The license deactivation process enables you to self-manage licenses. Whether you want to remove one or more active licenses or subscriptions attributed to a firewall (hardware-based or VM-Series firewall) or you want to deactivate the VM-Series firewall and unassign all active licenses and subscriptions, begin the deactivation process on the firewall or Panorama (not on the Palo Alto Networks Customer Support web site).

To successfully deactivate a license, you must install a license deactivation API key and enable verification of the update server identity (enabled by default). PAN-OS uses this deactivation API key to authenticate with all update a license services. The deactivation API is key is not required for manual license deactivation, where there is not connectivity between the firewall and license server.

If the firewall/Panorama has internet access and can communicate with the Palo Alto Networks Licensing servers, the license removal process completes automatically with a click of a button. If the firewall/Panorama does not have internet access, you must complete the process manually in a two-step process. In the first step, from the firewall or Panorama, you generate and export a license token file that includes information on the deactivated keys. In the second step, while logged in to the Palo Alto Networks Customer Support website, upload the token file to dissociate the license keys from the firewall.