There are three principal prerequisites for deploying Secure Snapshots, which are as follows:

• Secure Snapshots can only be enabled once the cluster has been committed to OneFS 9.12 or later.
• SnapshotIQ needs to be licensed, plus an account with the ‘ISI_PRIV_SNAPSHOT’ privilege is required for configuration.
• Multi-Party authorization (MPA) must be active on the cluster and configured for two or more approvers.

The user that wants to change or delete the snapshot and approver must not be the same user.

NOTE: The user wishing to modify or delete a secure snapshot and the approver must be two different users.

MPA can be enabled from the WebUI under Access > Multi-Party Authorization > Settings:

Multi-party authorization from the WebUI

NOTE: MPA cannot be enabled on a PowerScale cluster without having at least two registered approvers.

Enabling MPA from the WebUI

When successfully enabled, the following status banner will be displayed:

WebUI confirming successful MPA enablement

Alternatively, enabling via the CLI can be done with the following command syntax:

# isi mpa settings global modify –enable true
# isi mpa settings global view
Multi Party Authorization is enabled

NOTE: In OneFS 9.12, MPA cannot be disabled once it has been enabled.

Once MPA is enabled on a cluster, any requests to delete Secure Snapshots or modify their schedules, etc, are paused pending approval.

The general flow of Secure Snapshot privileged command execution is as follows:

Secure snapshots privileged command execution workflow

Once MPA is activated, any secure snapshot deletion or other privileged action requests are blocked pending approval.

Secure snapshots privileged command execution in pending state

As such, an attempt to delete a secure snapshot generates a warning, and the action is suspended until approved by an authorized user. For example:

Warning displayed when attempting to delete a secure snapshot

Similarly, from the CLI:

# isi snapshot list
ID   Name                                         Path
-----------------------------------------------------------------
40    Snapshot:2025July21.2:44PM      	        /ifs/data
42    SIQ-8b30297763c5db7307e2d84504839c25-new    /ifs/data/zone1
# isi snapshot delete 40
Are you sure? (yes/[no]): yes
Delete Snapshot is a privileged action . A request paareqa99439a172d09999 to perform this action is pending approval. Check Multi-Party Authorization to view the status of the request.

Details of the requested snapshot privileged action can be viewed as follows:

Details of a secure snapshot modification request

Similarly, from the CLI:

# isi mpa requests view --id= paareqa99439a172d09999
		     	    ID: paareqa99439a172d09999
		      Action: delete_snapshot
	    Action Payload: -
	        Created By: MPA
        Last Update Time: 2025-07-21T14:44:56
	      Resource IDs: 40
	     Resource Type: snapshot
		     Service: snapshot
		      Status: pending
	       Request For: 0

Assuming they sanction the privileged action, the authorizer grants approval for the snapshot deletion, or other privileged action.

Secure snapshots privileged command execution in approved state

This is achieved by clicking the ‘Approve’ button for the pending request, under Access > Multi-Party Authorization > Requests:

Approval option for a snapshot modification request

The authorizer is then prompted for their TOTP security authorization code as part of the approval process.

Approval request prompt for security code (TOTP)

Or via the CLI:

# isi mpa requests list
# isi mpa requests approve <id> <comment> <approved> --totp-code <******> --approval-valid-before <timestamp> --zone <zone>

Once approval has been granted, the privileged snapshot operation can complete as expected.

Secure snapshots privileged command execution in completed state

The WebUI reports a successful approval status as follows:

Banner confirming successful approval of a snapshot modification request

Similarly, from the CLI:

# isi mpa requests approve --approved=true –id= paareqa99439a172d09999–comment=approved
totp_code:
Request paareqa99439a172d09999has been approved successfully.
# isi snapshot delete 40
Are you sure? (yes/[no]): yes
# isi snapshot list
ID   Name                                          Path
-----------------------------------------------------------------------------
42    SIQ-8b30297763c5db7307e2d84504839c25-new      /ifs/data/zone1

NOTE: A snapshot schedule will only generate secure snapshots if it is configured to create snapshots with expiration dates.

For example:

Expiration options when creating a snapshot schedule

The new Secure Snapshots feature in OneFS 9.12 is designed to complement, rather than replace, the existing SnapshotIQ locking mechanism, which is managed via the ‘isi snapshot locks’ CLI command set.

