CMK alert resolution reference
Use this guide to troubleshoot and resolve alerts triggered by misconfigured Customer Managed Key (CMK) settings in Adobe Experience Platform. It helps system administrators and implementation specialists identify causes and apply resolutions to restore secure access.
Alert categories categories
The following sections outline the types of alerts that may be triggered by Customer Managed Key (CMK) issues in Adobe Experience Platform:
Key access disabled key-access-disabled
This alert indicates that Adobe Experience Platform is unable to access the configured CMK because the key is disabled or inaccessible due to its configuration. In such cases, the system treats the condition as an intentional removal of key access.
When it occurs
This alert is triggered when the encryption key in Azure Key Vault is in a disabled state, deleted, or misconfigured in a way that prevents access during platform operations.
Possible causes
The following are common reasons this alert may occur:
- The key was manually disabled.
- Key operations (wrapKey/unwrapKey) have been removed.
- The key activation date is set in the future.
- The key expiration date is in the past.
- The key has been deleted.
- The MultiTenant App permissions have been removed or altered.
- The MultiTenant App has been deleted.
- The MultiTenant App properties have been changed.
- The Key Vault has been deleted or is no longer accessible.
Resolution
- Navigate to the Azure Key Vault that contains the CMK.
- Select the key associated with Adobe Experience Platform.
- Verify that the key’s status is set to Enabled.
- If the key is disabled, enable it using the Azure portal or the CLI command
az keyvault key enable.
| note note |
|---|
| NOTE |
| Customize this command for your Azure environment. |
- Re-add the
wrapKeyandunwrapKeypermissions to the key.
| note note |
|---|
| NOTE |
| All of the key’s settings—including activation and expiration dates—must be valid for the key to function. |
- Set the activation date to the past or present.
- Set the expiration date to a future date.
- Ensure soft-delete is enabled in Azure Key Vault.
- Navigate to “Manage deleted keys” in the Azure portal or CLI.
- Select the deleted key from the list of soft-deleted items.
- Click Recover to restore the key.
- Restore the correct permissions for the MultiTenant App.
- Ensure the following permission is granted:
Key Vault Crypto Service Encryption User
- Revert the changes to the properties associated with the MultiTenant App.
- Confirm that soft-delete is enabled in Azure.
- Navigate to “Manage deleted vaults” in the portal or CLI.
- Recover the deleted vault within your retention period (7–90 days).
- If purge protection is disabled, you may still be able to recover the vault.
| note note |
|---|
| NOTE |
| If soft-delete or purge protection is not configured correctly, the key or vault may not be recoverable. |
Key access failure key-access-failure
This alert indicates that Adobe Experience Platform failed to access the CMK due to network-level or configuration-based denial of access.
When it occurs
This alert is typically triggered when the Key Vault firewall is not configured to allow Adobe CMK access or when identity-based access fails.
Possible causes
- Key Vault firewall is blocking Adobe’s static IP (
20.88.123.53) - The key no longer exists at the expected location
- Permissions for the Adobe MultiTenant App are missing
- The Key Vault has been deleted or misconfigured
- The MultiTenant App’s Object ID has changed
Resolution
- Verify that the Key Vault and encryption key still exist.
- If the key was deleted, follow the soft-delete recovery steps under “Key access disabled.”
- Confirm that the Adobe MultiTenant App has the following permissions:
get,wrapKey, andunwrapKeyon the key.
- Check that the Object ID for the MultiTenant App is correct. If it has changed, reapply permissions.
- Review firewall rules in Azure Key Vault.
- Ensure they allow access from Adobe’s static IP:
20.88.123.53.
| note note |
|---|
| NOTE |
| Even with correct permissions, a blocked IP will prevent key access. |
Alert notification alert-notification
This alert serves as a general notification for CMK configuration or access anomalies that don’t match a known failure type.
When it occurs
This alert appears when Adobe CMK detects an unknown, unsupported, or novel issue during key access or monitoring.
Possible causes
- Unanticipated firewall/network conditions
- Key or vault changes not covered by predefined alert types
- Internal Adobe network disruptions
- Misconfiguration Adobe has not seen before
Resolution
- Review the alert message for any contextual details.
- Check firewall, vault, and key settings for recent changes.
- If no clear cause is found, contact Adobe support for guidance.
- Monitor logs and system behavior to identify patterns.
Next steps
To understand how alerts are triggered and how to configure IP allowlisting for Azure CMK, see the Configure alerts and IP allowlist for Azure CMK guide.