Quorum Approval
What this screen is for
This screen turns on two-person control for your tenant: quorum (M-of-N) approval. With it on, an operation it gates changes nothing when someone asks for it. The request waits, and the operation runs only when M approvers other than the person who asked have approved it. Here you set the policy, and you decide the requests that wait for you.
Quorum approval is off by default. While it is off, nothing on this screen changes how any other screen behaves.
What must exist first
- The permission to read your tenant's quorum policy shows this screen. Without it the screen says so and reads nothing.
- To change the policy you need the permission to manage it; to approve or reject a request, the approve permission; to withdraw your own request, the cancel permission.
- Enabling needs M + 1 eligible approvers: active members of your tenant holding the approve permission. A requester never approves their own request, so with fewer of them a request could never be approved. When there are not enough, the control stays visible and says why it is unavailable.
Decisions you make here
Turning it on, and what it gates
Set the approvals a request needs (1 to 10, never counting the requester), how long a request may wait (1 to 336 hours), and the operations to gate: requesting the destruction of a key or one of its versions (always gated: with no policy one approval is needed, and the policy can raise it), weakening a key (extending or removing an expiry, raising or removing a usage limit, making it exportable), and changing your lifecycle, algorithm or rotation policies.
Two operations are always gated once the policy is on, and their boxes cannot be cleared: changing the quorum policy itself, and making someone an approver (a role assignment, a reactivation, a new or edited role, or a federation rule that would give someone the approve permission).
When the change applies, the screen lists your applications whose calls will wait for approval from now on. It is a warning, never a refusal: no caller is exempt.
Changing it or turning it off
Once the policy is on, it guards itself. Changing it or turning it off becomes a request like any other, and nothing changes until your approvers approve it.
Health
The policy reads Degraded when fewer than M + 1 approvers remain, for example after one was suspended. It keeps gating, and the screen warns you: a request by one of the remaining approvers may no longer reach its approvals. Give another active member the approve permission to restore it.
Deciding requests
The requests list opens on the ones that are Pending. For each one you see the operation and its target, who asked for it (a person, a workload or an application), the approvals it holds and when it expires.
- Approve counts your approval. The approval that reaches the quorum runs the operation, as the person who asked for it and with what they sent. If the operation refuses at that moment, the request ends Failed with the reason.
- Reject ends the request; one rejection is enough.
- Withdraw is offered on your own pending request only. You are never offered the approval of your own request.
A request can also end Executed, Cancelled (withdrawn, or its requester can no longer act) or Expired.
Approving, rejecting, and changing, turning off or recovering the policy ask for a recent confirmation of who you are. If you last confirmed it more than a few minutes ago, Confirm your identity to continue opens with your own sign-in steps; once you confirm, your decision is sent. Nothing is recorded until then.
A recovery the platform scheduled
If your policy is degraded, your platform operator can recover it, never at once and never alone: a second platform administrator approves it, and it takes effect 72 hours later. While it is scheduled, this screen shows who asked for it and when it takes effect. When it does, your policy is deleted and its waiting requests are cancelled.
If you can give the policy the approvers it needs, Cancel the recovery. The policy stays as it is.
How it relates to other screens
The quorum entry on your Policies hub shows the policy's state and how many requests wait:
On any other screen, an operation the policy gates is shown as waiting for approval, with a link to its request here, never as a failure.