Leads and archived clients don't count. The template's page, each client's Licenses and their overview show who is missing one.

Clients with any of them - Managed, say, for the endpoint protection every managed client gets.