Skip to content

Self-Hosted Feature Parity

Self-Hosted Feature Parity — Round 2 Research Report

Section titled “Self-Hosted Feature Parity — Round 2 Research Report”

Session: 20260321-0115 Domain: NetBird Self-Hosted vs Cloud Feature Parity Date: 2026-03-21 Round: 2 (resolving contradictions from Round 1) Tools Used: mcp__claude_ai_Tavily__tavily_search (8 queries), mcp__exa_websearch__web_search_exa (2 queries), WebFetch (7 pages)


Round 1 research contained critical contradictions about NetBird self-hosted capabilities. This report resolves all of them with high-confidence, source-verified answers.

The bottom line for GSISG: Self-hosted NetBird is genuinely free for unlimited users/peers with no license fees. However, it is not feature-equivalent to the cloud version. You lose 8 specific capabilities, the most operationally significant being: (1) background IdP-Sync (you get JWT-at-login group sync instead), (2) SCIM provisioning (requires commercial license), (3) peer approval (cloud-only), (4) traffic event logging and SIEM streaming (cloud-only), and (5) management server HA (DIY or enterprise license). For GSISG’s 100-user deployment, the JWT group sync workaround is adequate but not identical to the cloud IdP-Sync feature, and single-management-server risk is the primary operational concern.


Cloud Plans Feature Matrix (from netbird.io/pricing, verified March 2026)

Section titled “Cloud Plans Feature Matrix (from netbird.io/pricing, verified March 2026)”
FeatureFreeTeam ($5/user/mo)Business ($10/user/mo)Enterprise (Custom)Self-Hosted (Free)
Users5UnlimitedUnlimitedUnlimitedUnlimited
Machines100100 + 10/user100 + 10/userUnlimitedUnlimited
P2P WireGuard encryptionYesYesYesYesYes
Access controls (policies)YesYesYesYesYes
NetBird NetworksYesYesYesYesYes
Network RoutesYesYesYesYesYes
Private DNSYesYesYesYesYes
NetBird SSHYesYesYesYesYes
Setup keysYesYesYesYesYes
Social SSO & MFAYesYesYesYesYes (local users + OIDC)
Enterprise IdP SSO/MFANoYesYesYesYes (via external OIDC)
IdP-Sync (background provisioning)NoYesYesYesNO (JWT sync only)
SCIM provisioningNoYesYesYesEnterprise license
User invites (email)NoYesYesYesNO
Peer approvalNoNoYesYesNO
Device approvals (user-level)NoNoYesYesYes (user approval exists)
Audit events loggingNoYesYesYesNO
Connection traffic eventsNoNoYesYesNO
Audit & traffic events streamingNoNoYesYesNO
MDM & EDR integrationNoNoYesYesNO
Device posture checksNoNoYesYesNO
Geo-distributed relaysYes (managed)Yes (managed)Yes (managed)Yes (managed)DIY
High availabilityYes (managed)Yes (managed)Yes (managed)Yes (managed)DIY / Enterprise license
MSP multi-tenantNoNoNoYesNO
DORA complianceNoNoNoYesNo
SLAsNoNoNoYesNo
On-premise installation supportNoNoNoYesN/A
Custom integrationsNoNoNoYesNo
SupportCommunityTicketingPriorityCustom SLACommunity only

Sources: netbird.io/pricing, self-hosted vs cloud, plans and billing

Round 1 Contradiction Resolved: The cost-compliance report stated “self-hosted includes Device Posture Checks: Yes, Traffic Events Logging: Yes, Audit Events Streaming: Yes” — this was WRONG. The official self-hosted vs cloud comparison page explicitly lists these as cloud-only features. The Round 1 table was misleading because it conflated “technically possible in the codebase” with “available in the product.”

What self-hosted DOES get that isn’t obvious:

  • Unlimited users and unlimited machines (no caps at all)
  • Local user management (v0.62+) with no external IdP dependency
  • Multiple simultaneous OIDC providers alongside local users
  • JWT group sync (groups from IdP tokens auto-created in NetBird at login)
  • User approval (distinct from peer approval — controls whether new users can join)
  • All core networking features (routes, DNS, SSH, policies, networks)
  • Reverse proxy (v0.65+, beta, same as cloud)

Question 2: Entra ID Sync — Self-Hosted vs Cloud

Section titled “Question 2: Entra ID Sync — Self-Hosted vs Cloud”

There are two completely different mechanisms for syncing Entra ID data with NetBird, and they are NOT interchangeable:

Mechanism A: Cloud IdP-Sync (Team plan+, cloud only)

