You must have a valid SaaS Security Inline license on the
firewall to use ACE. If you do not have a SaaS Security Inline license
on a firewall, that firewall cannot install ACE App-IDs or use them
in Security policy. Panorama does not require a license to manage
firewalls that use ACE.