How do I give users the License Manager login page?

License Manager is a separate solution in the Mediabriz family. It is not part of Mediabriz Conversation Intelligence, its plans or its Genesys AppFoundry listing. Once Mediabriz turns it on for your organization, your administrator sets it up in Mediabriz Organization settings and enters your licensed capacity. Your part, as the IT owner, is to make the License Manager login page the way users open Genesys Cloud, and to leave the Genesys Cloud role and OAuth client in place.

Licensed capacity, the billing period, the Login ID, the Login exceptions report, licensed hours and the policy per license type are covered in How do I manage Genesys Cloud license use with License Manager?.

What you are handing out

A web address, for example https://login.mediabriz.com/acme. Users open it, the page checks your licensed capacity, and then they sign in to Genesys Cloud as usual. There is nothing new to install for users. If your organization also uses Mediabriz Conversation Intelligence, its extension does not change.

Users who open Genesys Cloud directly are counted, but the policy does not apply to them. That includes a bookmark that still points at Genesys Cloud, the Genesys Cloud desktop app, the mobile app, the Genesys Cloud browser extension opened from its own icon, and a CRM screen that opens Genesys Cloud itself. The policy applies only to sign-ins that start on the login page, so plan the rollout around it.

The address

Your administrator copies the Login page link from Organization settings, on the License Manager tab. The address is made from your Genesys Cloud organization's short name and the name does not change, so a bookmark you deploy keeps working.

Private link adds a key to the end, for example https://login.mediabriz.com/acme/K7M2Q9X4P3RA. Without the key, or with an old key, the page says This sign-in link isn't valid. Ask your administrator for the current Genesys Cloud sign-in link. Use the full address, key included, in every bookmark and portal tile. If the administrator selects Replace key, the old address stops working at once. Agree the new address before they do that, and update bookmarks and the portal together.

Treat a private address like a shared secret you are happy to put in a managed bookmark. It is not a user login: anyone who has it can open the page. Allowed networks is what keeps the page to your own networks.

Put the address where users already start

Replace the Genesys Cloud address rather than adding the login page next to it. Users open whichever link is familiar, and a direct opening is counted but the policy does not apply to it.

• Browsers. Deploy the login page as a managed bookmark or favorite, and as the home page or new-tab page if that is where agents start. In Chrome, the policy is ManagedBookmarks. Edge uses the same policy for managed favorites. Name it something agents already look for, such as "Genesys Cloud", and set the URL to the login page, including the private key if you use one.
• Single sign-on portal. Add a tile that opens the login page. In Okta, a Bookmark App is enough. In Microsoft Entra ID, add a tile in My Apps that opens the same URL. Leave your Genesys Cloud single sign-on application as it is: Genesys Cloud still signs the user in after the page lets them through. A tile that opens Genesys Cloud directly bypasses the page.
• Onboarding and the service desk. Put the login page address in the new-hire steps, and retire the old Genesys Cloud address from the knowledge base and from desktop shortcuts.
• Users who should bypass the page. Hourly Interacting users, and an admin who must always get in, can keep a direct Genesys Cloud address. Give them that address on purpose. Admins with a CX license are still counted. Hourly Interacting users are never counted.

The Genesys Cloud browser extension, the desktop app and the mobile app open Genesys Cloud directly. Agents who must go through License Manager open the login page first. If they then sign in with one of these, ask your administrator to set After admission, go to to Other Genesys Cloud app (browser extension, desktop or mobile): the page then says You're cleared to sign in. and Open Genesys Cloud the way you usually do: from the browser extension, the desktop app or the mobile app. on every device, and opens nothing.

Genesys Cloud browser extension

The page cannot open the Genesys Cloud browser extension for the user. With Other Genesys Cloud app (browser extension, desktop or mobile), the user opens Genesys Cloud from the extension's icon once the page says they are cleared, so pin that icon where it is always visible. An organization that chose the earlier Genesys Cloud browser extension option has this choice selected.

Chrome and Edge. In the Chrome admin console, or any Chrome policy that uses ExtensionSettings, set toolbar_pin to force_pinned for the Genesys Cloud extension. If you already force-install it, add toolbar_pin to that same extension entry. Do not replace the rest of the entry.

{
  "onbcflemjnkemjpjcpkkpcnephnpjkcb": {
    "toolbar_pin": "force_pinned"
  }
}

onbcflemjnkemjpjcpkkpcnephnpjkcb is the Chrome Web Store id of the Genesys Cloud extension. Edge uses the same ExtensionSettings format. Confirm the id in your own console before you roll the policy out.

Firefox. Genesys publishes its own Firefox extension. In the Firefox ExtensionSettings policy (Group Policy, Intune, or policies.json), set default_area to navbar for it. This needs Firefox 113 or later. It puts the icon on the toolbar, where a user can still move it. If you already force-install the extension, add default_area to that same entry.

{
  "purecloudForFirefox@mypurecloud.com": {
    "default_area": "navbar"
  }
}

purecloudForFirefox@mypurecloud.com is the Firefox Add-ons id of the Genesys Cloud extension. Confirm it on the extension's page in about:support before you roll the policy out.

These pins are for the Genesys Cloud extension, not for the Mediabriz Conversation Intelligence extension.

With this choice the page offers no link to Genesys Cloud, on any device. If most of your users open Genesys Cloud in a browser tab, choose Genesys workspace instead, so the page opens it for them.

