Only the administrator rotates the signing key; the manager keeps issuing licences
Who is involved
| Role | What they do |
|---|---|
| Subscriptions manager | Issues and manages licences but cannot rotate the signing key. |
| Tenant admin | Rotates the signing key when it must change. |
Step by step
- Subscriptions manager
Asks the administrator to rotate the key, for example after a staff change.
What they see:No rotate button on their Signing keys tab.
- Tenant admin
Opens Settings, Signing keys and chooses Rotate the key, confirming the warning.
What they see:A new key marked Signing now, and the old key marked Retired with the date it still checks licences until.
- Subscriptions manager
Issues a new licence for a customer.
What they see:The licence is issued and its details show the new key's identifier.
- Subscriptions manager
Checks that an older customer's software still works.
What they see:The older licence still verifies, because the retired key keeps verifying what it signed. Software with the old public key built in needs the new one before it can verify the new licence.
Who is told what
No message is sent; the rotation is written to the audit trail and kept permanently.
Related
- Subscriptions & Licensing
- The customer saves a card, the invoice is charged, the receipt lands in Accounting
- Usage is reported, billed and reconciled
- A manager suspends a licence, the customer's software is refused, finance sees the overdue invoice behind it
- Subscription lines on an accepted quote start subscriptions
- Subscription plans sell products from the catalogue
- Team workflows