Learn Editor: Update policy-keys-overview.md

Author: garrodonnell

articles/active-directory-b2c/policy-keys-overview.md

@@ -50,8 +50,8 @@ The top-level resource for policy keys in Azure AD B2C is the **Keyset** contain
 | Attribute |  Required | Remarks |
 | --- | --- |--- |
 | `use` | Yes | Usage: Identifies the intended use of the public key. Encrypting data `enc`, or verifying the signature on data `sig`.|
-| `nbf`| No | Activation date and time. |
-| `exp`| No | Expiration date and time. |
+| `nbf`| No | Activation date and time. An override value can be set manually by admins.|
+| `exp`| No | Expiration date and time. An override value can be set manually by admins.|
 
 We recommend setting the key activation and expiration values according to your PKI standards. You might need to rotate these certificates periodically for security or policy reasons. For example, you might have a policy to rotate all your certificates every year.
 
@@ -72,10 +72,17 @@ If an Azure AD B2C keyset has multiple keys, only one of the keys is active at a
 - The key activation is based on the **activation date**.
   - The keys are sorted by activation date in ascending order. Keys with activation dates further into the future appear lower in the list. Keys without an activation date are located at the bottom of the list.
   - When the current date and time is greater than a key's activation date, Azure AD B2C will activate the key and stop using the prior active key.
-- When the current key's expiration time has elapsed and the key container contains a new key with valid *not before* and *expiration* times, the new key will become active automatically.
+- When the current key's expiration time has elapsed and the key container contains a new key with valid *not before* and *expiration* times, the new key will become active automatically. New tokens will be signed with the newly active key. The expired key will continue to be published for token validation until disabled by an admin. 
+
 - When the current key's expiration time has elapsed and the key container *does not* contain a new key with valid *not before* and *expiration* times, Azure AD B2C won't be able to use the expired key. Azure AD B2C will raise an error message within a dependant component of your custom policy. To avoid this issue, you can create a default key without activation and expiration dates as a safety net.
 - The key's endpoint (JWKS URI) of the OpenId Connect well-known configuration endpoint reflects the keys configured in the Key Container, when the Key is referenced in the [JwtIssuer Technical Profile](./jwt-issuer-technical-profile.md). An application using an OIDC library will automatically fetch this metadata to ensure it uses the correct keys to validate tokens. For more information, learn how to use [Microsoft Authentication Library](../active-directory/develop/msal-b2c-overview.md), which always fetches the latest token signing keys automatically.
 
+## Key caching
+
+When a key is uploaded, the activation flag on the key is set to false by default. The new key will then be updated on all nodes. Only when the new key has been updated on all cache nodes will the activation flag set to true.  
+
+The activation flag property is modifiable within the Azure Portal UX allowing admins to disable a key and take it out of rotation. An active key can be an expired key. 
+
 ## Policy key management
 
 To get the current active key within a key container, use the Microsoft Graph API [getActiveKey](/graph/api/trustframeworkkeyset-getactivekey) endpoint.