Section titled “Mechanism A: Cloud IdP-Sync (Team plan+, cloud only)”
AspectDetail
AvailabilityCloud version only, Team plan and above
How it worksNetBird’s cloud backend connects to Microsoft Graph API using User.Read.All + Group.Read.All permissions and actively polls Entra ID at regular intervals
Sync timingBackground, automatic, continuous (“syncs at regular intervals”, manual trigger available)
User provisioningAll users (or filtered subset) appear in NetBird immediately, even before they log in
User deprovisioningAutomatic — when removed from Entra ID, access is revoked at next sync
Group namesDisplay names synced directly (e.g., “Engineering”, “General Users”)
Group limitNo 200-group JWT limit — fetched via API, not token
Pre-populate policiesYes — you can create policies referencing users/groups before they authenticate
AspectDetail
AvailabilitySelf-hosted (free), also works on cloud
How it worksGroups are embedded in the JWT ID token during OIDC authentication. NetBird reads the groups claim and creates/assigns groups
Sync timingAt login time only — groups update when the user authenticates
User provisioningUsers appear in NetBird only after their first login
User deprovisioningNOT automatic — if a user is disabled in Entra ID, they can’t log in again, but their existing NetBird peer connections remain until the session expires or setup key is revoked. No background check removes them.
Group namesObject IDs (GUIDs) by default, e.g., a1b2c3d4-5678-90ab-cdef-1234567890ab. Display names require Azure AD Premium AND cloud-only groups in Entra. NetBird Cloud does not have this limitation.
Group limit200 groups maximum per JWT token. If a user belongs to more than 200 groups, the claim is omitted entirely. Workaround: select “Groups assigned to the application” to limit to relevant groups.
Pre-populate policiesPartial — you can pre-create groups by name, but they won’t match until users authenticate with matching group claims

The Standalone IdP Manager (Legacy Advanced Setup)

Section titled “The Standalone IdP Manager (Legacy Advanced Setup)”

There is a third option: the standalone/advanced setup where you configure NETBIRD_MGMT_IDP="azure" in the setup.env and set up an IdPManagerConfig in management.json. This configures the NetBird management server to use the Microsoft Graph API endpoint (https://graph.microsoft.com/v1.0) with User.Read.All permission.

CRITICAL FINDING: This IdP Manager in the standalone setup is primarily for caching and displaying user names/email addresses in the NetBird dashboard. The official docs state: “NetBird’s management service integrates with some of the most popular IDP APIs, allowing the service to cache and display user names and email addresses without storing sensitive data.” It does NOT provide the same continuous background provisioning/deprovisioning that the cloud IdP-Sync feature offers. It supplements user display data, but group sync still happens via JWT claims at login.

ScenarioCloud IdP-SyncSelf-Hosted JWT Sync
New employee startsAppears in NetBird within minutes (background sync)Must log in first to appear
Employee terminated in Entra IDRemoved from NetBird at next sync, all access revokedCan’t re-authenticate, but existing sessions/connections persist until timeout
Group membership changedUpdated at next background sync (minutes)Updated at next user login only
Viewing groups in dashboardHuman-readable names (“Engineering”)GUIDs (a1b2c3d4...) unless Azure AD Premium
200+ groups per userWorks (API-based)Breaks (JWT token limit)
Policies before first loginFully functionalGroups must be pre-created manually

Verdict: JWT group sync is a workable alternative but NOT equivalent to IdP-Sync. The biggest operational gap is deprovisioning — there is no automatic revocation when a user is disabled in Entra ID. You would need to manually remove them from NetBird or revoke their setup keys. For a 100-user org, this is manageable but requires a documented offboarding procedure.

Sources: IdP-Sync docs (cloud), Entra ID sync (cloud), self-hosted IdP docs, self-hosted Entra ID, v0.62 announcement, GitHub issue #2073


The NetBird scaling documentation explicitly states:

“If you are looking for a high-availability setup for the Management and Signal services, this is available through an enterprise commercial license.”

What You CAN Do Without Enterprise License

Section titled “What You CAN Do Without Enterprise License”
ComponentHA Possible?How
Relay serversYes — fully supportedDeploy multiple relay + STUN servers on separate machines. Peers receive relay addresses from Management and connect directly. Authentication via shared secrets.
DatabaseYes — migrate to PostgreSQLMove from SQLite (single-file, not HA-ready) to PostgreSQL on a dedicated server. PostgreSQL itself supports replication/clustering.
Management serverNO without enterprise licenseSingle instance only. Cannot run multiple instances behind a load balancer in the community edition.
Signal serverNO without enterprise licenseSingle instance only. Can be extracted to a separate machine but not replicated.
DashboardYes (stateless)Static files served by nginx; can be load-balanced trivially. But useless without a functioning management server.

