10.4The configuration kill switch

Administrators of the server can switch operations off in the API's production configuration file, appsettings.Production.json in the API's installation folder, under the Operations:Disabled section. Upgrades never overwrite this file, so the setting survives an update. This is the outermost control: an operation disabled here cannot run and cannot be re-enabled from the Directory Policies screen, where it shows a padlock in the Enabled column.

You can name operations in three ways, and an operation is disabled when any of them matches. Matching is not case-sensitive.

For example, to stop every destructive operation and the deletion of users in particular:

{
  "Operations": {
    "Disabled": {
      "Commands": [ "DeleteActiveDirectoryUserCommand" ],
      "Categories": [ ],
      "Sensitivities": [ "Destructive" ]
    }
  }
}

Important behaviours:

• Edits to this section take effect without restarting the service.
• When the service starts, an entry that names no known command, category or risk class stops it from starting, so that a typing mistake can never leave an operation enabled that you meant to switch off. The cause is written to the start-up log, C:\Logs\startup-YYYYMMDD.log. This matters most after an upgrade, if a new release renamed a command your configuration names. If you edit the file while the service is running, unknown entries are reported in the application log instead.
• The Directory Policies header shows a warning pill such as "3 disabled by configuration".

Important: Use the configuration kill switch for decisions that must not be undone from the console, for example during an incident. For everyday decisions, use the Directory Policies screen, where every change is audited and visible.