48

I would like to log the following in my telemetry for diagnostic and usage purposes:

  • Azure Subscription ID
  • AAD Tenant ID
  • AAD App Client ID

Should I treat them as secrets/PII and hash/encrypt them?

(it goes without saying I will not be retaining the client secret in any way shape or form)

Ohad Schneider
  • 36,600
  • 15
  • 168
  • 198

1 Answers1

76

Ultimately, you should determine what to log and how, from a compliance/privacy/security perspective, based on official and compliance/privacy/security reviews and certifications within your company or by 3rd parties.

That disclaimer aside:

  • Tenant ID and App Client ID aren't generally considered PII nor secrets.
    • Not PII because, by themselves, they won't tell you who the user is.
    • Not secrets because they are very easy to obtain. Anyone attempting to log in to your application will be exposed to these as they are included in the authorization request.
  • Azure Subscription ID isn't generally considered PII though depending on your sensitivity, could be considered a secret
    • Not PII because, by itself, it doesn't tell you who the user is.
    • Could be a secret because it's not easily available publicly to everyone. Could be considered NOT a secret because nothing can be done with it without also having a token from an authorized user or application.

Do note that some companies and privacy reviews often consider these 3 data points as Organization Identifiable Information (OII) and sometimes have policies for handling those (less stringent that PII though).

Saca
  • 10,355
  • 1
  • 34
  • 47
  • Upvoted, thanks! (1) What if I have no organization and I'm just writing open source? (2) What if my organization is Microsoft (I see you work there too)? – Ohad Schneider Aug 13 '17 at 20:26
  • I was going to post a question on twitter/stack overflow/quora because i figured "why would anyone have answered this exact somewhat non-straight-forward question" and obviously googled first just in case - Voila. Much appreciated! – Ran Sagy Mar 11 '19 at 12:53
  • 1
    @OhadSchneider can you make this answer as the accepted answer please :) – Saca May 08 '22 at 12:04