|
| 1 | +--- |
| 2 | +title: "Understanding Microsoft 365 case creation and diagnostic data access" |
| 3 | +ms.author: camillepack |
| 4 | +author: camillepack |
| 5 | +manager: scotv |
| 6 | +ms.date: 04/07/2025 |
| 7 | +audience: Admin |
| 8 | +ms.topic: concept-article |
| 9 | +ms.service: microsoft-365-business |
| 10 | +ms.localizationpriority: medium |
| 11 | +ms.collection: |
| 12 | +- Tier1 |
| 13 | +- scotvorg |
| 14 | +- Adm_O365 |
| 15 | +- Adm_TOC |
| 16 | +description: "Learn about the diagnostic data Microsoft 365 Support engineers access to resolve support cases, including consent, data categories, retention periods, and logging details." |
| 17 | +--- |
| 18 | + |
| 19 | +# Understanding Microsoft 365 case creation and diagnostic data access |
| 20 | + |
| 21 | +The purpose of this article is to inform Microsoft 365 customers about the type of information that Microsoft Support engineers may collect and use in order to resolve a support case. |
| 22 | + |
| 23 | +## Consent for diagnostic information |
| 24 | + |
| 25 | +When you [create a support request](get-help-support.md), you consent to allow a Microsoft Support engineer to remotely run diagnostics on the Microsoft 365 subscription(s) associated with your request. This access allows them to collect diagnostic information that enables them to troubleshoot and solve your problem. |
| 26 | + |
| 27 | +## How long does Microsoft have this access? |
| 28 | + |
| 29 | +Access is removed automatically when your support request is closed. If your request is still open, access is removed 30 days from the date of request creation, and you will be prompted to provide access again. If you have multiple requests open, the access expires 30 days from the date of creation of the latest request. |
| 30 | + |
| 31 | +Depending on the nature of your support request, the data that Microsoft can access would belong under one or more of the following categories: |
| 32 | + |
| 33 | +- **Support Data** – All data provided to Microsoft by the customer as part of a customer engagement to obtain support services. |
| 34 | + - Examples |
| 35 | + - Support requests from customers and phone conversations, online chat sessions, or remote assistance sessions between support professionals and customers |
| 36 | + - Case notes and/or records related to support requests from customers |
| 37 | + - Data provided to Microsoft by the customer as part of support activities |
| 38 | + |
| 39 | +- **Account Data** – Contact and billing/purchase/payment/license information. |
| 40 | + - Examples |
| 41 | + - Customer’s provisioning information |
| 42 | + - Account configuration and billing data |
| 43 | + - Tenant administrator contact information (for example, tenant administrator’s name, address, e-mail address, phone number) |
| 44 | + - This also includes Licensing and Purchase Information. |
| 45 | + |
| 46 | +- **System Metadata** – Data generated in the course of running the service. |
| 47 | + - Examples |
| 48 | + - Event Logs |
| 49 | + - Access Control Logs |
| 50 | + - Account information belonging to Microsoft operations personnel |
| 51 | + - Microsoft server names/server IPs |
| 52 | + - Server patching and vulnerability data |
| 53 | + - Service configuration data |
| 54 | + - Telemetry (on-prem or cloud) |
| 55 | + |
| 56 | +- **Organization Identifiable Information (OII)** – Data that can be used to identify a particular tenant/deployment/organization (generally config or usage data) |
| 57 | + - Examples |
| 58 | + - Tenant ID (non-GUID) |
| 59 | + - TenantID (GUID) – due to the existence of many out of boundary TenantID to name mapping tables |
| 60 | + - Tenant usage data |
| 61 | + - Tenant IP Addresses (IPv4) such as tenant’s firewall IP address |
| 62 | + - Global Prefix and Subnet ID (first 64 bits of IPv6 address) |
| 63 | + - Tenant Domain name in e-mail address (joe@**contoso.com**) |
| 64 | + - Mapping of organizational GUID to organization |
| 65 | + |
| 66 | +- **End User Identifiable Information (EUII)** – Data that directly identifies or could be used to identify the authenticated user of a Microsoft service. |
| 67 | + - Examples |
| 68 | + - User-specific IP address (IPv4) |
| 69 | + - User Principal Name (joe@company.com) |
| 70 | + - Address Book Data |
| 71 | + - User’s machine Name |
| 72 | + - SIP URI |
| 73 | + |
| 74 | +- **End User Pseudonymous Identifiers (EUPI)** – An identifier created by Microsoft tied to the user of a Microsoft service. |
| 75 | + - Examples |
| 76 | + - User GUIDs or PUIDs |
| 77 | + - Session IDs |
| 78 | + |
| 79 | +## How long is diagnostic data retained in Microsoft systems? |
| 80 | + |
| 81 | +Microsoft retains diagnostic data for up to 28 days after it is collected. After this period, the data is deleted. |
| 82 | + |
| 83 | +## Where is support activity on a customer tenant logged? |
| 84 | + |
| 85 | +Activity performed on a customer tenant is available under Microsoft Entra Audit logs. |
0 commit comments