+ Start a Discussion

Extension package licensing and security review

I have a managed base package that passed security review and is an Aloha app. Does my managed extension package inherent that security review and Aloha status, or must I submit seperately?


I want to control licensing to the base package through LMA, but seemlessly allow users that have access to the base package to have access to the extension package. Should I use the Manage Licenses option in AppExchange publishing or not?


I looked at LMA documentation and publishing extension packages H&T and couldn't find these answers.






Yes, you will need to submit the extension package for security review if you want to list the app on the Appexchange. Its recommended regardless to ensure trust and security. 


I would also configure the package extension with LMA - just set the defaults to be a Site License that Never Expires. That way you have visibility and control over the end user - but you don't enforce licensing by default.