What Happens When the Single Management Server Goes Down

Section titled “What Happens When the Single Management Server Goes Down”
ScenarioImpact
Existing P2P (direct) tunnelsContinue working — WireGuard data plane is independent of management server
Existing relayed connectionsContinue working — as long as the relay server (separate component) is up
New peer connectionsCannot be established — peers need management for initial config and peer discovery
Policy changesCannot be applied until management returns
New user registrationCannot happen
DNS configuration updatesCannot be pushed
Client auto-reconnection after outageGenerally works, but known issue: clients sometimes stay offline indefinitely after prolonged management outage and require manual netbird up

Practical Mitigation Without Enterprise License

Section titled “Practical Mitigation Without Enterprise License”
  1. Run the management server on a reliable VM with monitoring and auto-restart (systemd, Docker restart policies)
  2. Regular backups of the SQLite database (or PostgreSQL) — recovery time is minutes, not hours
  3. Separate relay servers — even if management goes down, existing connections continue
  4. Monitoring — set up Uptime Kuma / Prometheus alerts for the management server health endpoint
  5. The blast radius is limited — data plane (actual VPN traffic) is unaffected; only control plane operations are disrupted

Sources: Scaling guide, self-hosted vs cloud, how NetBird works


ComponentBefore v0.53.0After v0.53.0
Repository rootBSD-3BSD-3 (unchanged)
Client applicationsBSD-3BSD-3 (unchanged)
management/ folderBSD-3AGPLv3
relay/ folderBSD-3AGPLv3
signal/ folderBSD-3AGPLv3
Dashboard repositoryBSD-3AGPLv3

Legacy versions (pre-v0.53.0) remain under BSD-3.

What This Means for GSISG Self-Hosting Internally

Section titled “What This Means for GSISG Self-Hosting Internally”

Absolutely nothing changes for internal use. NetBird’s official announcement is unambiguous:

“For self-hosters, internal use, absolutely nothing changes. You can continue to download, install, run, and manage NetBird on your own servers for your organization, your homelab, or any other personal purposes. You are free to modify NetBird for your own internal use without any obligation to share those changes; as long as you do not provide the modified software as a service to other users/organizations over a network.”

The AGPL source-sharing obligation is triggered ONLY when:

  1. You modify the NetBird server code AND
  2. You offer that modified version as a service to external users/organizations over a network

Simply running NetBird internally — even a modified version — for your own company’s employees does NOT trigger the AGPL obligation. This is explicitly confirmed by NetBird and is consistent with standard AGPL interpretation.

ConcernRisk LevelAnalysis
Internal deployment without modificationsZEROStandard self-hosting, no obligations
Internal deployment with minor modificationsZEROInternal use exemption applies
Running NetBird for GSISG employees across officesZEROThis is internal organizational use
Corporate policy prohibiting AGPL software on devicesLOWThe NetBird client remains BSD-3. Only server components are AGPL. The client installed on employee devices is NOT AGPL.
Legal review requirementLOW-MEDIUMSome corporate legal teams have blanket AGPL caution. Worth a brief legal review to confirm the client/server split satisfies any internal AGPL policies.
Future risk if NetBird changes termsLOWAGPL is an irrevocable license. Any version you have under AGPL cannot be retroactively restricted.

Contact sales@netbird.io for a commercial non-AGPLv3 license.

Sources: AGPL announcement, forum post, HN discussion, AGPL text analysis


Question 5: Self-Hosted Enterprise License

Section titled “Question 5: Self-Hosted Enterprise License”

NetBird offers a Commercial License for self-hosted deployments with enterprise needs. This is separate from the cloud subscription plans.

FeatureFree Self-HostedEnterprise Self-Hosted
Management + Signal HADIY (single instance)Multiple instances behind load balancer
SCIM provisioningNot availableAvailable
SupportCommunity onlyCustom SLA, dedicated support
On-premise installation assistanceNoneIncluded
Custom integrationsNoneAvailable

Note: The exact feature list for the self-hosted enterprise license is not comprehensively documented. The official docs only explicitly confirm SCIM and HA as gated features. Other cloud-only features (traffic events, SIEM streaming, EDR integration, peer approval) are NOT confirmed as available via the enterprise self-hosted license — they may remain cloud-only.

Not publicly listed. Pricing is custom and requires contacting sales@netbird.io.

