Skip to content

Remediation Action

What this screen is for

This screen shows one action of a remediation plan: the item it fixes, the keys it names, the steps that fix it, the executions so far, and who owns it. From here you preview a step, confirm it, and follow the migration of the keys it changed.

What must exist first

  • Reading the action needs the permission to read your tenant's analytics.
  • Executing a step needs the remediation write permission and the step's own permission: patching keys, rotating keys, creating keys, revoking keys or writing the tenant algorithm policy.
  • Setting a risk acceptance needs the risk acceptance permission, held by tenant administrators only.

Decisions you make here

Preview first

Choose a step and preview it. The preview changes nothing. It lists the keys a page at a time, up to 100 per page. For each key it shows the current algorithm and version, the proposed target, the other admissible targets, the proposed expiry, and why a key cannot be changed, if it cannot.

The Confirm button stays disabled until you have a preview.

Rotation or a new key identifier

A rotation keeps the key identifier. The previous version is retired: it stops encrypting and signing, and still decrypts and verifies what it protected. Applications and their authorizations keep working.

When a rotation is not possible, such as a composite key moving to a single algorithm, the plan creates a successor key and then revokes the old one as algorithm-deprecated. No authorization is copied to the successor; grant it separately.

The two are alternatives, not steps in a row: the screen shows Option A, rotate the key, or Option B, create a successor key and then revoke the superseded key, and says how many of the action's keys each option applies to. A successor is offered only for a key rotation cannot move; its preview refuses any other key, and confirming one anyway is refused.

The old key still decrypts and verifies: the revocation is offered only once the successor exists, and only while every version of the old key would still decrypt and verify once revoked. Your lifecycle policy must allow it, and a version already revoked for a security compromise stays unreadable under any policy, so a key holding one is not offered the revocation.

Conflicts with other packs

A target that fixes this pack can fail another pack the licence includes. Each conflict is listed with the pack, the item and the keys. Tick each one to acknowledge it before confirming. The platform never chooses between packs for you.

Confirming

Confirm runs the step on up to 100 keys, one at a time. One key failing does not stop the others. Each key shows done, already done, refused, failed or outcome unknown. Outcome unknown means a rotation was sent and no answer came back, so it may have been applied: it is never shown as failed, and a later run of the action checks the key again.

When the run answers, the dialog becomes its result: it says the step completed (or stopped), how many keys it moved, each key's outcome with the expiry the step wrote, and who ran it. A platform operator who ran it in a support session is shown as a platform operator, never by name. Below, the dialog reads the plan again and shows the action's status and the pack score as they are now, with a link back to the plan.

If the keys changed since the preview, or the preview is from an earlier day, the confirmation is refused: preview again. A retry of the same confirmation never runs twice. A run that stopped before finishing shows the outcomes it recorded.

One action runs once at a time: while a run is going, a retry or a second confirmation is refused. Different actions that name the same key are not held back from each other; a key the other run already changed shows as already done. If the wait for the running confirmation is too long, the confirmation is refused with nothing done: try again in a few seconds.

Follow-up

Set an owner and a target date, and mark the action open or in progress. A tenant administrator can record a risk acceptance with a reason and an end date at most one year ahead. It shows as risk accepted until then, and never changes the score.

The score delta shows what this action adds to the projected score. Closure is automatic: the action resolves when the evaluation stops failing the item.

Migration tracker

After a rotation or a new key, data protected under the old version stays readable. The tracker lists each superseded version or key and its use over the last 30 days, from the audit trail. Your applications move that data with re-encrypt and re-sign, if they choose to.

The tracker is information only. When you are satisfied, you can declare the migration complete.

If the usage cannot be read, an error shows in the tracker and the rest of the action stays usable.

A pack not included in your licence

When the licence no longer includes the pack, the action is read-only under the notice This pack is not included in your licence. Its follow-up, risk acceptance, executions and migration tracker are shown as recorded; no step, preview, edit or migration declaration is offered.

How it relates to other screens

The plan lists every action of the pack:

Key Inventory opens a key the action names:

Where to read more