Skip to content

Renewing a Tenant Posture

A tenant posture is the signed statement that can turn Pause off for a tenant's endpoints (or set its maximum length), and lets any browser extensions it lists use the endpoint's local engine. Endpoints accept a posture for at most 7 days, and the key that signs it is kept offline -- the control plane cannot re-sign it. Whoever holds that key must re-sign and upload the posture every week.

When it expires

Every endpoint in the tenant refuses the expired document:

  • Pause is available by default (since 2026-10-16), so an expired posture does not remove it. If the posture had turned Pause off, endpoints that verified it keep Pause off until a valid posture says otherwise. Organizations can also turn Pause off through device management (PauseEnabled = false) or the tenant setting.
  • Browser extensions listed in the posture lose access to the endpoint's local engine.

No release channel gates Pause any more.

The customer portal shows the posture's state on Mission Control and Endpoints -- valid, expiring soon, expired, or none uploaded -- and, when it has expired, which of these controls are off. Platform administrators also see every tenant on the admin dashboard, and -- when the deployment has a mail server and recipients configured -- are emailed 48 hours before expiry, 24 hours before, and on expiry. The dashboard shows whether each warning was actually handed to the mail server.

Renew it

  1. On the offline machine that holds the posture signing key:

    python3 agents/endpoint-agent/tools/sign_tenant_posture.py sign \
  --tenant-id <tenant> --posture <unregulated|regulated> [--allow-pause] \
  --serial <current serial + 1> --validity-days 7 \
  --key <path to the private key> --key-id <key id> \
  --out <tenant>-posture.json

    The serial must be higher than the current one (the portal shows it). Keep the same posture and permissions unless you mean to change them.

  2. Copy only the signed JSON file -- never the key -- to the control-plane host.

  3. Upload it there:

    curl -sS -X PUT http://127.0.0.1:8000/admin/tenant-posture/<tenant> \
  -H "x-api-key: $CYBERARMOR_API_SECRET" \
  -H "content-type: application/json" \
  --data @<tenant>-posture.json

  4. The portal now shows the posture as valid with the new expiry. Endpoints pick it up on their next posture sync; a device that was offline gets it when it reconnects.