Edit

Desktop Analytics data privacy

  • Article

Desktop Analytics is fully committed to customer data privacy, centering on these tenets:

  • Transparency: We fully document the Windows diagnostic events. Review them with your company's security and compliance teams. The Windows Diagnostic Data Viewer lets you see diagnostic data sent from a given device. For more information, see Diagnostic Data Viewer overview.

  • Control: You control the level of diagnostic data to share with Microsoft.

  • Security: Microsoft protects your data with strong security and encryption.

  • Trust: Desktop Analytics supports the Microsoft Privacy Statement and Online Service Terms.

For more information, see Windows 10 & privacy compliance: A guide for IT and compliance professionals.

Data flow

The following illustration shows how diagnostic data flows from individual devices through the Diagnostic Data Service, transient storage, and to your Log Analytics workspace:

Diagram illustrating flow of diagnostic data from devices.

  1. You sign in to the Microsoft Intune admin center, and onboard to Desktop Analytics. You create the Microsoft Entra app to connect with Configuration Manager. When you set up Desktop Analytics, you create an Azure Log Analytics workspace in the location of your choice.

  2. You connect Configuration Manager and enroll devices.

    1. You configure the Desktop Analytics cloud service in Configuration Manager with the Microsoft Entra app details.

    2. Within 15 minutes, and every hour after, Configuration Manager synchronizes via the Intune microservice the following data with Desktop Analytics using your tenant ID. The site sends all data over an encrypted HTTPS channel to your Endpoint Manager account in the public cloud.

    • Information about device collections necessary to create deployment plans. This information includes collection ID, support ID, collection name, and device count.
    • Information required to enroll devices. This information includes collection ID, SMS unique identifier, OS build version, device name, and serial number.
    • Information from the monitor connection health dashboard. This information includes the count of devices per health state, and device properties.
    • Information about deployment plans, which includes the collection ID, deployment ID, pilot or production deployment type, and count of devices per upgrade decision.

    1. Configuration Manager sets the commercial ID, diagnostic data level, and other settings for the devices in the target collection. This configuration specifies the devices to appear in your Desktop Analytics workspace.

    2. You deploy compatibility updates to all target devices.

  3. Devices send diagnostic data to the Microsoft Diagnostic Data Management service for Windows. All diagnostic data is encrypted over HTTPS and uses certificate pinning during transfer from the device to this service. The Microsoft Data Management Service is hosted in the United States. For more information, see How Microsoft handles diagnostic data.

    Application faults, kernel faults, unresponsive applications, and other application-specific issues use the Windows Error Reporting API to send application-specific problem reports to Microsoft. For more information about this dataflow, see Using WER.

  4. Each day, Microsoft produces a snapshot of IT-focused insights. This snapshot combines the diagnostic data from Windows with your input for the enrolled devices. This process happens in transient storage, which is only used by Desktop Analytics. The transient storage is hosted in Microsoft data centers in the United States with a 28-day retention period. All data is sent over an HTTPS-encrypted channel. The snapshots are segregated by commercial ID.

  5. The snapshots are then copied to your Azure Log Analytics workspace. This data transfer happens over HTTPS through the webhook ingestion protocol, which is a feature of Log Analytics. Desktop Analytics doesn't have any read or write permissions to your Log Analytics storage. Desktop Analytics calls the webhook API with a shared access signature (SAS) URI. Then Log Analytics gets the data from the storage tables over HTTPS.

  6. Desktop Analytics stores your input in Log Analytics storage. These configurations include deployment plans and asset decisions for upgrade and importance.

Other resources

For privacy-related frequently asked questions for Desktop Analytics, see Privacy FAQ.

For more information about related privacy aspects, see the following articles:

Separate from Desktop Analytics, Configuration Manager sends diagnostic and usage data to Microsoft. Microsoft uses this data to improve the installation experience, quality, and security of future releases of Configuration Manager. For more information, see Diagnostics and usage data for Configuration Manager.