A Password Rotation Policy changes the passwords of the vault items it lists, on a schedule or after a number of uses. The new password is generated from the item's Password Policy, set on the target through a gateway, and stored as a new version in the vault.
|
Applies to |
Who can do this |
|---|---|
|
Monopam v2026.10 |
Administrators with permission to manage policies. |
Create the policy
-
Open Policies → Add New → Advanced, choose Password Rotation Policy and enter a name.
-
Under Schedule (1), choose Time Based and click Add timing (every minute, hourly, daily, weekly, monthly, annually or custom), or Access Based to rotate after a number of uses. Monopam shows when the next run will happen.
-
On the Credentials tab (2), click Add Credential and select the vault items.
Figure 1. A monthly rotation for one account.
-
In Credentials to Rotate, select the items (1). Under Automations (2), add steps that run after the password changes, one per dependent system, for example updating a web console or restarting a service. Click Save (3).
Figure 2. Choosing what to rotate.
-
On the Settings tab (3 in Figure 1), set Record Session and If Automation Fails, then click Save.
Settings
|
Field |
Options |
|---|---|
|
Record Session |
System Default (the tenant setting), Never, Always, or Record on Fail (keep the recording only when the rotation fails). Applies to web automation sessions. |
|
If Automation Fails |
Revert to the previous password rolls the vault and the target back so they stay consistent (recommended); if the revert itself fails, the credential is flagged. Keep the new password keeps the newly generated password even if an automation fails. |
The Automation column (4 in Figure 1) shows Passive when the item has no automation of its own. Run Now runs the policy immediately.
Troubleshooting
|
What you see |
Why |
What to do |
|---|---|---|
|
Rotation fails for a server. |
The gateway cannot reach the server, or the account cannot change its own password. |
Check the resource with Test and the run under Automations. |
|
The vault and the server disagree after a failed rotation. |
Keep the new password was selected and an automation failed. |
Use Reconcile from the Vault list to push the vault's password to the server. |
Related
-
Password rotation and reconcile
-
Vault items
-
How policies work