consequences excluding Forticlient from management

[pnobels]

Hi,

i'm wondering the following...

I have 4000 endpoints registered in EMS.  I need to free up some licenses.  I can exclude some endpoints which actually never use the vpn.

The endpoint receives a 30 day grace period where they can still connect to the vpn.  What happens after 30days?  They can no longer connect, that's clear.  But the endpoint still exists in the EMS environment?  Or is it cleared up?

Secondly, with the Forticlient comes the fsso agent (authenticator).  What happens when an endpoint is excluded from management?  Does the fsso service stop?  Immediately, or after 30 days?  Of does this just continue to work (as the license for this is basically on the authenticator server)...