Skip to content

Require quorum approval for sensitive actions

Turn on two-person control for your tenant: an operation the policy gates waits until a number of approvers other than the person who asked for it have approved it.

Who can do it

A tenant administrator: changing the quorum policy needs the permission to manage it, which the tenant administrator role holds and no other built-in role does. Other tenant roles that can read the policy see the screen without the form.

A platform administrator acting in your tenant under support access cannot change the policy.

Before you start

  • Enabling needs one more eligible approver than the approvals you require: active members of your tenant holding the permission to approve. A requester never approves their own request, so with fewer the requests could never be approved.
  • Decide which operations to gate. The choices the screen offers include requesting the destruction of a key or one of its versions, weakening a key (extending or removing an expiry, raising or removing a usage limit, making it exportable), and changing the algorithm, rotation or lifecycle policies. Changing the quorum policy itself and making someone an approver are always gated once the policy is on.
  • Once the policy is on, changing it or turning it off is itself a request that waits for approval.

Steps

  1. Open Policies and, on the Quorum approval card, select Open quorum approval.
  2. In the Policy panel, set:
    • Approvals required (not counting the requester): 1 to 10.
    • A request waits at most (hours): 1 to 336. A request not decided in time expires.
    • Operations that wait for approval: select the operations to gate. The two that are always gated are selected and cannot be cleared.
  3. Select Turn on. When the policy is already on, the button reads Request the change.
  4. To turn the policy off, select Request to turn off and confirm with Request to turn off in Turn quorum approval off?.

The console may ask you to confirm who you are first: Confirm your identity to continue opens with your own sign-in steps, and your change is sent once you confirm.

What you see when it worked

  • Turning it on shows Quorum approval is on. The panel shows State as On, the Eligible approvers and the Health.
  • Applications this change gates lists your applications whose calls will wait for approval from now on. It is a warning: no caller is exempt.
  • A change or a turn-off of a policy that is already on shows Waiting for approval with a link to the request. Nothing changes until its approvers approve it.

The Quorum approval card on Policies shows how many approvals are required and how many requests wait.

If it fails

What you see Cause What to do
Turn on is disabled, with the reason below it Fewer than the required approvals plus one eligible approvers Give more active members the permission to approve, or require fewer approvals
The change is refused for too few approvers Raising the approvals, or a change that could not reach its quorum Add eligible approvers first
The change is refused because one is already waiting A change of the policy is already pending Decide or withdraw that request first
The change is refused under impersonation A platform administrator is acting in the tenant under support access A tenant administrator makes the change
Health reads Degraded Fewer approvers remain than the policy needs Give another active member the permission to approve

Without the console

Surface How
Key management CLI No command
Admin SDK Not available
API PUT /api/v3/admin/tenants/{tenantId}/quorum/policy with requiredApprovals, requestTtlHours and operations (operation replaceTenantQuorumPolicy); DELETE /api/v3/admin/tenants/{tenantId}/quorum/policy to turn it off (operation deleteTenantQuorumPolicy)