Rotate a credential without losing history

How to rotate

1. Open the agent’s connection and choose rotate.
2. Copy the new Application Password. It is shown once, like the first one.
3. Update the calling system’s configuration.
4. Run a connection health test to confirm the new secret resolves.

What changes and what does not

• The old secret stops working immediately. Any system still sending it will report the agent as not recognized until it is updated.
• The agent record is unchanged. Same identity, same name, same purpose, same environment.
• Permissions are unchanged. The matrix belongs to the agent, not the credential.
• The audit history is unchanged. It is attached to the identity, so a rotation does not create a gap or start a new trail.

When to rotate

• On whatever schedule your organisation uses for service credentials.
• Whenever a credential may have been exposed — in a log, a screenshot, a support thread, a repository.
• When someone with access to the credential leaves.
• After an incident, before returning the agent to service.

Related guides

• IdentityAgent not recognized

  The request arrived without a resolvable managed identity, so it stopped at the first gate. Check state, environment, connection and credential.

• IdentityConnect an agent with the wizard

  Generate an Application Password for a dedicated user, copy it once, and confirm the connection is healthy before handing it to an agent.

• RecoveryTerminate sessions and credentials

  Sessions are ended connection-wide and credentials invalidated before the connection state changes, so nothing in flight outlives the decision.