Microsoft Power Platform governance and administration: Security and compliance - Prevent sending sensitive data to Purview audit logs
To help prevent leaking sensitive customer data from Dataverse audit logs, all customer data is removed before these audit events are sent to Purview activity logging. Examples of sensitive customer data include financial information, medical and health data, and personally ident
DIGITAL SKILL WORKS LTD / 12 PANES
What it is
Microsoft Power Platform governance and administration: Security and compliance - Prevent sending sensitive data to Purview audit logs is a Microsoft 365 roadmap item published via Microsoft Release Communications. Current status: Launched.
What it does
To help prevent leaking sensitive customer data from Dataverse audit logs, all customer data is removed before these audit events are sent to Purview activity logging. Examples of sensitive customer data include financial information, medical and health data, and personally identifiable information. In Dataverse audit logs, create and update events—including a column’s before-and-after values—are captured. These values remain in Dataverse audit logs, but aren’t sent to Purview activity logging. Business Value: This feature restricts customer business data in Dataverse audit logs from being sent to Purview auditing streams. This helps ensure compliance and reduces the risk of leaking sensitive customer data. Enabled for: Enabled by admins/makers/marketers for end users
Why you should care
Board
Security/compliance control — fund Steady before more seats.
CISO
Prioritise as Steady control; wire into IR and GRC evidence paths.
CFO
Map licence or consumption impact to the frozen value case; avoid seat spray.
Adoption
Pilot with a named cohort and measure changed work, not vanity clicks.
Suggested action
Wave 0 first: Security → GRC → Cost & Value → Licence → Adoption. Decide: adopt for a named cohort, defer, or reject. If adopting, update licence and adoption plans in the same week.
12 Panes: 03 Horizon · 04 Security · 05 GRC · 08 Adoption
Communication needed
- Security: Lead review; confirm control mapping before enablement.
- GRC: Update AI/agent register and evidence path; confirm DPIA triggers if personal data is in scope.
- FinOps: Forecast seat or credit impact; align to frozen value case.
- Adoption: Plan cohort messaging, clinics, and success measures.
- Comms: One story for board and staff — what changes, what does not, who owns risk.
Benefits
- May improve productivity on a specific Microsoft 365 surface when permissions and data quality allow.
- Roadmap visibility helps Horizon planning without guessing dates.
Risks
- Status and dates change; treat MRC as directional, not a contract.
- Enabling without Steady controls can amplify overshare or cost leakage.
Source
- MRC id: 576863
- Status: Launched
- Products: Microsoft Power Platform governance and administration
- GA / disclosure: June CY2026
- Preview: —
- Platforms: Web
- Cloud instances: Worldwide (Standard Multi-Tenant)
- moreInfoUrls: https://learn.microsoft.com/en-us/power-platform/important-changes-coming#removal-of-before-and-after-field-change-values-in-audit-events-sent-to-microsoft-purview
- Open on Microsoft 365 Roadmap
Microsoft Release Communications / Microsoft 365 Roadmap (AI at Work). Content is subject to Microsoft API Terms of Use. Dates and status change; verify in the official roadmap before acting.