> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getnao.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> nao Enterprise license, supported features, and how to get a quote

nao Enterprise is the licensed tier of self-hosted nao. It unlocks features that are restricted to organizations with a signed license (currently SSO and Microsoft Entra ID-based row-level security on Redshift), and runs on the same self-hosted deployment you already use for OSS nao.

<Info>
  nao Enterprise applies only to **self-hosted deployments**. nao Cloud organizations get the equivalent features as part of their Cloud plan and do not need a separate license.
</Info>

## What's included

| Capability                                                                           | OSS | Enterprise  |
| ------------------------------------------------------------------------------------ | --- | ----------- |
| Open-source agent + chat UI, all LLM providers                                       | ✅   | ✅           |
| Slack / Teams / WhatsApp / Telegram bots                                             | ✅   | ✅           |
| Self-hosting on your infrastructure                                                  | ✅   | ✅           |
| Admin / Member / Viewer roles                                                        | ✅   | ✅           |
| Microsoft SSO (Azure AD / Entra ID)                                                  | -   | ✅           |
| Okta SSO                                                                             | -   | Coming soon |
| Per-user identity passthrough to Redshift (RLS)                                      | -   | ✅           |
| [White-label branding](/nao-agent/enterprise/white-label) (logos, favicon, app name) | -   | ✅           |
| Priority support and roadmap input                                                   | -   | ✅           |

The list of features available on a given license is encoded in the signed license payload itself. The currently shipped feature flags are `sso` and `white-label`; new features are added as they ship.

## Getting a license

nao Enterprise licenses are issued per company on a yearly subscription. To request a quote and a license key:

1. Email [claire@getnao.io](mailto:claire@getnao.io) with your company name, expected user count, and which features you need (SSO, Redshift RLS, both).
2. We send back a quote and, once signed, a license key tied to your `subscriptionId`.
3. You install the key as the `NAO_LICENSE` environment variable on your nao deployment (see below).

Trial licenses are available on request.

## Installing the license

The license is a signed token. Verification happens **offline** at server startup against the public key bundled in the build, so your nao deployment never has to phone home to validate the license.

1. In your deployment environment (e.g. Cloud Run, ECS, Kubernetes), set:

   ```bash theme={null}
   NAO_LICENSE=<the license key you received>
   ```

2. Restart the nao backend. On startup, the server logs the license verification result.

3. Sign in as an admin and open **Settings -> Enterprise**. The page shows the license status, expiry date, company name, and the list of activated features.

### License statuses

The Enterprise settings page reports one of four statuses:

* **Active** - signature valid and within expiry. Enterprise features are enabled.
* **Expired** - signature valid but the expiry date has passed. Renew the license to re-enable Enterprise features.
* **Invalid** - `NAO_LICENSE` is set but verification failed (bad signature, malformed token, key mismatch). Check that you copied the full key and that you're on a recent nao build.
* **Unlicensed** - `NAO_LICENSE` is not configured. The deployment runs in OSS mode.

When a license expires or becomes invalid, the gated Enterprise features are disabled cleanly - the rest of nao keeps running as the OSS build.

## Next steps

<CardGroup cols={2}>
  <Card title="Authentication" icon="key" href="/nao-agent/enterprise/authentication">
    Configure Microsoft SSO for your nao deployment
  </Card>

  <Card title="Permissions" icon="shield-halved" href="/nao-agent/enterprise/permissions">
    Per-user identity passthrough and Redshift RLS
  </Card>

  <Card title="White-Label Branding" icon="palette" href="/nao-agent/enterprise/white-label">
    Replace nao branding with your own logos, favicon, and app name
  </Card>
</CardGroup>