Sanitize logs#2334
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR reduces the risk of leaking sensitive data in logs by removing structured logging of entire options objects and replacing it with explicit identifiers in LogError statements across many Azure and Fabric tool commands.
Changes:
- Removed
{@Options}structured logging from many command exception handlers. - Replaced prior option-object logs with specific identifiers (e.g., subscription/resource group/workspace/item IDs).
- Added an Azure.Mcp.Server changelog entry describing the logging change.
Reviewed changes
Copilot reviewed 92 out of 92 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/Workspace/OneLakeWorkspaceListCommand.cs | Remove options-object logging from error path |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/Table/TableNamespaceListCommand.cs | Log only workspace/item identifiers on error |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/Table/TableNamespaceGetCommand.cs | Log only workspace/item/namespace identifiers on error |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/Table/TableListCommand.cs | Log only workspace/item/namespace identifiers on error |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/Table/TableGetCommand.cs | Log only workspace/item/table identifiers on error |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/Table/TableConfigGetCommand.cs | Log only workspace/item identifiers on error |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/Item/OneLakeItemListDfsCommand.cs | Remove options-object logging from error path |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/Item/OneLakeItemListCommand.cs | Remove options-object logging from error path |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/Item/OneLakeItemDataListCommand.cs | Remove options-object logging from error path |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/File/FileWriteCommand.cs | Remove options-object logging; keep file/workspace/item identifiers |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/File/FileReadCommand.cs | Remove options-object logging; keep file/workspace/item identifiers |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/File/FileDeleteCommand.cs | Remove options-object logging; keep file/workspace/item identifiers |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/File/DirectoryDeleteCommand.cs | Remove options-object logging; keep directory/workspace/item identifiers |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/File/DirectoryCreateCommand.cs | Remove options-object logging; keep directory/item identifiers |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/File/BlobPutCommand.cs | Remove options-object logging; keep path/workspace/item identifiers |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/File/BlobListCommand.cs | Remove options-object logging; keep workspace/item/path identifiers |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/File/BlobGetCommand.cs | Remove options-object logging; keep path/workspace/item identifiers |
| tools/Fabric.Mcp.Tools.OneLake/src/Commands/File/BlobDeleteCommand.cs | Remove options-object logging; keep path/workspace/item identifiers |
| tools/Fabric.Mcp.Tools.Core/src/Commands/ItemCreateCommand.cs | Remove options-object logging; keep item/workspace identifiers |
| tools/Azure.Mcp.Tools.VirtualDesktop/src/Commands/Hostpool/HostpoolListCommand.cs | Remove options-object logging; keep subscription identifier |
| tools/Azure.Mcp.Tools.Storage/src/Commands/Account/AccountGetCommand.cs | Remove options-object logging; keep account/subscription identifiers |
| tools/Azure.Mcp.Tools.Storage/src/Commands/Account/AccountCreateCommand.cs | Remove options-object logging; keep account/RG/location identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/Server/ServerGetCommand.cs | Remove options-object logging; keep server/RG identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/Server/ServerDeleteCommand.cs | Remove options-object logging; keep server/RG identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/FirewallRule/FirewallRuleListCommand.cs | Remove options-object logging; keep server/RG identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/FirewallRule/FirewallRuleDeleteCommand.cs | Remove options-object logging; keep server/RG/rule identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/FirewallRule/FirewallRuleCreateCommand.cs | Remove options-object logging; keep server/RG/rule identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/EntraAdmin/EntraAdminListCommand.cs | Remove options-object logging; keep server/RG identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/ElasticPool/ElasticPoolListCommand.cs | Remove options-object logging; keep server/RG identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/Database/DatabaseUpdateCommand.cs | Remove options-object logging; keep server/db/RG identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/Database/DatabaseRenameCommand.cs | Remove options-object logging; keep server/db/new-name/RG identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/Database/DatabaseGetCommand.cs | Remove options-object logging; keep server/db/RG identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/Database/DatabaseDeleteCommand.cs | Remove options-object logging; keep server/db/RG identifiers |
