An assistant reads a document.
Who can read its trace?

Microsoft announced the general availability of its Foundry Browser Automation tool on October 19, 2026. The linked RSS item establishes that publication date; its full article body also contains the sensitive-trace warning. The announcement says traces can contain prompts, model responses, system instructions and tool-call arguments or results, and directs builders to a protection workflow documented as preview. This article examines that narrower data-handling boundary, not the availability of every associated browser component. Microsoft's sensitive-trace guidance states that preview items have no service-level agreement and are not recommended for production workloads; some capabilities may be constrained or unsupported. The announcement does not remove those qualifications.

The practical distinction is between permission to read a source document and permission to read content captured during an assistant's work. Microsoft's guidance identifies input messages, output messages, system instructions, tool definitions, tool-call arguments, tool-call results and evaluation explanations as sensitive attributes. Ask which of these could contain document text in the proposed workflow and what tracing configuration actually captures. A finance or insurance buyer might ask whether customer-document excerpts appear in tool results; a manufacturer might ask the same about supplier specifications or drawing text. These are evaluation questions, not reported deployments or observations.

According to Microsoft, before September 30, 2026, Application Insights routed the seven attributes to both AppGenAIContent and the existing AppDependencies, AppTraces and AppEvents tables. From that date, newly ingested values stop flowing to those existing tables; their keys remain with short pointers to AppGenAIContent. Early adoption used the protectGenAISensitiveData feature flag. However, the optOutProtectGenAISensitiveData flag can temporarily maintain the previous routing while custom queries and related assets are updated. Microsoft says that opt-out ends on September 30, 2027; unregistering it returns to the dedicated-table behavior sooner. Ask for the actual subscription configuration and a recent trace, not an assumption based on the calendar. Then check the table's protection level separately: routing content to AppGenAIContent is not the same action as setting that table to Protected.

Microsoft's protected-table guidance describes a deny-by-default model after the table is set to Protected. The built-in Privileged Monitoring Data Reader role grants access to all protected tables at its assigned scope, so its scope matters. For viewing sensitive content through Foundry and Application Insights, the Foundry guidance specifies the linked Application Insights resource; direct workspace-centric queries require the corresponding workspace assignment. Do not interpret the built-in role as the only possible access route. The guidance explicitly preserves custom roles with qualifying Azure Monitor DataActions, while the protected-table instructions describe targeted custom assignments using table-name and protection-level ABAC conditions. Have the administrator identify effective assignments and relevant conditions, rather than checking role names alone. The same instructions also describe DataActionsOnly mode, which removes implicit log-read access through some control-plane roles. Establish whether it applies in the actual workspace; do not presume it is enabled.

Use an authorized, non-sensitive test input and record the expected visibility before testing. Microsoft's verification instructions distinguish a Log Analytics Reader without privileged or qualifying custom access from a reader with an appropriate grant. In the documented protected-table check, the former query succeeds but returns no rows; the latter returns data. A successful query alone therefore does not demonstrate authorized visibility. Also check that ordinary non-sensitive trace information remains available as intended. Separately examine records ingested before September 30, 2026: Microsoft says they remain in their existing tables and stay queryable as before. A new routing destination does not retrospectively relocate or delete those records. Assign an owner to identify relevant older records and ask whether any additional copies exist in exports, reports or other destinations used by the organization. Record what has actually been found. Obtain environment-specific retention and deletion evidence, including the treatment of historical copies, before accepting a requirement that depends on their removal. The cited pages do not establish that removal.