Clarification of when data protection keys are read

[ADringer]

Hi all, just wanted to know when data protection keys are read when persistence has been configured. Does it only read on startup and write when it needs to? Does it ever read again during the lifetime of the app in the case of the persistence store has been updated externally?

Thanks

[csa7mdm]

Data Protection reads all keys on first use and caches them in memory.
It writes only when it has to create or roll keys, but it can refresh the key ring during the app’s lifetime, so external changes in the persistence store may be picked up later; it’s not limited to a single read at startup.