# Enabling Memgraph Enterprise The following Memgraph features are only available in Enterprise Edition: | **Category** | **Features** | |---------------|-------------| | **Security** | [Role-based access control (RBAC)](#role-based-access-control) [Label-based access control (LBAC)](#role-based-access-control) [Property-based access control (PBAC)](#role-based-access-control) [Multi-role users and multi-tenant roles](#multi-role-users-and-multi-tenant-roles) [Auth system integrations](#authentication-system-integrations) (LDAP, SAML, OIDC) [Impersonate user](#impersonate-user) [Hiding sensitive information](#hiding-sensitive-information) | | **Logging & monitoring** | [Audit log](#audit-log) [Metrics tracking via HTTP server](#metrics-tracking-via-http-server) (Prometheus integration) | | **Database management** | [High availability](#high-availability) with automatic failover [Multi-tenancy](#multi-tenancy) [Tenant profiles](#tenant-profiles) [CRON snapshot scheduling](#cron-snapshot-scheduling) | | **Querying** | [Dynamic graph algorithms](#dynamic-graph-algorithms) [Time-to-live (TTL)](#time-to-live-ttl) for data expiration [Parallel execution](#parallel-execution) | | **Memgraph Lab features** | [Real-time performance monitoring](#monitoring) [Query sharing](#sharing-features) [Graph Style Script (GSS) sharing](#sharing-features) [Single Sign-On (SSO)](#single-sign-on) support (OIDC, SAML) | If you're interested in the Memgraph Enterprise Trial, you need to fill out the following [form](https://memgraph.com/enterprise-trial) where one of the fields is the organization name. Whether you bought Memgraph Enterprise or requested a trial, you will receive a file with the values you need to set the `organization.name` and the `enterprise.license` configuration values to. ## License sources and selection Memgraph accepts a license key from three sources and automatically selects the best one on startup or whenever the license settings change: | Source | How to provide | Priority | |--------|---------------|---------| | **CLI flags** | `--license-key` and `--organization-name` at startup | Highest (3) | | **Environment variables** | `MEMGRAPH_ENTERPRISE_LICENSE` and `MEMGRAPH_ORGANIZATION_NAME` | Medium (2) | | **Database settings** | `SET DATABASE SETTING` queries (persisted to disk) | Lowest (1) | **Winner selection:** Among all sources that provide a valid, non-expired key with a matching organization name, Memgraph picks the license with the furthest expiry date. A license with no expiry date (`valid_until = 0`, "forever") always beats any finite expiry. If two candidates expire at the same time, the higher-priority source wins. **Persistence:** The winning license is automatically written back to persistent storage so it remains active across restarts even if the CLI flags or environment variables are no longer passed. ## License types Memgraph issues three license types. All three unlock the Enterprise features listed at the top of this page; the difference lies in how the license-imposed memory limit is applied. | Type | Feature gating | What the license memory limit gates | | -------------- | -------------- | ----------------------------------- | | `enterprise` | Enterprise | **All** tracked memory — graph, query execution, and vector index memory combined. | | `ai_platform` | Enterprise | **Graph and query memory** (the `query+graph_memory_tracked` arena). Vector index memory grows unconstrained, gated only by the system [`--memory-limit`](https://memgraph.com/docs/database-management/configuration#other) flag. | | `oem` | OEM-specific | Reserved for OEM deployments. | The license type for the active license is reported by [`SHOW LICENSE INFO`](https://memgraph.com/docs/database-management/server-stats#license-information) under the `license_type` field. The AI Platform license is intended for vector-heavy workloads (RAG, similarity search, AI/ML pipelines) where the embedding storage typically dominates total memory and should not consume the licensed graph capacity. ## Providing the license If you want to enable the Enterprise Edition on startup, [set the configuration flags](https://memgraph.com/docs/configuration/configuration-settings#changing-configuration) or [environment variables](https://memgraph.com/docs/database-management/configuration#environment-variables) to the correct values. If you are already running Memgraph Community Edition, these configuration flags can also be adjusted [during runtime](https://memgraph.com/docs/configuration/configuration-settings#during-runtime), or you can run the following queries to set the values: ```cypher SET DATABASE SETTING 'organization.name' TO 'Organization'; SET DATABASE SETTING 'enterprise.license' TO 'License'; ``` Setting a license key via `SET DATABASE SETTING` is validated immediately: - A **malformed or undecodable** key is rejected with an error — the write does not go through. - An **already-expired** key is rejected with an error — the write does not go through. - An **organization name mismatch** is not checked at write time; it is caught during the next revalidation and Memgraph will log a warning and fall back to community mode if no other valid source is available. To check the set values run: ```opencypher SHOW DATABASE SETTING 'organization.name'; SHOW DATABASE SETTING 'enterprise.license'; ``` or: ```opencypher SHOW DATABASE SETTINGS; ``` To get all the information about the Memgraph Enterprise License that was injected into the system, run: ```cypher SHOW LICENSE INFO; ``` ## Upgrading or downgrading the license Memgraph licenses are issued based on the maximum unique data stored. So, if you get a 1TB license, you can store 1TB of data. The enforced value is `memory_tracked` (visible in [`SHOW STORAGE INFO`](https://memgraph.com/docs/database-management/server-stats#storage-information)), which represents the total RAM allocated and tracked by Memgraph across all databases in the instance. When `memory_tracked` reaches the license's `memory_limit`, write queries are blocked — only `read` and `delete` queries are allowed. That means it is possible to analyze the existing data but new data can no longer be added until you upgrade or free storage by deleting some of the data. Upon upgrading the license by entering a new license key the `write` queries will be enabled. When multiple valid license keys are present (for example a CLI key and a key set via `SET DATABASE SETTING`), Memgraph automatically picks the one with the furthest expiry, so providing a longer-lived key from any source takes effect immediately. To check the used storage, run `SHOW STORAGE INFO;` and compare the `memory_tracked` value against the `memory_limit`. ## License key expiry Once the license key expires, the enterprise features will be disabled, but the data stored in the database will remain intact. You will still be able to add more data, but any enterprise features that require specific actions will no longer function. For example, you will not be able to create any new databases. ## Switching between Community and Enterprise editions Enterprise user and role details are persisted in the database across editions, including license expiry. However, modifying users while running the Community build will result in the loss of enterprise-specific attributes such as multiple role assignments or impersonation privileges. ## Security features ### Role-based access control Most databases used in production have multiple users accessing and modifying data within the database, which might pose a serious security concern for system administrators wishing to grant only certain privileges to specific users. With [role-based access controls](https://memgraph.com/docs/database-management/authentication-and-authorization/role-based-access-control#user-roles-enterprise-feature), a set of users can have different [privilege levels](https://memgraph.com/docs/database-management/authentication-and-authorization/role-based-access-control#privileges-enterprise-feature). For even more control, Memgraph offers two levels of fine-grained access control: [label-based access control (LBAC)](https://memgraph.com/docs/database-management/authentication-and-authorization/role-based-access-control#label-based-access-control) controls which nodes and relationships a user can see and manipulate based on labels and edge types, while [property-based access control (PBAC)](https://memgraph.com/docs/database-management/authentication-and-authorization/role-based-access-control#property-based-access-control) controls which individual properties a user can read or write. Together, these allow a database administrator to keep all the data in one database while keeping any private data secure from those who don’t have adequate permission. ### Multi-role users and multi-tenant roles [Multi-role users and multi-tenant roles](https://memgraph.com/docs/database-management/authentication-and-authorization/multiple-roles) enable advanced user management and tenant isolation in Memgraph Enterprise. This feature allows users to have multiple roles assigned simultaneously, with permissions combined from all roles according to specific rules. **Key capabilities:** - **Multiple roles per user**: Users can have multiple roles with combined permissions - **Database-specific role assignment**: Roles can be assigned to specific databases using `SET ROLE ... ON database` syntax - **Tenant isolation**: Users can have different roles for different databases, ensuring proper data isolation - **SSO integration**: Support for external identity providers that return multiple roles - **Permission filtering**: Automatic filtering of permissions based on the current database context This feature is particularly valuable for multi-tenant environments where organizations need to manage users with different access levels across multiple isolated databases while maintaining strict security boundaries. ### Authentication system integrations Memgraph supports authentication and authorization using external auth modules. It includes built-in support for basic (username and password) authentication via [LDAP](https://memgraph.com/docs/database-management/authentication-and-authorization/auth-system-integrations#ldap), as well as [single sign-on over the SAML and OIDC protocols](https://memgraph.com/docs/database-management/authentication-and-authorization/auth-system-integrations#single-sign-on). ### Impersonate user The [impersonate user](https://memgraph.com/docs/database-management/authentication-and-authorization/impersonate-user) feature lets authorized users run queries on behalf of another user. When using impersonation, the permitted user adopts the full permissions and context of the impersonated user. This means they can execute queries and perform actions exactly as the impersonated user, with all associated privileges. This feature provides a powerful tool for managing user permissions, debugging, and performing administrative tasks. By leveraging the ability to impersonate other users, you can ensure more efficient management of users and roles while maintaining robust security and access control within your graph database. ### Hiding sensitive information To enhance security, it’s crucial to ensure that sensitive information is not logged. With Memgraph Enterprise, users can [mask passwords](https://memgraph.com/docs/database-management/logs#hiding-passwords-enterprise) - all passwords are replaced with **** to prevent their exposure in the logs. This approach ensures that even if logs are accessed by unauthorized individuals, they won’t be able to retrieve the actual passwords. ## Logging and monitoring ### Audit log Memgraph supports all query [audit logging](https://memgraph.com/docs/database-management/logs#audit-log-enterprise). When enabled, the audit log contains **records of all queries executed on the database**. Each executed query is one entry (one line) in the audit log. The audit log itself is a CSV file. By default, the log is rotated every day and a full year of entries is preserved. ### Metrics tracking via HTTP server In production