To reduce SafeMode protections (such as shortening the retention period or disabling the eradication timer), two authorized SafeMode approvers must authenticate and approve the request via Pure1 step-up authentication.

SafeMode is a ransomware protection feature designed to prevent the accidental or malicious deletion of snapshots. Because reducing these protections weakens the array's security posture, Pure Storage enforces a strict 'Ratchet' authorization process.

The Process: Unlike standard support requests, a single admin or local user cannot authorize this change (making Option C incorrect). The customer must have previously designated specific individuals as 'SafeMode Approvers' in their Pure1 portal.

Authorization: When a request to weaken the policy is made, Pure Support triggers a verification workflow. Two of these designated approvers must log into Pure1 and perform a secondary authentication (often involving a PIN or TOTP) to explicitly 'sign off' on the reduction. This 'two-person rule' ensures that a compromised credential or a rogue insider cannot unilaterally expose the organization's backup data to destruction.