AI-driven operations and Adaptive Policy features. |
| Included in every edition | ||
| Cloud management, zero-touch provisioning and 24x7 support with RMA | ✓ | ✓ |
| Air Marshal wireless intrusion detection and firewall rules | ✓ | ✓ |
| API access | ✓ | ✓ |
| Cisco Spaces Essentials | ✓ | ✓ |
| Advanced only | ||
| AI configuration recommendations | — | ✓ |
| AI PCAP analyzer and proactive packet capture | — | ✓ |
| AI-RRM radio resource management | — | ✓ |
| Adaptive Policy | — | ✓ |
| MQTT data streaming | — | ✓ |
| AP port profiles (USB) | — | ✓ |
| Cisco Spaces Advantage | — | ✓ |
| Two free MT sensor licenses | — | ✓ |
- MR licenses are model-agnostic: any MR license covers any MR access point, so replacing an old AP does not require a new license.
- A co-term organization runs one wireless edition — MR Enterprise or MR Advanced. MR Upgrade licenses convert an Enterprise organization to Advanced.
- Advanced features generally require every AP in the network to hold Advanced (or Enterprise plus Upgrade).
- Automatic Umbrella integration was deprecated on 26 April 2025 and is no longer included in either edition.
Feature list from Cisco’s licensing documentation — read the source. Cisco changes licensing; we re-check it.
MS switch licensing
| Feature | Enterprise | Advanced |
|---|---|---|
| Who it is for | Cloud-managed switching. | I need Adaptive Policy segmentation or deep traffic telemetry. |
| Included in every edition | ||
| Cloud management, zero-touch provisioning and 24x7 support with RMA | ✓ | ✓ |
| Layer 2 and Layer 3 switching, VLANs and stacking | ✓ | ✓ |
| Port scheduling, access policies (802.1X) and topology mapping | ✓ | ✓ |
| Advanced only | ||
| Adaptive Policy (group-based segmentation) | — | ✓ |
| NetFlow v10 | — | ✓ |
| Encrypted Traffic Analytics (C9300 and MS390 only) | — | ✓ |
| Cloud EVPN fabric | — | ✓ |
- The Advanced tier exists only for MS130, MS150, MS390 and Catalyst C9300-M / C9200L-M. Other MS models are Enterprise only.
- On co-term, MS130 / MS150 / MS390 / C9300-M must all run the same tier across the organization — mixing produces an incompatible-license error.
- Adaptive Policy requires every switch in the network to hold Advanced.
Feature list from Cisco’s licensing documentation — read the source. Cisco changes licensing; we re-check it.
Common questions
- What is the difference between Meraki Enterprise and Advanced Security?
- Enterprise gives you the firewall, Auto VPN and SD-WAN essentials. Advanced Security adds the UTM layer — content filtering via Cisco Talos, IDS/IPS, Advanced Malware Protection, and geography-based firewall rules. Choose Advanced Security if the appliance faces the internet directly.
- Do I need an SD-WAN license to use SD-WAN on an MX?
- No. Every MX edition — including Enterprise, the cheapest — includes the SD-WAN essentials: site-to-site Auto VPN, sub-second dynamic path selection, automatic WAN failover, uplink load balancing, cellular failover, traffic shaping and policy-based routing. Secure SD-WAN Plus is not what makes SD-WAN work; it adds the application-intelligence layer on top — Meraki Insight analytics, smart SaaS quality-of-experience monitoring, ThousandEyes internet intelligence, Web App / WAN / VoIP health, and smart breakout. Buy it if you need to see and act on how SaaS and data-centre apps are performing, not to turn SD-WAN on. Note it is licensed per appliance by SIZE (XS to XL) rather than by model, and it is added to an Advanced Security organization.
- Can I run different license editions in one organization?
- On co-term licensing, generally no. The MX edition is uniform across the organization, and MS130/MS150/MS390/C9300-M switches must share one tier. An Advanced Security organization can add Per-Device SD-WAN Plus for specific networks; Z-Series can join any MX organization.
- Do I need MR Advanced?
- Only for the AI-driven operations features — AI-RRM, AI configuration recommendations, the PCAP analyzer — plus Adaptive Policy, MQTT streaming and Cisco Spaces Advantage. Air Marshal and the firewall are in Enterprise already.
- Which switches can take the Advanced tier?
- MS130, MS150, MS390 and Catalyst C9300-M / C9200L-M. Every other MS model is Enterprise only. Advanced adds Adaptive Policy, NetFlow v10, Encrypted Traffic Analytics and Cloud EVPN fabric.