| tools/Azure.Mcp.Tools.Sql/src/Commands/Database/DatabaseCreateCommand.cs | Remove options-object logging; keep server/db/RG identifiers |
| tools/Azure.Mcp.Tools.ServiceFabric/src/Commands/ManagedCluster/ManagedClusterNodeTypeRestartCommand.cs | Remove options-object logging; keep subscription/RG/cluster/node type identifiers |
| tools/Azure.Mcp.Tools.ServiceFabric/src/Commands/ManagedCluster/ManagedClusterNodeGetCommand.cs | Remove options-object logging; keep subscription/RG/cluster/node identifiers |
| tools/Azure.Mcp.Tools.Pricing/src/Commands/PricingGetCommand.cs | Remove options-object logging; keep service/region identifiers |
| tools/Azure.Mcp.Tools.Postgres/src/Commands/PostgresListCommand.cs | Remove options-object logging from generic operation error |
| tools/Azure.Mcp.Tools.Policy/src/Commands/Assignment/PolicyAssignmentListCommand.cs | Remove options-object logging; keep subscription/scope identifiers |
| tools/Azure.Mcp.Tools.MySql/src/Commands/MySqlListCommand.cs | Remove options-object logging from generic operation error |
| tools/Azure.Mcp.Tools.Monitor/src/Commands/Metrics/MetricsQueryCommand.cs | Remove options-object logging; keep resource + metric-name identifiers |
| tools/Azure.Mcp.Tools.Monitor/src/Commands/Metrics/MetricsDefinitionsCommand.cs | Remove options-object logging; keep resource + namespace identifiers |
| tools/Azure.Mcp.Tools.Monitor/src/Commands/ActivityLog/ActivityLogListCommand.cs | Remove options-object logging; keep resource identifiers + hours |
| tools/Azure.Mcp.Tools.Marketplace/src/Commands/Product/ProductListCommand.cs | Remove options-object logging; keep subscription/search identifiers |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/SubnetSize/SubnetSizeAskCommand.cs | Remove options-object logging; keep subscription/sku identifiers |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/ImportJob/ImportJobGetCommand.cs | Remove options-object logging; keep filesystem identifier |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/ImportJob/ImportJobDeleteCommand.cs | Remove options-object logging; keep job/filesystem identifiers |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/ImportJob/ImportJobCreateCommand.cs | Remove options-object logging; keep filesystem identifier |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/ImportJob/ImportJobCancelCommand.cs | Remove options-object logging; keep job/filesystem identifiers |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/FileSystemListCommand.cs | Remove options-object logging; keep resource group identifier |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/AutoimportJob/AutoimportJobGetCommand.cs | Remove options-object logging; keep job/filesystem identifiers |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/AutoimportJob/AutoimportJobDeleteCommand.cs | Remove options-object logging; keep job/filesystem identifiers |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/AutoimportJob/AutoimportJobCreateCommand.cs | Remove options-object logging; keep filesystem identifier |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/AutoimportJob/AutoimportJobCancelCommand.cs | Remove options-object logging; keep job/filesystem identifiers |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/AutoexportJob/AutoexportJobGetCommand.cs | Remove options-object logging; keep job/filesystem identifiers |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/AutoexportJob/AutoexportJobDeleteCommand.cs | Remove options-object logging; keep job/filesystem identifiers |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/AutoexportJob/AutoexportJobCreateCommand.cs | Remove options-object logging; keep filesystem identifier |
| tools/Azure.Mcp.Tools.ManagedLustre/src/Commands/FileSystem/AutoexportJob/AutoexportJobCancelCommand.cs | Remove options-object logging; keep job/filesystem identifiers |
| tools/Azure.Mcp.Tools.FunctionApp/src/Commands/FunctionApp/FunctionAppGetCommand.cs | Remove options-object logging; keep subscription/RG/function-app identifiers |
| tools/Azure.Mcp.Tools.FoundryExtensions/src/Commands/ResourceGetCommand.cs | Remove options-object logging; keep subscription/RG/resource-name identifiers |
| tools/Azure.Mcp.Tools.FileShares/src/Commands/Snapshot/SnapshotDeleteCommand.cs | Remove options-object logging; keep snapshot/share/RG identifiers |
| tools/Azure.Mcp.Tools.FileShares/src/Commands/Informational/FileShareGetUsageDataCommand.cs | Remove options-object logging; keep subscription/location identifiers |
| tools/Azure.Mcp.Tools.FileShares/src/Commands/Informational/FileShareGetProvisioningRecommendationCommand.cs | Remove options-object logging; keep subscription/location identifiers |
| tools/Azure.Mcp.Tools.FileShares/src/Commands/Informational/FileShareGetLimitsCommand.cs | Remove options-object logging; keep subscription/location identifiers |
| tools/Azure.Mcp.Tools.FileShares/src/Commands/FileShare/FileShareDeleteCommand.cs | Remove options-object logging; keep share/RG identifiers |