Third-party reference point: WZ-IT (a German managed services provider) offers fully managed NetBird hosting starting at EUR249.90/month for up to 200 devices (includes setup, SSO, monitoring, updates, and support). This is NOT a NetBird enterprise license — it’s a third-party managed service built on the open-source version.

Sources: self-hosted vs cloud, pricing page, WZ-IT pricing, advanced guide


Question 6: Local Users + External Entra ID OIDC

Section titled “Question 6: Local Users + External Entra ID OIDC”

NetBird v0.62 introduced a fundamental architectural change: the embedded Dex IdP provides local user management, AND you can add multiple external OIDC providers simultaneously from the Dashboard UI.

  1. Deploy self-hosted NetBird using the quickstart script (creates the embedded IdP with local users)
  2. Create your admin account via the Dashboard setup wizard (local email/password)
  3. Add Microsoft Entra ID as an external provider:
    • Navigate to Settings > Identity Providers > Add Identity Provider
    • Select type: entra (for work/school accounts)
    • Enter Client ID, Client Secret, and Issuer from your Entra App Registration
    • NetBird generates the redirect URI for you
  4. Users see both login options: “Continue with Email” (local) AND a Microsoft button on the login page
  5. Each user’s provider is tracked: Users show a badge in the Users list indicating which IdP they authenticated through (local, Microsoft, Google, etc.)

What This Gives You (SSO Without Cloud IdP-Sync)

Section titled “What This Gives You (SSO Without Cloud IdP-Sync)”
CapabilityAvailable?
SSO via Entra IDYes — users click “Microsoft” on login page
MFA via Entra IDYes — if configured in Entra Conditional Access, it applies
JWT group sync from Entra IDYes — configure groups claim in the App Registration token configuration, enable JWT group sync in NetBird Settings > Groups
Local users alongside SSO usersYes — both coexist; local auth is always available as fallback
Multiple OIDC providers simultaneouslyYes — add Google, Okta, Keycloak, etc., alongside Entra ID
Background user/group syncNo — this is the cloud IdP-Sync feature, not available
Automatic deprovisioningNo — disabled Entra users can’t re-authenticate but aren’t auto-removed
Group display names (not GUIDs)No — requires Azure AD Premium + cloud-only groups, or use NetBird Cloud
GSISG Self-Hosted NetBird
|
+-- Embedded Dex IdP (local user management)
| |-- Admin account (local, email/password)
| |-- Break-glass accounts (local, for emergency access)
|
+-- Microsoft Entra ID (external OIDC provider)
| |-- 100+ employees authenticate via SSO
| |-- Groups sync via JWT claims at login
| |-- MFA enforced via Entra Conditional Access
|
+-- (Optional) Additional OIDC providers
|-- Google Workspace for contractors
|-- Self-hosted Keycloak/Authentik

Key advantage: You get SSO through Entra ID without needing the cloud Team plan. The only thing you miss is the background sync (user/group changes propagate at next login, not immediately).

Sources: v0.62 announcement, local user management docs, identity providers overview, self-hosted Entra ID


Consolidated: What You Lose Going Self-Hosted

Section titled “Consolidated: What You Lose Going Self-Hosted”
#FeatureCloud PlanImpact for GSISGWorkaround
1IdP-Sync (background provisioning)Team+MEDIUM-HIGH — no auto-provisioning/deprovisioningJWT group sync at login; manual offboarding procedure
2SCIM provisioningTeam+ (cloud), Enterprise (self-hosted)MEDIUM — no standardized user lifecycleJWT group sync; or purchase enterprise license
3Peer approvalBusiness+MEDIUM — any device with a valid setup key can joinUser approval exists; restrict setup key distribution; use setup key expiration
4Traffic events loggingBusiness+LOW-MEDIUM — no connection-level audit trailUse WireGuard interface packet captures, or NetBird API for peer status
5Audit & traffic events streamingBusiness+LOW — no SIEM integrationManual log aggregation from management server
6MDM & EDR integrationBusiness+LOW for GSISG — no CrowdStrike/Intune posture checksEnforce compliance through Intune separately; manual verification
7Device posture checksBusiness+LOW-MEDIUM — no OS version / process enforcementManual policy enforcement; Intune compliance as separate check
8User invites (email)Team+LOW — can’t send email invitationsShare setup keys or login URL directly
9MSP multi-tenantEnterpriseNONE for GSISG — single orgN/A
10Geo-distributed relaysAll cloud plansLOW — relay traffic is e2e encrypted anywayDeploy own relay servers in Azure regions near offices

Features Retained (Available in Self-Hosted)

Section titled “Features Retained (Available in Self-Hosted)”

All core networking: P2P WireGuard, access controls, network routes, networks, private DNS, split DNS, custom DNS zones, SSH, setup keys, SSO/OIDC, local user management, reverse proxy (beta), user approval, unlimited users, unlimited machines.


