Managed AIRS for AWS Procurement and Management with Software NGFW Credits

Table of Contents

Software NGFW Credit Distribution and Management

Managed AIRS for AWS Procurement and Management with Legacy Cloud NGFW Credits

Managed AIRS for AWS Procurement and Management with Software NGFW Credits

Interchange and allocate credits among your Managed AIRS for AWS resources regardless of the cloud deployment method.

Where Can I Use This?	What Do I Need?
Managed AIRS for AWS	Managed AIRS for AWS subscription Palo Alto Networks Customer Support Portal account AWS Marketplace account Credit Admin or Super User role in Customer Support Portal

You can procure and associate Software NGFW credits to your Managed AIRS for AWS tenants by paying an upfront cost for a long-term contract between one and five years. You can procure these credits directly from Palo Alto Networks or its partners. Your Palo Alto Networks sales team and its partners can send these credits to you directly or by using Cloud provider marketplace Private Offers. These private offers (such as AWS Private Offers or AWS Consulting Partner Private Offers) allow you to take advantage of Cloud Marketplace benefits such as consolidated billing and spend commitments (AWS EDP).

Consider the following when using Software NGFW credits with Managed AIRS for AWS:

Software NGFW credits are term-based. Terms can be defined for any amount of time between one and five years. Both allocated and unallocated credits expire at the end of the agreed-upon term.
If your monthly average consumption exceeds the purchased credits, additional usage/overage charges are charged at PAYG rates.
If you add Software NGFW credits during a free-trial period, your contract starts immediately and overrides the free trial.
Use the Managed AIRS for AWS pricing estimator to help you determine AWS pricing for your Managed AIRS for AWS tenant.
You can procure credits for Managed AIRS for AWS and all the CDSS services you intend to use.

You must first subscribe to Managed AIRS for AWS through AWS Marketplace and create a tenant prior to setting up your deployment profile.

Activate Software NGFW Credits

Once you book the order for credits, they become active immediately, and an email is sent to enable you to start using your credits; for example, if you purchased credits for a one year term on September 6, 2026, the credits are active from that day forward, while the term lasts, in the case of this example, until September 5, 2027. The person listed as the administrative contact in the quote receives the activation email. The email provides details about the subscription, the credit pool ID, the subscription start and end date, the number of credits purchased, and the description of the default credit pool. You can use these details to activate credits in your Customer Support Portal (CSP) account.

Palo Alto Networks recommends retaining this email to access information related to your account.

Select one of your CSP accounts for the credit pool during activation. Once your credit pool is active, you can manage and allocate the credits to your Managed AIRS for AWS tenants using the Credit Management Application described below.

In the email, click Start Activation to view your available credit pools.
Select the credit pool you want to activate. Use the search field to filter your account list by name or number. If you've purchased multiple credit pools, they will be automatically selected by default. Check marks indicate which pools are eligible for activation and onboarding.

When proceeding, you'll be prompted to sign in or authenticate.

If you deselect a credit pool, a reminder appears letting you know that you'll need to return to activate it later.

If you're an existing superuser or admin, the Credit Admin role is automatically added to your profile.

If you're new to the Customer Support Portal, an account is created for you with the Credit Admin role assigned.
Select Start Activation.
Select your support account (you can search by account number or name).

You can create multiple accounts within your organization.

When activating your credits, you must select one account per default credit pool.
Select the default credit pool.
Select Deposit Credits.

A message indicates that the deposit was successful.
Once activated, Credit Admins can:
- Allocate credits to specific deployments
- Transfer credits to other pools if needed
Create and Associate a Deployment Profile.

Associate Software NGFW Credits

Do the following:

Step 1: Create a Parent Deployment Profile in Customer Support Portal
Step 2: Create a Child Parent Deployment Profile in Credit Management Application

Step 1: Create a Parent Deployment Profile (CSP)

Log in to your Palo Alto Networks Customer Support Portal (CSP).
In the left navigation pane, expand Products and select Software/Cloud NGFW Credits.
Click Create New Profile.
Provide a descriptive name, select your target unified pool SKU, and specify CNGFW as the primary service type.
Enter your desired credit capacity and click Submit.

The global unallocated support balance will show a reduction equal to your input amount plus the 18% support overhead block.
Copy the automatically generated DP Authorization Code (AuthCode) from the profile grid for confirmation tracking.
Click Create Deployment Profile.

Step 2: Configure a Child Deployment Profile on Credit Management System (CMS Hub App)

Log in to the CMS Hub App.
Verify that the dashboard shows a credit pool container matching your CSP configuration, labeled with your DP AuthCode.
Click Create Deployment Profile on the target credit pool row.
Select Amazon Web Services (AWS) as your cloud infrastructure provider.
Enter the target AWS Tenant ID string and assign a specific credit allocation limit to this tenant.
Check or uncheck the Enable Smart Credit Buffer box depending on your overage preferences.
During Deployment Profile setup or modification in CMS, the Enable Smart Credit Buffer checkbox controls buffer access rules:
Enable Smart Credit Buffer (Default): If an overage occurs, the tenant automatically draws from the central unallocated credit buffer. If the buffer has a sufficient balance, it covers the entire overage, resulting in zero direct marketplace PAYG charges for that billing period.
Enable Smart Credit Buffer Disabled: If you want to enforce strict budgetary isolation for an individual environment (such as an isolated lab or testing tenant), you can disable the buffer. If consumption breaches the assigned limit, the system bypasses the unallocated pool entirely and routes the overage directly to AWS Marketplace PAYG billing.
If multiple active Managed AIRS for AWS tenants exceed their allocated budgets in the same hour, the system satisfies requests using a first-come, first-served strategy based on when each billing microservice reaches the validation step. If the total shared overage exceeds the available buffer, any remaining uncovered consumption overflows to standard marketplace PAYG tracking.
Click Save.