What constitutes a license in Identity Manager?

Suppose our AD domain contained a total of 100,000 user objects but only 10,000 of those objects we would want managed by the Identity Manager system. Would we have to buy a license for EVERY object in our AD domain (ex: 100,000) or just buy enough licenses to cover what is managed by IDM (ex: 10,000).

Appreciate any clarity on this. Thank you.