Secure Snapshots operate independently and do not interfere with the creation, removal, or general operation of the regular SnapshotIQ snapshot locks.

While SnapshotIQ locks help prevent snapshots from being accidentally or unintentionally deleted, unlike Secure Snapshots, they do not offer the additional anti-tamper protection of Multi-Party Authorization (MPA).

SnapshotIQ locks function as follows. For example, a manual snapshot, ‘snaploc1’ is taken of /ifs/test:

# isi snapshot snapshots create /ifs/test --name snaploc1
# isi snapshot snapshots list | grep snaploc1
79188 snaploc1                                     /ifs/test

A lock is then placed on it (in this case lock ID=1):

# isi snapshot locks create snaplock1
# isi snapshot locks list snaploc1
ID
----
1
----
Total: 1

Similarly, snapshot lock creation can be performed via the WebUI:

Snapshot lock creation

Banner confirming successful snapshot lock creation

Attempts to delete the snapshot fails because the lock prevents its removal:

# isi snapshot snapshots delete snaploc1
Are you sure? (yes/[no]): yes
Snapshot "snaploc1" can't be deleted because it is locked

The CLI command ‘isi snapshot locks delete <lock_ID>’ can be used to clear existing snapshot locks, if desired. For example, to remove the only lock (ID=1) from snapshot ‘snaploc1’:

# isi snapshot locks list snaploc1
ID
----
1
----
Total: 1
# isi snapshot locks delete snaploc1 1
Are you sure you want to delete snapshot lock 1 from snaploc1? (yes/[no]): yes
# isi snap locks view snaploc1 1
No such lock

Similarly, snapshot locks can be deleted via the WebUI:

Snapshot lock deletion

Banner confirming successful snapshot lock deletion

Once the lock is removed, the snapshot can then be deleted:

# isi snapshot snapshots delete snaploc1
Are you sure? (yes/[no]): yes
# isi snapshot snapshots list| grep -i snaploc1 | wc -l
       0

A snapshot can have up to a maximum of sixteen SnapshotIQ locks on it at any time. Also, lock numbers are continually incremented and not recycled upon deletion.

Like snapshot expiry configuration, snapshot locks can also have an expiry time configured too, although this is not protected by Multi-Party Authorization.

For example, to set a lock on snapshot ‘snaploc1’ that expires at 12pm on April 1st, 2026:

# isi snap lock create snaploc1 --expires '2026-04-01T12:00:00'
# isi snap lock list snaploc1
ID
----
36 
----
Total: 1

Recommended practices, considerations, and caveats for Secure Snapshots on OneFS 9.12 and later include:

• For enhanced security, it is recommended to enable Secure Snapshots in conjunction with Root Lockdown Mode (RLM).
• Secure Snapshots are not supported in Compliance Mode.
• When upgrading a cluster from an earlier release, the Secure Snapshots privileged actions and the underlying Multi-Party Authorization (MPA) approval system becomes available after committing the upgrade to OneFS 9.12 or later.
• As part of the upgrade process, a pre-check is performed to ensure that no existing role named ‘ApprovalAdmin’ (case-insensitive) is present. If such a role exists, administrators will be prompted to rename it to avoid conflicts with the newly introduced system role.
• An authorized user can view or update a Secure Snapshots privileged action request while it is in a ‘pending’ state, but only an MPA approver user can move the request to an ‘approved’ or ‘rejected’ state.
• Once Secure Snapshots and MPA functionality is activated, it cannot be disabled in OneFS 9.12.
• Secure snapshots in OneFS 9.12 can only be created via a snapshot schedule with a configured expiry time. The ad-hoc securing of individual snapshots is not supported at this time.
• Secure snapshots currently uses the OneFS system clock for its expiration time. Use of the OneFS compliance clock will be supported in a future version.
• With secure snapshots enabled, only the following privileged functions will require MPA approvals:
  • Deleting a snapshot prior to its expiry date
  • Shortening the expiry date of a snapshot
  • Renaming a snapshot using reserved name
  • Modifying a snapshot schedule
• Feature-generated snapshots (i.e. from FSA, MetadataIQ, SyncIQ, SmartSync, etc.) and user scheduled snapshots will still be automatically deleted by OneFS, per their respective schedule, without any need for MPA approvals.

The Dell Technologies Info Hub provides expertise to ensure customer success with Dell storage and data protection products.

Dell.com/support is focused on meeting customer needs with proven services and support.