All Products
Search

This Product

    Security Center:Disable elastic protection

    Document Center

    Security Center:Disable elastic protection

    最終更新日:Aug 17, 2026

    When the actual usage of Security Center exceeds the subscription quota, elastic protection is automatically enabled and generates pay-as-you-go bills. This topic describes how to disable elastic protection and the billing impact and precautions after disabling.

    Usage notes

    Elastic protection is the pay-as-you-go mechanism of Security Center. When the actual usage exceeds the subscription quota, the system automatically enables elastic protection and generates additional fees.

    Recommendations

    Decide whether to disable elastic protection based on your business requirements:

    • Recommended to disable: The subscription quota is consistently sufficient, strict budget control is required, and the business scale is stable.

      Important

      We recommend that you perform this operation during off-peak hours and ensure that other security measures are in place.

    • Recommended to keep: Business workloads fluctuate significantly, the attack surface is uncertain, or continuous security compliance coverage is required.

    Supported features

    • Features that can be disabled together: Protected Servers (edition services), Agentic EDR, Anti-Ransomware, and Agentic Cloud Platform Configuration Check.

    • Feature that must be disabled separately: Attack Management.

    Disable protection

    Different feature modules have different entry points for disabling elastic protection. Choose the corresponding operation based on the module you are using.

    Disable all

    Supported feature modules

    Protected Servers (edition services), Agentic EDR, Anti-Ransomware, and Agentic Cloud Platform Configuration Check.

    Procedure

    1. Confirm that elastic protection has been triggered (view elastic protection usage)

        Access the Security Center console - Asset Center - Asset Overview. At the top of the left side of the page, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

    2. On the Overview page, in the Subscription section, check the usage statistics (used quota/subscription quota) on the right side of the service modules that support unified disabling. If the used quota exceeds the subscription quota, elastic protection has been triggered.

    3. Release or upgrade quota:

      Upgrade quota

      1. On the Overview page, in the Subscription section, click Change Configuration > Upgrade Now.

      2. On the Order Upgrade tab, set the quota change as needed and complete the payment.

        Note

        The newly purchased quota must exceed the difference between the used quota and the current subscription quota.

      Release quota

      • Protected Servers: For more information, see Change the edition of an instance.

        1. Click Manage on the right side. On the Quota Management page, find the servers that do not require protection (the protection edition is Basic or above).

        2. In the Target Version column of the target server, change the protection edition to Basic.

      • Agentic EDR: Agentic EDR is an agent-based endpoint detection and response feature. It is different from instance protection editions and requires separate quota management. For more information, see Manage Agentic EDR.

        1. Click Manage on the right side. On the Quota Management page, find the servers that do not require protection.

        2. In the Agentic EDR Seat column of the target server, turn off the switch.

      • Anti-Ransomware: On the Anti-Ransomware page, click Release after Capacity Used by Servers or Capacity Used by Databases. The capacity decreases within 24 to 72 hours.

    4. Turn off elastic protection: After releasing the excess bound quota, in the Overview page, above the Subscription section, turn off the Elastic Protection switch.

    5. Verify the result:

      • Confirm that the Elastic Protection switch is in the off state.

      • No elastic protection bills are pushed from the third day after disabling.

        Important

        Elastic protection fees incurred on the day of disabling are still billed on the next day.

    Disable separately

    Supported feature modules

    Attack Management

    Procedure

    Attack Management

    1. Log on to the Security Center console.

    2. On the Overview page, in the Attack Surface Management section, turn off the Full Protection switch.

    Impact

    Note

    Elastic protection applies only to Subscription. Standalone pay-as-you-go services are not affected.

    • After you disable elastic protection, it immediately becomes invalid and no longer automatically extends quotas.

    • Within a subscription billing cycle, once the base quota is exhausted, the related protection services stop because they cannot scale up.

    • Elastic protection fees incurred on the day of disabling are still billed on the next day.

    FAQ

    • What do I do if I cannot turn off elastic protection?

      • Cause: Usage for Protected Servers, Agentic EDR, or Anti-Ransomware has exceeded your annual subscription quota.

      • Solution: Complete the released or upgraded the quota operation first. Make sure that the used quota does not exceed the subscription quota, and then turn off the elastic protection switch.

    • How do I re-enable elastic protection? Does it take effect immediately?

      On the Overview page, above the Subscription section, turn on the Elastic Protection switch. Elastic protection takes effect immediately after you turn on the switch.

    • Where is the elastic protection switch?

      Warning

      If the current used quota exceeds the subscription base quota and you have not released or upgraded the quota, the system does not allow you to disable elastic protection.

      • Protected Servers (edition services), Agentic EDR, Anti-Ransomware, and Agentic Cloud Platform Configuration Check: These features are controlled by the same switch. The switch is located above the Subscription section on the Overview page.

      • Attack Management: This feature has a separate switch. The switch is located in the Attack Surface Management section on the Overview page.

    • Why am I still receiving bills after disabling elastic protection?

      • Elastic protection fees incurred on the day of disabling are still billed on the next day.

      • If you have separately purchased or activated other pay-as-you-go services and have not disabled them, the corresponding pay-as-you-go bills are still pushed.

        Note

        You can view and disable the activated pay-as-you-go services in the Enable Pay-as-You-Go Service section on the Overview page.

    • During the release of Anti-Ransomware capacity, the Elastic Protection switch cannot be turned off. Will this result in continuous charges?

      No. Elastic Protection fees are adjusted in real-time. High fees will not continue to accrue simply because the switch is temporarily unavailable. Details are as follows:

      • Billing takes effect immediately: After releasing quotas for Anti-Ransomware, Server Protection Authorization, or Agentic EDR, the billing base for Elastic Protection is reduced immediately.

      • Display latency exists: There may be a brief synchronization delay in the "Capacity Statistics" data on the console. This is normal and does not affect the actual bill amount.

      • Recommended next steps: Monitor the release progress closely. Once the release is complete, immediately turn off the Elastic Protection switch.