| tools/Azure.Mcp.Tools.FileShares/src/Commands/FileShare/FileShareCheckNameAvailabilityCommand.cs | Remove options-object logging; keep share/location identifiers |
| tools/Azure.Mcp.Tools.Extension/src/Commands/CliInstallCommand.cs | Remove options-object logging; keep CLI type identifier |
| tools/Azure.Mcp.Tools.Extension/src/Commands/CliGenerateCommand.cs | Remove options-object logging; keep CLI type identifier |
| tools/Azure.Mcp.Tools.EventHubs/src/Commands/EventHub/EventHubUpdateCommand.cs | Remove options-object logging; keep event-hub/namespace/RG/sub identifiers |
| tools/Azure.Mcp.Tools.EventHubs/src/Commands/EventHub/EventHubGetCommand.cs | Remove options-object logging; keep event-hub/namespace/RG/sub identifiers |
| tools/Azure.Mcp.Tools.EventHubs/src/Commands/EventHub/EventHubDeleteCommand.cs | Remove options-object logging; keep event-hub/namespace/RG/sub identifiers |
| tools/Azure.Mcp.Tools.EventHubs/src/Commands/ConsumerGroup/ConsumerGroupGetCommand.cs | Remove options-object logging; keep CG/eventhub/namespace/RG identifiers |
| tools/Azure.Mcp.Tools.EventGrid/src/Commands/Topic/TopicListCommand.cs | Remove options-object logging; keep subscription identifier |
| tools/Azure.Mcp.Tools.EventGrid/src/Commands/Subscription/SubscriptionListCommand.cs | Remove options-object logging; keep subscription/RG/topic/location identifiers |
| tools/Azure.Mcp.Tools.EventGrid/src/Commands/Events/EventsPublishCommand.cs | Remove options-object logging; keep subscription/topic identifiers |
| tools/Azure.Mcp.Tools.DeviceRegistry/src/Commands/Namespace/NamespaceListCommand.cs | Remove options-object logging; keep subscription/RG identifiers |
| tools/Azure.Mcp.Tools.Cosmos/src/Commands/CosmosListCommand.cs | Remove options-object logging; keep account/RG identifiers |
| tools/Azure.Mcp.Tools.ContainerApps/src/Commands/ContainerApp/ContainerAppListCommand.cs | Remove options-object logging; keep subscription/RG identifiers |
| tools/Azure.Mcp.Tools.Compute/src/Commands/Vmss/VmssGetCommand.cs | Remove options-object logging; keep vmss/instance/RG/sub identifiers |
| tools/Azure.Mcp.Tools.Compute/src/Commands/Vm/VmGetCommand.cs | Remove options-object logging; keep vm/RG/sub identifiers |
| tools/Azure.Mcp.Tools.Compute/src/Commands/Disk/DiskUpdateCommand.cs | Remove options-object logging; keep disk/RG identifiers |
| tools/Azure.Mcp.Tools.Compute/src/Commands/Disk/DiskGetCommand.cs | Remove options-object logging; keep disk/RG identifiers |
| tools/Azure.Mcp.Tools.Compute/src/Commands/Disk/DiskDeleteCommand.cs | Remove options-object logging; keep disk/RG identifiers |
| tools/Azure.Mcp.Tools.Compute/src/Commands/Disk/DiskCreateCommand.cs | Remove options-object logging; keep disk/RG identifiers |
| tools/Azure.Mcp.Tools.Communication/src/Commands/Sms/SmsSendCommand.cs | Remove options-object logging; keep from/to/message-length identifiers |
| tools/Azure.Mcp.Tools.Communication/src/Commands/Email/EmailSendCommand.cs | Remove options-object logging; keep endpoint identifier |
| tools/Azure.Mcp.Tools.AzureMigrate/src/Commands/PlatformLandingZone/RequestCommand.cs | Remove options-object logging; keep action/RG identifiers |
| tools/Azure.Mcp.Tools.Aks/src/Commands/Nodepool/NodepoolGetCommand.cs | Remove options-object logging; keep sub/RG/cluster/nodepool identifiers |
| tools/Azure.Mcp.Tools.Aks/src/Commands/Cluster/ClusterGetCommand.cs | Remove options-object logging; keep sub/RG/cluster identifiers |
| tools/Azure.Mcp.Tools.Advisor/src/Commands/Recommendation/RecommendationListCommand.cs | Remove options-object logging; keep subscription/RG identifiers |
| tools/Azure.Mcp.Tools.Acr/src/Commands/Registry/RegistryListCommand.cs | Remove options-object logging; keep subscription/RG identifiers |
| servers/Azure.Mcp.Server/changelog-entries/1775229599410.yaml | Adds changelog entry for the logging sanitation change |
alzimmermsft
approved these changes
Apr 3, 2026
KarishmaGhiya
approved these changes
Apr 3, 2026
g2vinay
approved these changes
Apr 3, 2026
xiangyan99
added a commit
that referenced
this pull request
Apr 3, 2026
xiangyan99
added a commit
that referenced
this pull request
Apr 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
[Provide a clear, concise description of the changes]Replaced structured logging of entire options objects with explicit non-sensitive identifiers in error log statements across all commands
[Add additional context, screenshots, or information that helps reviewers]GitHub issue number?
[Link to the GitHub issue this PR addresses]Pre-merge Checklist
servers/Azure.Mcp.Server/README.mdand/orservers/Fabric.Mcp.Server/README.mddocumentationREADME.mdchanges running the script./eng/scripts/Process-PackageReadMe.ps1. See Package READMEToolDescriptionEvaluatorand obtained a score of0.4or more and a top 3 ranking for all related test promptsconsolidated-tools.jsonbreaking-changelabelservers/Azure.Mcp.Server/docs/azmcp-commands.md./eng/scripts/Update-AzCommandsMetadata.ps1to update tool metadata inazmcp-commands.md(required for CI)servers/Azure.Mcp.Server/docs/e2eTestPrompts.mdcrypto mining, spam, data exfiltration, etc.)/azp run mcp - pullrequest - liveto run Live Test Pipeline