Responding to DSR requests for system-generated logs in Power Apps, Power Automate, and Common Data Service

Microsoft gives you the ability to access, export, and delete system-generated logs that may be deemed personal under the European Union (EU) General Data Protection Regulation (GDPR) broad definition of personal data. Examples of system-generated logs that may be deemed personal under GDPR include:

  • Product and service usage data, such as user activity logs
  • User search requests and query data
  • Data generated by product and services as a product of system functionality and interaction by users or other systems

Note that the ability to restrict or rectify data in system-generated logs is not supported. Data in system-generated logs constitutes factual actions conducted within the Microsoft cloud, and diagnostic data—including modifications to such data—would compromise the historical record of actions and increase fraud and security risks.

Prerequisites

This article focuses on responding to DSR requests for system-generated logs in managed and unmanaged tenants. To determine whether or not you belong to a managed or unmanaged tenant, please see the Determining Tenant Type section below.

Accessing and exporting system-generated logs for Managed Tenants

Administrators can access system-generated logs associated with a user’s use of Power Apps, Power Automate, and Common Data Service services and applications.

To access and export system-generated logs, do the following:

  1. Go to the Microsoft Service Trust Portal and sign in using Office 365 Global Administrator credentials.

  2. From the Privacy drop-down list at the top of the page, select Data Subject Request.

  3. On the Data Subject Request page, under System Generated Logs, select Data Log Export. The Data Log Export displays and shows a list of export data requests submitted by your organization.

  4. To create a new request for a user, click Create Export Data Request.

    After you create a new request, the request is listed on the Data Log Export page, where you can track its status. After a request is complete, you can click a link to access the system-generated logs, which will be exported to your organization’s Azure storage location within 30 days of creating the request. The data will be saved in common, machine-readable file formats such as XML, CSV, or JSON. If you don't have an Azure account and Azure storage location, you'll need to create an Azure account and/or Azure storage location for your organization so that the Data Log Export tool can export the system-generated logs. For more information, see Introduction to Azure Storage.

The following table summarizes accessing and exporting system-generated logs for managed tenants:

Question Answer
How long does the Microsoft Data Log Export tool take to complete a request? This depends on several factors. In most cases it should complete in one or two days, but it can take up to 30 days.
What format will the output be in? The output will be in the form of structured, machine-readable files such as XML, CSV, or JSON.
Who has access to the Data Log Export tool to submit access requests for system-generated logs? Office 365 Global Administrators will have access to the GDPR Log Manager tool.
What data does the Data Log Export tool return? The Data Log Export tool returns system-generated logs that Microsoft stores. Exported data spans across various Microsoft services including Office 365, Azure, Dynamics, Power Apps, Power Automate, and Common Data Service.
How is data returned to the user? Data will be exported to your organization's Azure storage location; it will be up to administrators in your organization to determine how they will show/return this data to users.
What will data in system-generated logs look like? Example of a system-generated log record in JSON format:
[{
"DateTime": "2017-04- 28T12:09:29-07:00",
"AppName": "SharePoint",
"Action": "OpenFile", "IP": "154.192.13.131",
"DevicePlatform": "Windows 1.0.1607"
}]

Note

For security and audit purposes, some features do not allow you to export or delete system-generated logs in order to maintain the integrity of personal information.

Deleting system-generated logs for Managed Tenants

To delete system-generated logs retrieved through an access request, you must remove the user from the service and permanently delete his or her Azure Active Directory account. For instructions on how to permanently delete a user, see the Deleting a user section in the Azure Data Subject Request GDPR documentation that can be found on the Office 365 Service Trust Portal. It's important to note that permanently deleting a user account is irreversible once initiated.

Permanently deleting a user account removes the user’s data from system-generated logs for Power Apps, Power Automate, and Common Data Service services within 30 days.

Accessing and exporting system-generated logs for Unmanaged Tenants

Users can access system-generated logs associated with their use of Power Apps, Power Automate, and Common Data Service services and applications.

To access and export system-generated logs, do the following:

  1. Go to the Work and School Privacy portal.
  2. On the My data requests page, a user can request a data export by clicking on the New export request button.
  3. Upon clicking this button, you will be asked for to confirm your request. Click Yes to continue.
  4. New export requests may take up to 1 month to complete. During this time, you will see a status of Running.
  5. Once complete, the Date Completed column will be populated and a link to your system-generated logs will be provided.
  6. Click on this link to download your data. You can use a text editor to view this data.
  7. Also note, the Expiry date for this content is being populated within the Expiry Date column. You have up until this time to retrieve your system-generated logs.

The following table summarizes accessing and exporting system-generated logs for unmanaged tenants:

Question Answer
How long does the Microsoft Data Log Export tool take to complete a request? This depends on several factors. In most cases it should complete in one or two days, but it can take up to 30 days.
What format will the output be in? The output will be in the form of structured, machine-readable files such as XML, CSV, or JSON.
Who has access to the Data Log Export tool to submit access requests for system-generated logs? Users who are a member of an unmanaged tenant have access to submit requests.
What data does the Data Export tool return? The Data Export tool returns system-generated logs that Microsoft stores. Exported data spans across various Microsoft services including Office 365, Azure, Dynamics, Power Apps, Power Automate, and Common Data Service.
How is data returned to the user? Data will be exported to a Microsoft website where a link will be securely provided to the user who made the DSR request.
What will data in system-generated logs look like? Example of a system-generated log record in JSON format:
[{
"DateTime": "2017-04- 28T12:09:29-07:00",
"AppName": "SharePoint",
"Action": "OpenFile", "IP": "154.192.13.131",
"DevicePlatform": "Windows 1.0.1607"
}]

Note

For security and audit purposes, some features do not allow you to export or delete system-generated logs in order to maintain the integrity of personal information.

Deleting system-generated logs for Unmanaged Tenants

To delete system-generated logs retrieved through an access request, you must close your account, which will delete your system-generated logs and remove your data in Power Apps, Power Automate, and Common Data Service services within 30 days.

To delete system-generated logs, do the following:

  1. Go to the Work and School Privacy portal.
  2. On the My data requests page, a user can request the deletion of their data by clicking on the Close account button.
  3. Upon clicking this button, you will be asked for to confirm your request. Click Yes to continue.
  4. Once the account has been closed, you will not have access to Power Apps, Power Automate, and Common Data Service.

Determining Tenant Type

To determine whether or not you are a user of a managed or unmanaged tenant, perform the following actions:

  1. Open the following URL in a browser, making sure to replace your email address in the URL:https://login.microsoftonline.com/common/userrealm/name@contoso.com?api-version=2.1.

  2. If you are a member of an unmanaged tenant then you will see an "IsViral": true in the response.

    {
    ...
    "Login": "name@unmanagedcontoso.com",
    "DomainName": "unmanagedcontoso.com",
    "IsViral": **true**,
    ...
    }
  1. Otherwise, you belong to a managed tenant.