Encryption Key Lifecycle Changed

REGISTERED

Info

VALIDATED

Info

VALIDATION_FAILED

High

DELETION_SCHEDULED

High

DELETED

High

specversion

Event schema version.

ev20260814

source

System that sent the event. Possible values: CONTROLPLANE, M365, AZURE.

CONTROLPLANE

timestamp

Time when the event happened, in RFC3339Nano format and the UTC time zone.

2026-08-04T09:18:42Z

type

Event ID.

vdc.org_v0.kmskey_v0.lifecycle_v0

severity

Event severity. Possible values: INFO, LOW, MEDIUM, HIGH, CRITICAL.

INFO

visibility

Intended visibility scope of the event. Only events with the CUSTOMER_ACCESSIBLE value are forwarded to SIEM platforms, so a forwarded event always carries this value.

CUSTOMER_ACCESSIBLE

category

Event category. Possible values: BACKUP, RESTORE, LOGIN, USER_MANAGEMENT, TENANT_MANAGEMENT, ORGANIZATION_MANAGEMENT, SUBSCRIPTION_MANAGEMENT, SECURITY_ALERT, INTERNAL.

ORGANIZATION_MANAGEMENT

actor.identifier

Actor identifier.

admin@bob.networking

actor.kind

Actor type that triggered the event. Possible values: user, system, service_account.

user

organizationReference.organizationId

ID of the Veeam Data Cloud organization.

org_12345

orgId

ID of the Veeam Data Cloud organization that the event belongs to. Resolved during event processing, so it is present even when the event references only a workload tenant.

org_12345

triage.code

Fault type. Present only when the event reports a fault. Possible values: CLIENT_INVALID_INPUT, CLIENT_UNAUTHORIZED, CLIENT_ACCESS_DENIED, CLIENT_RESOURCE_NOT_FOUND, CLIENT_QUOTA_EXCEEDED, EXTERNAL_THROTTLED, EXTERNAL_ERROR, EXTERNAL_UNAVAILABLE, SYSTEM_ERROR, SYSTEM_UNAVAILABLE, SYSTEM_TIMEOUT.

CLIENT_RESOURCE_NOT_FOUND

triage.message

Fault details. Present only when the event reports a fault.

KEY_NOT_FOUND/KEY_DOES_NOT_EXIST: key not found in Azure Key Vault

data.kmskey.keyId

Control-plane-derived key ID.

b3f1c2a4-0000-0000-0000-000000000000

data.kmskey.keyDisplayName

Display name of the key. Used as the audit target, so the action reads against a human-readable name.

Finance Org CMK Key

data.kmskey.provider

Key Management Service (KMS) provider backing the key. Possible values:AZURE_KEY_VAULT.

AZURE_KEY_VAULT

data.lifecycle.action

Key-level lifecycle transition that occurred. Possible values: REGISTERED, VALIDATED, VALIDATION_FAILED, DELETION_SCHEDULED, DELETED.

REGISTERED

data.lifecycle.status

Resulting key state after the transition. Omitted for a DELETED transition, which leaves no resulting key state. Possible values: PENDING_CUSTOMER_SETUP, READY_TO_USE, ACTIVE, VALIDATION_FAILED, PENDING_DELETION.

PENDING_CUSTOMER_SETUP

data.lifecycle.previousStatus

Key state immediately before the transition. Possible values: PENDING_CUSTOMER_SETUP, READY_TO_USE, ACTIVE, VALIDATION_FAILED, PENDING_DELETION.

ACTIVE

data.lifecycle.failureReason

Human-readable cause of a VALIDATION_FAILED transition. Never contains secrets or key material.

Wrap/unwrap denied: caller lacks Key Vault Crypto User role.

data.lifecycle.failureSource

What triggered a VALIDATION_FAILED transition. Possible values: CUSTOMER_VALIDATE, MONITOR.

MONITOR

data.lifecycle.keyIdentifier

Uniform Resource Identifier (URI) of the provider key, including the key name. Never includes key material.

https://myvault.vault.azure.net/keys/prod-cmk

data.lifecycle.keyVersion

Current key version.

a1b2c3d4e5f6

data.lifecycle.scheduledDeletionAt

Hard-delete time for a DELETION_SCHEDULED transition, 30 days out.

2026-07-16T00:00:00Z

data.org.id

ID of the Veeam Data Cloud organization.

org_12345

data.org.name

Name of the Veeam Data Cloud organization.

Alice and Bob's Networking