Select workspace for locking control or workflow for a documented change-approval lifecycle as appropriate. This can be appropriate when an engineer claims workspace and workflow modes are identical and chooses the mode without considering approval needs. It does not directly address the present situation, where the required correction is configure supported per-ADOM workspace settings and validate the behavior of each delegated tenant.

Inspect session changes and compare the saved or submitted state before approving or discarding. This can be appropriate when a reviewer wants to see which unapproved changes are pending within a FortiManager workspace session. It does not directly address the present situation, where the required correction is configure supported per-ADOM workspace settings and validate the behavior of each delegated tenant.

Enable workspace locking on the package or its ADOM before concurrent policy edits. This can be appropriate when two administrators edit one FortiManager policy package simultaneously and overwrite each other's work. It does not directly address the present situation, where the required correction is configure supported per-ADOM workspace settings and validate the behavior of each delegated tenant.

Review device database synchronization and pending ADOM package changes as separate conditions. This can be appropriate when a device-level revision matches the FortiGate while the ADOM policy package reports modified. It does not directly address the present situation, where the required correction is inspect ADOM policy validity independently from the device-level configuration synchronization indicator.

Retrieve the current device configuration and decide whether to adopt or replace the local difference. This can be appropriate when a FortiManager Device Manager dashboard reports an out-of-sync device configuration after a local FortiGate administrator made a route change. It does not directly address the present situation, where the required correction is inspect ADOM policy validity independently from the device-level configuration synchronization indicator.

Target the responsible system template or device database layer rather than rolling back unrelated policies. This can be appropriate when an administrator performs an ADOM database revision rollback to correct a wrong NTP server stored only in a device template. It does not directly address the present situation, where the required correction is inspect ADOM policy validity independently from the device-level configuration synchronization indicator.

Check entitlement and contract status together with connectivity before diagnosing updates. This can be appropriate when an operator sees FortiGuard license-expired warnings but continues treating signature download failures as network-only issues. It does not directly address the present situation, where the required correction is replace the unsupported trial setup with an eligible licensed deployment before enabling local FDS.

Test web and email rating lookup service behavior separately from antivirus package delivery. This can be appropriate when a FortiGate downloads antivirus updates but its administrator assumes that proves its web filtering queries are correctly routed. It does not directly address the present situation, where the required correction is replace the unsupported trial setup with an eligible licensed deployment before enabling local FDS.

Enable the documented public fallback behavior only when policy allows and test the intended private-server precedence. This can be appropriate when a managed firewall is configured to query a private FortiGuard service but the local FDS is unreachable during an outage. It does not directly address the present situation, where the required correction is replace the unsupported trial setup with an eligible licensed deployment before enabling local FDS.

Forced lock removal without preserving changes can lose valid but unsubmitted configuration. That consequence is more specific to an administrator disconnects while holding an ADOM lock and a peer cannot continue urgent work. For this case, the most direct exposure is breaking a lock without review can interrupt in-progress changes and cause lost work.

Assuming a policy-package lock permits device creation can lead to failed configuration actions. That consequence is more specific to a team wants to create a new device in an unlocked ADOM while only a different package is locked. For this case, the most direct exposure is breaking a lock without review can interrupt in-progress changes and cause lost work.

Approval without reviewing session scope can authorize unintended firewall changes. That consequence is more specific to a reviewer wants to see which unapproved changes are pending within a FortiManager workspace session. For this case, the most direct exposure is breaking a lock without review can interrupt in-progress changes and cause lost work.

Use the supported Re-install Policy operation for that package after comparing target configuration. This can be appropriate when a production gateway has an approved policy package that needs reinstallation after an out-of-band device restore. It does not directly address the present situation, where the required correction is correct the target-specific interface mapping before retrying the failed installation.

Review policy import mapping and resolve unresolved interfaces and objects before accepting the package. This can be appropriate when an engineer imports a FortiGate's existing firewall rules into FortiManager but ignores mapping warnings in the wizard. It does not directly address the present situation, where the required correction is correct the target-specific interface mapping before retrying the failed installation.

Read the failed task detail and correct the reported dependency before retrying. This can be appropriate when a FortiManager installation task fails at its validation stage but the operator retries unchanged settings repeatedly. It does not directly address the present situation, where the required correction is correct the target-specific interface mapping before retrying the failed installation.

