Conversion Checklist

Inform your Fusion Applications Service Administrators about this upcoming change and share this information with them.

If your organization works with implementation partners to manage your Fusion Applications, share this information with them. Ensure to inform them that many environment lifecycle activities previously handled by Oracle Support (including environment refresh) will be self-service, and no longer processed by Oracle Support.

If your organization has Oracle Break Glass for Fusion Cloud Service, inform your approvers that after the conversion they will need to log in to the Oracle Cloud Console to approve break glass requests. If the original approvers are no longer with the organization, file a Support Request to have them removed. If you are not sure who your break glass approvers are, file a Support Request to get the list.

1. Sign in to your Cloud account.

2. Open the navigation menu, under Account Management, point to Users, and then select identity (Primary).

   

3. The User Management page displays a message indicating that your user management has been moved to the new identity and access management experience.

   
4. Select the link to open the Users page in the new Console. Prior to the conversion, your Identity Management interface is converted to the new Oracle Cloud console. Verify that your page resembles the screen image below. (Your Domain may be OracleIdentityCloudService.) You can browse through the new Console, though at this time it will not include any of your Fusion Applications services, which will be converted to this new Console after the scheduled quarterly downtime.
   

Check Existing Policies

If you have policies already set up, ensure that they follow the correct syntax.

'<identity_domain_name>'/'<group_name>'

For example:

Allow group 'OracleIdentityCloudService'/'FA-Admins' to manage fusion-family in tenancy

If any of your policy statements do not have the single quotes placed as shown above, make the correction and save the policy.

To navigate to the policies page to check your policy statements: Open the navigation menu  and select Identity & Security. Under Identity, select Policies.

Take training. The free, one-and-a-half-hour Oracle University course Fusion Applications: Environment Administration will familiarize you with the new Cloud Console interface and the Fusion Applications environment provisioning experience.

• How to activate your Oracle Cloud Applications subscription.
• How to navigate the Cloud Console and the Applications interface, including how to manage your account, set Console preferences, and troubleshoot common issues.
• Key concepts of Fusion Applications environment lifecycle management, including how to provision, run, and manage your environments.

Familiarize yourself with the documentation for managing your Fusion Applications environments in the new Oracle Cloud Console:

• Update allow-lists
• Update ports
• Update private access settings from on-premises for VPN and FastConnect

See Update Network Configurations for details.

Import root certificate.

If you have embedded the Fusion SSL certificate in external systems that integrate with Fusion, you might need to import the new root certificate. You can download the new certificate from the Digicert site. Search for the DigiCert Global Root G2 certificate in the list. Download and import the certificate.

• Do not add or update your SaaS subscriptions

  During the conversion process, subscription updates are not allowed (including orders for additional ATEs). This restriction will start 4 days prior to your first environment conversion until the completion of the quarterly update of the last environment. After the last environment is converted, you can use the self-service process to apply subscription updates.

• IPs added to your ACLs prior to conversion downtime will need to be added again post-conversion

  If you add new IPs to the access control list (ACL) for a Fusion Applications environment within 1 week of the scheduled downtime for the conversion, you will need to add those IPs again to the ACL in the converted environment. After conversion, you can add the IPs via self-service in the new Oracle Cloud Console. See To edit network access control rules for information on how to manage access control rules post-conversion.

• Breakglass settings changed prior to conversion downtime will need to be updated again post-conversion

  If you make any of the following updates to your Breakglass settings within 1 week of the scheduled downtime for the conversion, you will need make the same updates in the converted environment:

Verify Access to the new Console.

Note: If you are U.S. Government customer, see Reset Password and Sign in to the new Cloud Console for specific sign in steps.

After you receive the email notifying you that the scheduled downtime is complete, verify that you are able to access the new Oracle Cloud Console and that your environments have been converted.

1. Sign in to Oracle Cloud. For all commercial regions, sign in at https://cloud.oracle.com. For other regions, such as Oracle US Government Cloud or Oracle EU Sovereign Cloud, see Sign in to the new Cloud Console for the sign-in URL.
2. Enter the Cloud Account Name (also called your tenancy name) and select Next.
3. In the Sign in with an identity domain box, select your primary identity domain. This value can be either OracleIdentityCloudService or Default. Select Next.
4. Enter your User Name and Password and select Sign In.

5. After you sign in, you'll see the new Cloud Console with your Fusion Applications environments listed.

   

6. Select Go to service to open the Fusion Applications Overview page. Select Environments to see your environments.

   

   After the non-production cadence update, your environments associated with the non-production cadence will be available in the new Console.

   After the production cadence update, your environments associated with the production cadence will be available in the new Console.

7. To navigate back to the Cloud Classic Console (My Services), open the navigation menu in the upper left, select My Applications, and then select Cloud Classic Console.

   
   
   

Sign in to your Fusion Applications using the URL and steps you normally use.

(Optional) Create logins for implementation partners.

If your organization works with implementation partners to manage your Fusion Applications, you can create user accounts for them in the new Oracle Cloud Console and grant them access to perform the self-service tasks that were previously performed by Oracle Support. For example, environment refreshes can now be perform via self-service in the Console.

To create a user with the ability to perform refreshes, and no other access, see Managing Oracle Cloud Users with Specific Job Functions for general information about creating users and Environment Read-Only + Refresh User for the details to create this specific type of role.

Ensure Breakglass approvers have access to the Oracle Cloud Console.

Break glass approvers must be able to log in to the Oracle Cloud Console to approve or reject access requests in Oracle Managed Access. Individuals on the approver's list will have a user automatically created for them in the Default domain in the Oracle Cloud Console, if the user does not already exist, with the appropriate permissions to approve or deny break glass requests. These users will be notified by email with instructions to sign in to activate their account and set up their password. If SSO is setup for the Default domain, they can use SSO to sign in. Ensure that you notify these users to respond to their account activation email so that their access is not interrupted. For more information about managing access requests in the new Console, see Managed Access.

Key management: Bring Your Own Key.

Note: If you recently purchased Oracle Break Glass and the encryption was scheduled to be applied in this upgrade cycle, it will not be applied. After conversion is complete, you can follow the instructions in Customer-Managed Keys for Oracle Break Glass to create the vaults and keys required for your environments. The encryption will be applied in the next quarterly update. If you need encryption applied before the next scheduled quarterly update, create the vaults and keys as described in the instructions, and then file a support request.

If you have subscribed to Oracle Break Glass for your Fusion Applications and have brought your own key (BYOK), you need to perform these additional steps to import your external key again.

When your environments are converted, Oracle creates a new key for you in your tenancy. You can manage your own vaults and keys through the OCI Vault service.

To add your own key to a Fusion Applications environment post-conversion:

1. Follow the steps in the preceding section to sign in to the Oracle Cloud Console and locate your environments.
2. Select the name of the environment where you configured bring your own key.
3. Under Resources, select Security. The key that has been set up for you is displayed.
4. Select the key link to go to the details page for the key in the Vault service.
5. On the key details page, under Resources, select Versions, then select Rotate Key. Select Import External key version and follow the instructions in Importing Keys and Key Versions to upload your wrapped external key.

For more information on managing keys in OCI for Fusion Applications, see the following documentation:

• Changing and Rotating Keys for Fusion Applications environments.
• Importing Keys and Key Versions.
• To use the API to manage keys, see CreateKeyVersion.
• To use the CLI to manage keys, see Generate new key version.