Test web and email rating lookup service behavior separately from antivirus package delivery. This can be appropriate when a FortiGate downloads antivirus updates but its administrator assumes that proves its web filtering queries are correctly routed. It does not directly address the present situation, where the required correction is configure the supported outbound proxy settings for FortiGuard network access.

Validate supported firmware image and device model compatibility before scheduling deployment. This can be appropriate when an administrator wants to push approved firmware to many FortiGates but did not review each model's compatibility. It does not directly address the present situation, where the required correction is configure the supported outbound proxy settings for FortiGuard network access.

Enable the documented public fallback behavior only when policy allows and test the intended private-server precedence. This can be appropriate when a managed firewall is configured to query a private FortiGuard service but the local FDS is unreachable during an outage. It does not directly address the present situation, where the required correction is configure the supported outbound proxy settings for FortiGuard network access.

The intended interface settings and package mappings both validate after adjustment. That observation is relevant for the separate case an engineer changes a FortiGate interface in Device Manager but expects that change to update all firewall rule objects automatically. Here the decisive evidence is device and ADOM states converge to the reviewed expected policy and system configuration.

NTP settings are corrected without changing accepted firewall rule packages. That observation is relevant for the separate case an administrator performs an ADOM database revision rollback to correct a wrong NTP server stored only in a device template. Here the decisive evidence is device and ADOM states converge to the reviewed expected policy and system configuration.

The report correctly identifies that local device settings are current but a central policy install remains pending. That observation is relevant for the separate case a device-level revision matches the FortiGate while the ADOM policy package reports modified. Here the decisive evidence is device and ADOM states converge to the reviewed expected policy and system configuration.

Use the supported Re-install Policy operation for that package after comparing target configuration. This can be appropriate when a production gateway has an approved policy package that needs reinstallation after an out-of-band device restore. It does not directly address the present situation, where the required correction is confirm actual installed rule order, object values and traffic logs rather than relying on task success alone.

Review the install preview and device-level settings before approving the combined operation. This can be appropriate when a policy installation preview displays unexpected changes to DNS configuration on a target firewall. It does not directly address the present situation, where the required correction is confirm actual installed rule order, object values and traffic logs rather than relying on task success alone.

Supply the missing target-specific dynamic mapping and revalidate the installation. This can be appropriate when an operator attempts to deploy a security policy with a dynamic address object that has no mapping for one target. It does not directly address the present situation, where the required correction is confirm actual installed rule order, object values and traffic logs rather than relying on task success alone.

Unlocked concurrent editing can silently lose approved firewall changes. That consequence is more specific to two administrators edit one FortiManager policy package simultaneously and overwrite each other's work. For this case, the most direct exposure is skipping approval sessions can violate separation-of-duties requirements.

Selecting the wrong collaboration mode can leave required approval steps unenforced. That consequence is more specific to an engineer claims workspace and workflow modes are identical and chooses the mode without considering approval needs. For this case, the most direct exposure is skipping approval sessions can violate separation-of-duties requirements.

Assuming a policy-package lock permits device creation can lead to failed configuration actions. That consequence is more specific to a team wants to create a new device in an unlocked ADOM while only a different package is locked. For this case, the most direct exposure is skipping approval sessions can violate separation-of-duties requirements.

Enable or execute the supported device configuration retrieval and revision retention workflow. This can be appropriate when a customer asks which FortiGate configuration was in force when an incident began, but the registration record lacks recent retrieved revisions. It does not directly address the present situation, where the required correction is reassign the managed device through a supported ADOM move after validating target packages and permissions.

Review the discovered device configuration and reconcile import differences before accepting central control. This can be appropriate when a FortiGate has been discovered, but its import report shows inconsistent settings compared with the planned baseline. It does not directly address the present situation, where the required correction is reassign the managed device through a supported ADOM move after validating target packages and permissions.

Refresh cluster discovery and verify the member serials and HA topology in Device Manager. This can be appropriate when a FortiGate HA cluster adds a replacement secondary member, but FortiManager still displays the old member inventory. It does not directly address the present situation, where the required correction is reassign the managed device through a supported ADOM move after validating target packages and permissions.

A complete migration includes dependent services beyond transferring configuration files. This mechanism instead applies when FortiManager configuration is migrated to replacement hardware but administrators forget to validate device entitlements and reachability. The current correction relies on time synchronization establishes a consistent chronology across managed infrastructure.

