Why should I restore the keys in Azure Device Provisioning?

Question

I'm using the service Device Provisioning for my Azure IoT solution.

I've created a group of registration with Symmetric key attestation.

From the guide: By default, the Device Provisioning Service creates new symmetric keys with a default length of 32 bytes. [...] The symmetric keys for group enrollments are not used directly by devices when provisioning. Instead devices that belong to an enrollment group provision using a derived device key.

In Azure Portal, at the top of the screen of this service I saw that there is a botton: Restore Keys

I have some questions about:

1. Why should I restore/regenerate these keys?
2. If I sold 1000 devices with devide keys generated by the primary key, if I changed the primary key it would be impossible to register new devices. Do I have to provide a management system for these keys within the devices?

Thanks for the clarifications!

Answer 1

This looks like it might be a slight translation issue - in English it's "regenerate keys" and the button is used to generate a new key for key rotation purposes.