ContradictionResolution
”Self-hosted is genuinely free for unlimited users” vs “IdP-Sync is only on Team plan”Both are true. Self-hosted IS free with unlimited users. IdP-Sync (background provisioning) IS cloud Team+ only. Self-hosted uses JWT group sync instead (login-time only).
”Self-hosted HA requires enterprise license” vs “DIY HA”Both are partially true. Relay server HA is DIY (no license needed). Management + Signal HA requires enterprise commercial license. You cannot run multiple management server instances without it.
Cost-compliance report listing Device Posture Checks as “Yes” for self-hostedINCORRECT in Round 1. Device posture checks are Business+ cloud-only features. The Round 1 table was wrong.
”SCIM provisioning requires commercial license for self-hosted”CORRECT. Explicitly stated in docs: “SCIM provisioning: Enterprise license” for self-hosted.

Section titled “Path 1: Self-Hosted Free (Recommended Starting Point)”
  • Cost: Azure infrastructure only (~$25-30/month)
  • Identity: Entra ID as external OIDC provider + local admin accounts
  • Group sync: JWT group sync (groups update at login)
  • Offboarding: Manual process to remove users from NetBird when terminated in Entra ID
  • HA: Single management server with monitoring/alerts, separate relay server(s)
  • Risk: Single point of failure for management server (mitigated by data plane independence)

Path 2: Cloud Team Plan (If IdP-Sync Is Critical)

Section titled “Path 2: Cloud Team Plan (If IdP-Sync Is Critical)”
  • Cost: $5/user/month = $500/month = $6,000/year for 100 users
  • Identity: Full Entra ID background sync with auto-provisioning/deprovisioning
  • Offboarding: Automatic — disabled Entra users lose access at next sync
  • HA: Included, managed by NetBird
  • Relays: Geo-distributed, managed

Path 3: Self-Hosted + Enterprise License (Best of Both Worlds)

Section titled “Path 3: Self-Hosted + Enterprise License (Best of Both Worlds)”
  • Cost: Custom pricing (contact sales@netbird.io) + Azure infrastructure
  • Identity: SCIM provisioning for automated user lifecycle
  • HA: Multiple management server instances with load balancing
  • Control: Full data sovereignty with enterprise support
  • Risk: Unknown pricing; may exceed cloud Team plan cost
PriorityPath 1 (Self-Hosted Free)Path 2 (Cloud Team)Path 3 (Self-Hosted Enterprise)
Cost minimizationBestModerateUnknown
Data sovereigntyBestModerate (NetBird cloud)Best
Auto-deprovisioningManual workaroundBestGood (SCIM)
Management HAWeakestBestGood
Operational simplicityModerateBestModerate
Compliance controlBestModerateBest

ToolQueryPurpose
TavilyNetBird self-hosted HA management server enterprise licenseQ3: HA gating
TavilyNetBird AGPLv3 license change v0.53.0 implicationsQ4: License analysis
TavilyNetBird self-hosted enterprise license cost pricingQ5: Enterprise tier
TavilyNetBird self-hosted JWT group sync vs IdP syncQ2: Sync mechanisms
TavilyNetBird self-hosted local user management external OIDC v0.62Q6: Local + SSO
TavilyNetBird management.json IdPManagerConfig Azure Graph APIQ2: Background sync
TavilyNetBird self-hosted features cloud-only missingQ1: Feature matrix
TavilyGitHub netbirdio/netbird IdpManagerConfig azure management idpQ2: Source code
ExaNetBird self-hosted features missing compared to cloud 2025 2026Q1: Community views
ExaNetBird self-hosted IdPManagerConfig azure management.jsonQ2: Technical config
URLPurpose
netbird.io/pricingQ1: Complete pricing matrix
docs.netbird.io/about-netbird/self-hosted-vs-cloudQ1: Feature comparison
docs.netbird.io/selfhosted/identity-providers/managed/microsoft-entra-idQ2/Q6: Entra ID setup
docs.netbird.io/manage/team/idp-syncQ2: Cloud IdP-Sync docs
docs.netbird.io/selfhosted/maintenance/scaling/…Q3: Scaling/HA guide
netbird.io/knowledge-hub/netbird-agpl-announcementQ4: AGPL details
docs.netbird.io/selfhosted/identity-providers/managed/advanced/microsoft-entra-idQ2: Legacy Entra setup