Key rotation

Admin key

Rotate from the dashboard:

1. Open the dashboard.
2. Click Rotate admin key in the Settings panel.
3. The new key is shown once. Copy it to your password manager.
4. All existing sessions are invalidated immediately.
5. Re-log-in with the new key.

The rotation writes the new value to your Key Vault as admin-key. The customer-runtime reads from KV with a short in-process cache, so the new key takes effect across all instances within ~30 seconds (the dashboard shows “settling…” until it confirms).

Rotation is also how you create the first key — a fresh deployment has none. See Admin key.

Old ?code= links die immediately after a rotation.

AAD app client secret

No rotation needed. The current customer-runtime validates Teams SSO tokens by JWT signature against your tenant’s public keys — it never uses the AAD app’s client secret. The secret printed by scripts/create-aad-app.mjs when you set up the AAD app is not consumed by anything in the deployed stack, so its 90-day expiry does not affect SSO: agents keep signing in after it lapses.

If a future release introduces a flow that needs the secret (e.g. on-behalf-of Graph calls), the changelog and updates page will say so, along with the rotation procedure.