Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Applies to: ✔️ Front Door Standard ✔️ Front Door Premium
The Azure Front Door log scrubbing tool helps you remove sensitive data, such as personally identifiable information, from your Azure Front Door logs. You enable log scrubbing at the Azure Front Door Standard or Premium profile level and select the log fields to scrub. Once enabled, the tool replaces that information in logs generated under the profile with ****.
Log scrubbing is only supported on Azure Front Door Standard and Premium. If you're using Azure Front Door (classic), migrate to Azure Front Door Standard or Premium to use log scrubbing. For more information, see Azure Front Door (classic) to Standard or Premium tier migration.
Default log behavior
When Azure Front Door serves a request, it logs the request details in clear text. Sensitive data might be included in the request URI, such as passwords, and the client IP and socket IP are logged. This data is viewable by anyone with access to the Azure Front Door access logs. To protect customer data, you can set up log scrubbing rules that target sensitive data.
Scrubbing fields
You can scrub the following fields from the logs:
| Information | Description | Sample after enablement |
|---|---|---|
| Request URI | RequestUri, OriginUrl | **** |
| Request IP address | ClientIp, SocketIp | **** |
| Query string | Querystring in RequestUri and OriginUrl | https://contoso.com/bar/temp.txt?20240423&q=****&foo=**** |
Note
When you enable log scrubbing, Microsoft still retains IP addresses in its internal logs to support critical security features.
Enable log scrubbing to protect sensitive data
Go to the Azure Front Door Standard or Premium profile.
Under Settings, select Configuration.
Under Scrub sensitive data from access logs, select Manage log scrubbing.
In Manage log scrubbing, select Enable access log scrubbing to enable scrubbing.
Select the log fields that you want to scrub, and then select Save.
On the Configuration page, confirm that log scrubbing is Enabled.
To verify your sensitive data protection rules, open the Azure Front Door log and search for **** in place of the sensitive fields.