systems, monitoring of applications is crucial, and that includes databases as well. Memgraph allows [tracking information about transactions](https://memgraph.com/docs/database-management/monitoring#metrics-tracking-via-http-server-enterprise-edition), query latencies, snapshot recovery latencies, triggers, bolt messages, indexes, streams, and many more using an HTTP server. That means you can [integrate Memgraph with Prometheus](https://memgraph.com/blog/use-prometheus-monitoring-memgraph-performance-metrics), a time-series database that enables other databases and applications to monitor and react to performance changes in the system just in time. ## Database management ### High availability [High availability](https://memgraph.com/docs/clustering/high-availability) is a critical component for maintaining a resilient database system. Especially for enterprises that require uninterrupted data access and reliability. Memgraph’s Enterprise edition is the ideal solution for those who need a worry-free, highly available system with [automatic failover](https://memgraph.com/docs/clustering/high-availability#failover). Built-in automatic failover ensures your system remains operational with minimal downtime and manual intervention. The cluster's control plane can also be secured: [coordinator authentication](https://memgraph.com/docs/clustering/high-availability/coordinator-authentication) lets coordinators authenticate OIDC, SAML and Kerberos connections against your identity provider and enforce the `COORDINATOR_READ` and `COORDINATOR_WRITE` privileges on Raft-replicated roles. ### Multi-tenancy [Multi-tenant support](https://memgraph.com/docs/database-management/multi-tenancy) enables you to manage multiple isolated databases within a single instance. That is especially useful if you prefer having multiple clients in one database. Those isolated databases within Memgraph function as distinct single-database Memgraph instances. That means that queries executed on a specific database should operate as if it were the sole database in the system, preventing cross-database contamination. You can also [suspend and resume individual databases](https://memgraph.com/docs/database-management/multi-tenancy#suspending-and-resuming-databases-enterprise) to free the RAM of idle tenants without dropping their data. ### Tenant profiles [Tenant profiles](https://memgraph.com/docs/database-management/tenant-profiles) allow you to define named memory-limit profiles and attach them to individual databases. This prevents a memory-intensive database from starving others in a multi-tenant deployment. You can create, alter, and drop profiles, and use `SHOW MEMORY INFO` and `SHOW STORAGE INFO ON DATABASE` to monitor per-database memory usage. ### CRON snapshot scheduling Memgraph supports [periodic snapshot creation](https://memgraph.com/docs/fundamentals/data-durability#periodic-snapshots) in defined intervals. With Memgraph Enterprise, users can define these intervals as 6-field CRON expressions (seconds, minute, hour, day of month, month, day of week). ## Querying ### Dynamic graph algorithms [Dynamic graph algorithms](https://memgraph.com/docs/advanced-algorithms/available-algorithms#dynamic-graph-algorithms-enterprise) allow you to perform **real-time, scalable computations on changing data**. These algorithms have been specifically developed to handle high-speed updates and large-scale graph changes without needing to restart the computation process. Here’s a breakdown to help you compare the Community and Enterprise offering in terms of graph algorithms: | Feature | Static algorithms (Community) | Dynamic algorithms (Enterprise) | |----------------|--------------------------------------------------------|---------------------------------------------------| | **Performance** | High-performing at scale | Real-time performance at scale | | **Handling graph updates** | Requires recomputation | Updates in real-time without recomputation | | **Use case** | Great for batch or periodic processing | Ideal for real-time applications | | **Licensing** | Free (Community version) | Part of Enterprise version | ### Time to live (TTL) [Time-to-live](https://memgraph.com/docs/querying/time-to-live) allows a user to tag vertices with an expiration time. Once a vertex has expired, the vertex and all associated edges will be deleted. ### Parallel execution [Parallel execution](https://memgraph.com/docs/querying/parallel-execution) allows you to execute Cypher queries in parallel, utilizing multiple workers to speed up data retrieval and processing. It is particularly useful for analytical queries that involve scanning large amounts of data, aggregations, or complex filtering. ### User profiles [User profiles](https://memgraph.com/docs/database-management/authentication-and-authorization/user-profiles) allows administrators to monitor and limit resources used by specific users. You can set limits on the number of concurrent sessions and transaction memory usage to control resource consumption and prevent system abuse. ## Memgraph Lab Enterprise features ### Monitoring [Monitoring](https://memgraph.com/docs/memgraph-lab/features/monitoring) feature tracks resource usage, database size, query activity, transaction flow and active sessions, providing real-time insights into database performance. ### Sharing features [Query sharing](https://memgraph.com/docs/memgraph-lab/features/sharing-features#query-sharing) allows users to share selected queries from the query execution or previously run queries from the history. [Graph Style Script (GSS) sharing](https://memgraph.com/docs/memgraph-lab/features/sharing-features#graph-style-script-sharing) allows users to share styling scripts among team members. ### Single sign-on [Single sign-on (SSO)](https://memgraph.com/docs/memgraph-lab/features/single-sign-on) provides authorization and authentification to your database. It supports two types of SSO methods - OpenID Connect (OIDC + OAuth 2.0) and SAML- and two identity providers - Microsoft Azure (Entra ID) and Okta.