Responding to DSR requests for system-generated logs in Power Apps, Power Automate, and Microsoft Dataverse

Microsoft gives you the ability to access, export, and delete system-generated logs that may be deemed personal under the privacy standard definition of personal data. Examples of system-generated logs that may be deemed personal under privacy standards include:

• Product and service usage data, such as user activity logs
• User search requests and query data
• Data generated by product and services as a product of system functionality and interaction by users or other systems

Note that the ability to restrict or rectify data in system-generated logs isn't supported. Data in system-generated logs constitutes factual actions conducted within the Microsoft cloud, and diagnostic data—including modifications to such data—would compromise the historical record of actions and increase fraud and security risks.

Prerequisites

This article focuses on responding to DSR requests for system-generated logs in managed and unmanaged tenants. To determine whether or not you belong to a managed or unmanaged tenant, see the following Determining Tenant Type section.

Accessing and exporting system-generated logs for Managed Tenants

Administrators can access system-generated logs associated with a user's use of Power Apps, Power Automate, and Dataverse services and applications.

To access and export system-generated logs, do the following:

1. Go to the Microsoft Service Trust Portal and sign in using Global admin credentials.

2. From the Privacy drop-down list at the top of the page, select Data Subject Request.

3. On the Data Subject Request page, under System Generated Logs, select Data Log Export. The Data Log Export displays and shows a list of export data requests submitted by your organization.

4. To create a new request for a user, select Create Export Data Request.

   After you create a new request, the request is listed on the Data Log Export page, where you can track its status. After a request is complete, you can select a link to access the system-generated logs, which will be exported to your organization's Azure storage location within 30 days of creating the request. The data is saved in common, machine-readable file formats such as XML, CSV, or JSON. If you don't have an Azure account and Azure storage location, you'll need to create an Azure account and/or Azure storage location for your organization so that the Data Log Export tool can export the system-generated logs. For more information, see Introduction to Azure Storage.

The following table summarizes accessing and exporting system-generated logs for managed tenants:

Deleting system-generated logs for Managed Tenants

To delete system-generated logs retrieved through an access request, you must remove the user from the service and permanently delete their Microsoft Entra account. For instructions on how to permanently delete a user, see the Deleting a user section in the Azure Data Subject Request privacy documentation that can be found on the Microsoft 365 Service Trust Portal. It's important to note that permanently deleting a user account is irreversible once initiated.

Permanently deleting a user account removes the user's data from system-generated logs for Power Apps, Power Automate, and Dataverse services within 30 days.

Accessing and exporting system-generated logs for Unmanaged Tenants

Users can access system-generated logs associated with their use of Power Apps, Power Automate, and Dataverse services and applications.

To access and export system-generated logs, do the following:

1. Go to the Work and School Privacy portal.
2. On the My data requests page, a user can request a data export by clicking on the New export request button.
3. Upon clicking this button, you'll be asked for to confirm your request. Select Yes to continue.
4. New export requests may take up to one month to complete. During this time, you'll see a status of Running.
5. Once complete, the Date Completed column is populated and a link to your system-generated logs will be provided.
6. Select on this link to download your data. You can use a text editor to view this data.
7. Also note, the Expiry date for this content is being populated within the Expiry Date column. You have up until this time to retrieve your system-generated logs.

The following table summarizes accessing and exporting system-generated logs for unmanaged tenants:

Deleting system-generated logs for Unmanaged Tenants

To delete system-generated logs retrieved through an access request, you must close your account, which will delete your system-generated logs and remove your data in Power Apps, Power Automate, and Dataverse services within 30 days.

To delete system-generated logs, do the following:

1. Go to the Work and School Privacy portal.
2. On the My data requests page, a user can request the deletion of their data by clicking on the Close account button.
3. Upon clicking this button, you'll be asked for to confirm your request. Select Yes to continue.
4. Once the account has been closed, you won't have access to Power Apps, Power Automate, and Dataverse.

Determining Tenant Type

To determine whether or not you're a user of a managed or unmanaged tenant, perform the following actions:

1. Open the following URL in a browser, making sure to replace your email address in the URL:https://login.microsoftonline.com/common/userrealm/[email protected]?api-version=2.1.

2. If you are a member of an unmanaged tenant,** then you'll see an "IsViral": true in the response.

      {
      ...
      "Login": "[email protected]",
      "DomainName": "unmanagedcontoso.com",
      "IsViral": **true**,
      ...
      }
   

3. Otherwise, you belong to a managed tenant.