The rotation compliance report
Which credentials are out of compliance with the rotation your Master Policy requires, and why — including credentials whose one-time-password control has no schedule to run.
The rotation compliance report lists credential rotation status and the specific reason for each finding, alongside summary counts. The report is computed fresh each time it is opened, not a stored snapshot.
Opening the report
A Compliance report button on /pam/rotation opens it in a modal: summary counts, a searchable table (credential name, a compliant/non-compliant pill, the reason, last rotated date, and interval), and a Download CSV button.
The CSV export runs entirely in your browser — there is no separate server-side export endpoint — and its cell escaping guards against formula injection the same way the audit log's own CSV export does: a cell beginning with =, +, @ or - is prefixed so a spreadsheet reads it as text rather than evaluating it as a formula.
What to do next
- Run this report after turning on
one_time_passwordanywhere, to confirm every affected credential actually has a schedule. - For a non-compliant finding with no obvious cause, cross-check A credential rotation failed.
Reading the result before taking action
The table includes compliant credentials as well as findings. An account with no active schedule is reported as having no rotation schedule configured; a paused schedule does not count as active coverage. A failed last attempt takes precedence over an overdue next run. On schedule means the next scheduled run has not passed and the last recorded status is not failed. It does not prove that the target is reachable now or that a future rotation will succeed.
After correcting a schedule or investigating a failed attempt, close and reopen the report to obtain a new result. Keep the downloaded CSV with the time and scope of your review if you need evidence of what was visible then. The current synchronous report reads at most 2,000 credentials. For a larger vault, do not treat its total as proof that every account was examined; arrange a separately scoped review.