Controlled script lifecycle management reduces high-blast-radius administrative mistakes. This mechanism instead applies when an engineer edits a saved script without updating its documented purpose and target risk. The current correction relies on script execution uses target-device command syntax and must account for product versions.

FortiManager workspace permissions and locking also apply to script authoring workflows. This mechanism instead applies when an administrator edits a script in workspace mode without first obtaining the required creation or editing lock. The current correction relies on script execution uses target-device command syntax and must account for product versions.

FortiManager scripts apply managed configuration operations across explicitly selected targets. This mechanism instead applies when an engineer plans to change the same NTP server on 60 gateways using manual command-line sessions. The current correction relies on script execution uses target-device command syntax and must account for product versions.

The cleanup removes only objects with no required references across the appropriate scope. That observation is relevant for the separate case an object cleanup plan proposes deleting all address objects that are not shown in the first policy table. Here the decisive evidence is removed rules are proven unneeded across the intended target packages.

A policy preview shows the obsolete member removed wherever the group is referenced. That observation is relevant for the separate case a shared policy contains an address group with one obsolete member that could allow traffic to a retired server. Here the decisive evidence is removed rules are proven unneeded across the intended target packages.

Installation preview includes exactly the intended devices for that rule and package. That observation is relevant for the separate case a policy administrator copies a new rule but forgets to identify which FortiGate devices should receive it. Here the decisive evidence is removed rules are proven unneeded across the intended target packages.

Replace factory credentials and restrict management-plane access using organizational standards. This can be appropriate when an administrator leaves a factory default management account unchanged after initial deployment. It does not directly address the present situation, where the required correction is reconcile the restored license, network identity and registered device connectivity after migration.

Configure approved NTP sources and verify time synchronization before relying on event timestamps. This can be appropriate when a secure management deployment requires accurate audit timestamps but its local clock drifts. It does not directly address the present situation, where the required correction is reconcile the restored license, network identity and registered device connectivity after migration.

Complete the initial setup workflow with the approved management address, gateway and DNS settings. This can be appropriate when a newly deployed FortiManager appliance is reachable only through an unplanned factory addressing scheme. It does not directly address the present situation, where the required correction is reconcile the restored license, network identity and registered device connectivity after migration.

Device Manager shows an established trusted central management session for the gateway. That observation is relevant for the separate case a remote FortiGate has working user traffic but its FortiManager management session is disconnected. Here the decisive evidence is the replacement device is managed under the authorized record with current configuration restored.

The device can be matched to its authorized model record during registration. That observation is relevant for the separate case an offline model device has no known serial number and the selected onboarding method requires a serial match. Here the decisive evidence is the replacement device is managed under the authorized record with current configuration restored.

The managed device database reflects the current approved interface configuration. That observation is relevant for the separate case an operations engineer expects changes to FortiGate interfaces to appear in Policy & Objects without maintaining the device database. Here the decisive evidence is the replacement device is managed under the authorized record with current configuration restored.

System templates supply reusable device-level baseline settings through FortiManager. This mechanism instead applies when a fleet of branch appliances requires identical DNS and NTP settings but is being configured by hand on every unit. The current correction relies on FGFM is the control communication mechanism used for FortiGate and FortiManager management.

Managed device registration and policy package target assignment are distinct steps. This mechanism instead applies when a large deployment authorizes a discovered FortiGate but forgets to attach it to any intended policy installation package. The current correction relies on FGFM is the control communication mechanism used for FortiGate and FortiManager management.

FortiManager tracks managed devices by identity and can support controlled device replacement. This mechanism instead applies when a FortiGate was replaced after hardware failure, and the new unit is still associated with a stale device identity. The current correction relies on FGFM is the control communication mechanism used for FortiGate and FortiManager management.

Compare target firmware capabilities and ADOM policy schema before attempting another installation. This can be appropriate when a security policy installation repeatedly fails only for a device with a much older FortiOS version. It does not directly address the present situation, where the required correction is compare task completion, target policy version and subsequent device configuration retrieval.

Read the failed copy detail and align the object with the target FortiOS feature support. This can be appropriate when an installation task fails during object-copy processing because the target device rejects an unsupported security profile field. It does not directly address the present situation, where the required correction is compare task completion, target policy version and subsequent device configuration retrieval.

Inspect per-target task results and isolate only the failed device for repair. This can be appropriate when an installation fails on one branch and the administrator assumes every target in the batch failed. It does not directly address the present situation, where the required correction is compare task completion, target policy version and subsequent device configuration retrieval.