FortiManager can perform core management in environments with restricted external connectivity. This mechanism instead applies when a deployment in a restricted network has no direct internet access but needs centrally managed device configuration. The current correction relies on time synchronization establishes a consistent chronology across managed infrastructure.

FortiManager feature and device limits depend on the installed license entitlement. This mechanism instead applies when a FortiManager virtual appliance starts but license activation has not been completed. The current correction relies on time synchronization establishes a consistent chronology across managed infrastructure.

Enable workspace locking on the package or its ADOM before concurrent policy edits. This can be appropriate when two administrators edit one FortiManager policy package simultaneously and overwrite each other's work. It does not directly address the present situation, where the required correction is obtain the ADOM-level lock required for device creation under the relevant workspace configuration.

Check whether the device can be locked independently under the configured workspace and ADOM mode. This can be appropriate when a managed device requires a local interface correction, but the policy package is locked by another administrator. It does not directly address the present situation, where the required correction is obtain the ADOM-level lock required for device creation under the relevant workspace configuration.

Configure supported per-ADOM workspace settings and validate the behavior of each delegated tenant. This can be appropriate when an MSP wants each tenant ADOM to use a different editing collaboration model. It does not directly address the present situation, where the required correction is obtain the ADOM-level lock required for device creation under the relevant workspace configuration.

Test FGFM management connectivity, permitted service paths and authorized device status. This can be appropriate when a remote FortiGate has working user traffic but its FortiManager management session is disconnected. It does not directly address the present situation, where the required correction is review pending device authorization and approve the intended serial number into its correct ADOM.

Apply a supported system template to the correct managed devices or device group. This can be appropriate when a fleet of branch appliances requires identical DNS and NTP settings but is being configured by hand on every unit. It does not directly address the present situation, where the required correction is review pending device authorization and approve the intended serial number into its correct ADOM.

Use the supported device-replacement or registration workflow and reconcile the new serial record. This can be appropriate when a FortiGate was replaced after hardware failure, and the new unit is still associated with a stale device identity. It does not directly address the present situation, where the required correction is review pending device authorization and approve the intended serial number into its correct ADOM.

Restored central data may predate the live device revision and needs reconciliation. This mechanism instead applies when a restored FortiManager database contains imported revisions but the newest branch firewall configuration was changed after the backup. The current correction relies on configuration retrieval refreshes FortiManager's observed copy of managed-device settings.

Device revision history exposes differences between observed firewall state and centrally managed state. This mechanism instead applies when a FortiGate policy changed locally but FortiManager shows an older managed configuration revision. The current correction relies on configuration retrieval refreshes FortiManager's observed copy of managed-device settings.

Device revisions and policy package status track distinct configuration layers. This mechanism instead applies when a managed FortiGate reports a configuration conflict while its policy package status says modifications remain pending. The current correction relies on configuration retrieval refreshes FortiManager's observed copy of managed-device settings.

Stale device target references can confuse subsequent fleet policy deployments. That consequence is more specific to a branch FortiGate is removed from FortiManager but its policy package installation target remains in historical reports. For this case, the most direct exposure is a healthy device database does not imply a newly edited ADOM policy package is valid.

Assuming ADOM object edits are immediately active can leave the firewall enforcing old data. That consequence is more specific to a new policy object is created in an ADOM but the managed FortiGate still shows the original object value. For this case, the most direct exposure is a healthy device database does not imply a newly edited ADOM policy package is valid.

The central policy can fail even when both the device and ADOM records are individually valid. That consequence is more specific to a FortiGate uses a different interface alias than the central ADOM policy expects. For this case, the most direct exposure is a healthy device database does not imply a newly edited ADOM policy package is valid.

Separate unmanaged records for one HA pair can create inconsistent member targeting. That consequence is more specific to two new FortiGates in a high-availability pair are being registered independently with conflicting configuration records. For this case, the most direct exposure is incorrect ADOM membership can expose customer configuration to unrelated administrators.

Blocked management control traffic prevents registration regardless of IP reachability to other services. That consequence is more specific to a device registration wizard cannot discover a branch gateway because the management path crosses a blocked security segment. For this case, the most direct exposure is incorrect ADOM membership can expose customer configuration to unrelated administrators.

Unapproved requests cannot receive the intended centralized policy and configuration management. That consequence is more specific to a branch FortiGate requests authorization from FortiManager but does not appear among managed devices. For this case, the most direct exposure is incorrect ADOM membership can expose customer configuration to unrelated administrators.