Allowed networks

Your administrator enters Allowed networks on the License Manager tab. You supply the public addresses.

• One public IPv4 or IPv6 address, or one range, per line, up to 50.
• A range is a CIDR prefix. IPv4 ranges must be /16 or narrower (/24 is narrower than /16). IPv6 ranges must be /32 or narrower.
• Use the address the page will see: your office's public internet address, or the address your VPN or cloud gateway uses for remote agents. Private, reserved and documentation ranges (IPv4 and IPv6, such as 10.x.x.x or 192.168.x.x) are not accepted, because the page never sees them.
• An empty list allows every network. In that case, use a private link.
• The list applies in Monitor and Apply policy. When the mode is Off, the page lets everyone through.
• The list applies only to your organization's login page. Mediabriz Settings and Insights, and the Mediabriz Conversation Intelligence extension if you use it, are not affected by it.

Remote agents who are not on the VPN see You can't sign in from this network. Contact your administrator. Add your VPN's public address, or leave the list empty and use a private link.

Firewall and proxy

If your firewall or proxy limits which websites agent browsers can reach, allow login.mediabriz.com. The page needs only its own domain.

A busy office behind one public address is normal traffic for the page, for example at a shift change.

Do not block Genesys Cloud to force users through the page. License Manager does not work that way: users who open Genesys Cloud directly are counted, but the policy does not apply to them.

Also keep the rest of Mediabriz and Genesys Cloud reachable. In particular, do not block:

• api.mediabriz.com and eu.api.mediabriz.com
• wizard.mediabriz.com and insights.mediabriz.com
• login.<your Genesys Cloud region>, apps.<your Genesys Cloud region> and api.<your Genesys Cloud region>

Blocking those breaks Mediabriz or Genesys Cloud.

The role and the OAuth client

When the administrator selects Connect, Mediabriz creates two items in Genesys Cloud, both named Mediabriz License Manager:

In older connections both are named Mediabriz Login Limit. Mediabriz keeps using them, and Disconnect deletes the OAuth client under either name.

The role is granted on all divisions, including divisions you create later. The client does not sign users in.

Leave the name, the permissions and the division grant as Connect made them. A renamed role, a removed permission, or a grant limited to some divisions makes the count wrong or stops Mediabriz from reading Genesys Cloud. When Mediabriz cannot read Genesys Cloud, the login page lets everyone on your allowed networks in, records it, and the administrator gets an email.

To disconnect, the administrator selects Disconnect on the License Manager tab. Disconnect deletes the OAuth client and the client secret Mediabriz stored, and uninstalling Mediabriz does the same. The role stays in Genesys Cloud: a Genesys Cloud admin can delete it by hand if you no longer need it, and the next Connect reuses it and resets its permissions. Disconnect needs oauth:client:view, oauth:client:edit and oauth:client:delete. It checks them first, lists any that are missing, and changes nothing until they are in place. Deleting the role or the client by hand while connected leaves Settings out of date: Verify connection then reports The License Manager role is missing. or The OAuth client is missing or no longer accepted., and Reconnect creates them again.

The user who selects Connect needs oauth:client:add, authorization:role:add and authorization:grant:add, on top of integration:cloudBriz:admin (cloudBriz - Admin) for Organization settings. Genesys Cloud only lets a user give a client a role they hold, so Connect also grants Mediabriz License Manager to that user, on all divisions.

Permissions on the role:

There is nothing else on the role. It cannot change users, roles, licenses or OAuth clients.

Licensed hours and license type policy

Your administrator sets the numbers. You only need to know what the page applies, so the rollout matches the contract.

• Licensed hours. For organizations that Genesys Cloud bills by total logged-in time. Licensed capacity is hours in the billing period, not seats. Once the licensed hours are fully in use, the page says Your organization's licensed hours for this billing period are fully in use. Contact your administrator. Sessions that are already open keep running. Opening Genesys Cloud directly still adds hours, and the policy does not apply to it.
• License type policy. An optional licensed capacity beside the CX licensed capacity, for license types Genesys Cloud bills by who signs in, for example CX Cloud from Genesys and Salesforce. Each license type can send an alert, or also ask a new sign-in from the page to try again shortly when the type is fully in use. A direct sign-in is counted toward that type, but the policy does not apply to it.

Both use the same login page and the same Mediabriz License Manager role and client. There is no second role and no second address.

Roll out with the administrator

1. The administrator contacts us to add License Manager, which is not included in Mediabriz Conversation Intelligence plans. Once Mediabriz turns it on, they select Connect and Verify connection.
2. Agree the address. If you will use a private link or Allowed networks, set them up before you tell the team.
3. The administrator saves Monitor. Everyone who opens the page from an allowed network is let in (everyone, if the list is empty). The License Manager section in Insights shows the count, and the Login exceptions report (when the page asks for a Login ID) shows who still opened Genesys Cloud directly. The count updates on its own, without anyone using the page. Each day's Login exceptions report is ready about 2 hours after the day ends.
4. You deploy the bookmarks, the portal tile and the Chrome pin, and remove the old Genesys Cloud shortcuts you control.
5. Review a few days of Insights together, including a shift change. When the count looks right, the administrator switches the mode to Apply policy.
6. To pause the policy, the administrator switches back to Monitor. The change reaches the page within a few seconds, and shared links keep working.

Apply policy applies only to a new sign-in from the login page. It does not sign anyone out, and it does not apply to someone who opens Genesys Cloud another way.

If you have questions, contact Mediabriz support.