Pii Leakage on Azure

Fixing PII leakage in Azure relies on applying the platform’s native security controls and adjusting application code to return only the data that is strictly necessary.

Storage hardening

• Set the Blob Storage account’s publicNetworkAccess to Disabled or ensure containers are Private. Use Azure Policy storageAccountsAllowBlobPublicAccess to enforce this.
• When a SAS token is required, generate it with the most limited permissions (sp=r on a specific blob, not the container) and a short expiry (se parameter).
• Enable Azure Defender for Storage to receive alerts when a container becomes publicly accessible.

Function/App Service data filtering

• Never return raw entity models. Instead, map to a DTO that excludes sensitive fields.
• In .NET 6 Azure Functions:

using System.Collections.Generic;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging;

public static class GetUserProfile
{
    public record UserDto(string Id, string Name, string Email); // SSN omitted

    [FunctionName("GetUserProfile")]
    public static async Task Run(
        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "profile/{id}")] HttpRequest req,
        string id,
        ILogger log)
    {
        // Assume we fetch an entity from Table Storage
        var entity = await TableService.GetEntityAsync<UserEntity>("Users", id);
        if (entity == null) return new NotFoundResult();

        var dto = new UserDto(entity.PartitionKey, entity.Name, entity.Email);
        return new OkObjectResult(dto);
    }
}

// Internal entity – never exposed
public class UserEntity
{
    public string PartitionKey { get; set; }
    public string RowKey { get; set; }
    public string Name { get; set; }
    public string Email { get; set; }
    public string SSN { get; set; } // sensitive, not in DTO
}

The function now returns only Id, Name, and Email.

• In Node.js with the Azure SDK for Cosmos DB, request only the needed fields via a SELECT projection:

const { CosmosClient } = require("@azure/cosmos");
const client = new CosmosClient(process.env.COSMOS_CONNECTION_STRING);
const container = client.database("UsersDb").container("Profiles");

async function getUser(id) {
    const query = "SELECT c.id, c.name, c.email FROM c WHERE c.id = @id";
    const { resources } = await container.items
        .query(query, [{ name: "@id", value: id }])
        .fetchAll();
    return resources[0]; // contains only id, name, email
}

Logging and diagnostics

• Configure Azure App Service diagnostic settings to send logs to a Log Analytics workspace with RetentionInDays set and Categories limited to AppServiceConsoleLogs and AppServiceHTTPLogs. Disable FailedRequestsTracing if it captures request bodies.
• In Application Insights, set SamplingPercentage to a low value and use TelemetryProcessor to drop telemetry that contains patterns matching PII (e.g., regex for SSN).
• Review ARM/Bicep templates: replace any reference(resourceId('Microsoft.KeyVault/vaults/secrets/', vaultName, secretName), '2019-09-01').value with a secure parameter that is marked secureString and never output in deployment logs.

API Management policies

• Use a <set-body> policy to project a safe response:

<outbound>
    <base />
    <set-body>{
        "id": $(context.Response.Body.As<JObject>()["id"]),
        "name": $(context.Response.Body.As<JObject>()["name"]),
        "email": $(context.Response.Body.As<JObject>()["email"])
    }</set-body>
</outbound>

By combining these controls—private storage, data‑transfer‑object patterns, restrained logging, and API Management filtering—you eliminate the most common pathways through which PII leaks from Azure‑hosted APIs.