Find a key and check its state, versions and rotations

Find a key in your tenant and read where it stands: its status and limits, its material versions, how and when it rotates, and whether a destruction was requested for it.

Who can do it

Anyone who holds the permission to read keys: every built-in tenant role, and every built-in platform role working inside the tenant. Parts of a key's detail need a further read permission:

• The Lineage tab needs the permission to read material versions.
• The Next rotation column and row need the permission to read rotation schedules.
• The Rotation schedule tab needs the permission to read the tenant's schedules, which the built-in tenant roles hold and the built-in platform roles do not.

Before you start

• Know the key's identifier, or enough of it to search for. A key keeps one identifier for its whole life; rotating it adds a material version under the same identifier.
• The detail described here is read-only. Changing a key's state is a separate task.

Steps

1. Open Key Inventory. Key managers land on it when they sign in; tenant administrators open it from their tenant's navigation.
2. Narrow the list:
   • Type part of the identifier in Search by key ID.... The search narrows the keys on the current page.
   • Choose a status, from All Status to Destroyed (read-only), which shows destroyed keys with their cause and dates.
   • Choose a key type in All Types, or a Conformance verdict against your algorithm policy.
   • Select Unreferenced only to keep the keys on the current page that nothing references.
3. Read the row: Key ID, Type, Algorithm, Status, Conformance, Usage, References, Expires and Next rotation.
4. Select the row, or View Details, to open the key's detail.
5. On Details, read:
   • Key Information: the Key ID, the Key identity that names this one key, the Origin, the Security Level, the Expires date and the Next rotation.
   • Lifecycle & Usage: the Status, why the key stopped protecting when it did, the cause and dates of a revocation or archive, whether it is Exportable, its Key Operations, its Usage against its limit and its Soft Limit.
   • Automatic rotation: whether Rotate this key automatically is on, the triggers under When to rotate, and the Tolerance.
   • Destruction: for an archived, pending-destruction or destroyed key, the destruction request and orders.
   • Raw JSON Metadata: the whole single-key read, which you can copy.
6. Select Lineage to see every material version with its Version, status, algorithm, Rotation cause, Activated, Retired, expiry and Revocation.
7. Select Rotation schedule to see the key's schedule and its runs. With more than one schedule, Show executions chooses whose runs are shown.
8. Select Access to see the capability grants that name the key, and Audit History for the key's own audit trail.

What you see when it worked

The detail shows the key's state as the server read it on opening, and its footer offers only the actions the server allows on that key now. When no lifecycle action is open to you, the footer says why.

Two server verdicts are shown where you would act on them rather than in the detail: whether the key may rotate now, when you start Rotate, and what each cause would do to reads on this key, when you open Suspend or Revoke.

If it fails

Without the console

Four of these reads have no control of their own in the console: one material version alone, the key's rotation executions, the key's destruction orders as a list, and the cryptographic service's own metadata read, which an application makes and no built-in role holds.

Related

• Key Inventory: what the screen shows and every decision you make on it.