Address telemetry disclosure review

- fix duplicated usage wording in shared and adopter skill metadata
- make Power Pages Entra object ID disclosure conditional on PAC exposing it
- keep canonical telemetry and workflow copies synchronized

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: priyanshu92

README.md

@@ -269,4 +269,4 @@ Any use of third-party trademarks or logos are subject to those third-party's po
 
 ## Telemetry
 
-Plugins that ship 1DS telemetry (currently `power-pages` and `model-apps`) gather usage signals that can include Dataverse organization and Entra tenant GUIDs when PAC is signed in. Power Pages also includes the signed-in user's Entra object ID; Model Apps excludes it. Telemetry is default-on when the plugin's committed telemetry config is enabled. Users opt out per plugin via `/<plugin>:telemetry off` (for example, `/power-pages:telemetry off`), stored in `~/.power-platform-skills/config.json`. Each adopting plugin also honors `POWER_PLATFORM_SKILLS_TELEMETRY_<PLUGIN>_OPTOUT` for automation and CI. The environment variable has highest precedence and disables transmission regardless of the saved command choice. See `shared/telemetry/README.md` for the full field list and local-mirror behavior.
+Plugins that ship 1DS telemetry (currently `power-pages` and `model-apps`) gather usage signals that can include Dataverse organization and Entra tenant GUIDs when PAC is signed in. Power Pages can also include the signed-in user's Entra object ID when PAC exposes it; Model Apps excludes it. Telemetry is default-on when the plugin's committed telemetry config is enabled. Users opt out per plugin via `/<plugin>:telemetry off` (for example, `/power-pages:telemetry off`), stored in `~/.power-platform-skills/config.json`. Each adopting plugin also honors `POWER_PLATFORM_SKILLS_TELEMETRY_<PLUGIN>_OPTOUT` for automation and CI. The environment variable has highest precedence and disables transmission regardless of the saved command choice. See `shared/telemetry/README.md` for the full field list and local-mirror behavior.

plugins/model-apps/scripts/lib/telemetry/lib/telemetry-config.js

@@ -10,7 +10,8 @@ const { pluginLogDir, latestSessionLog } = require("./local-log");
 function dataDisclosure(plugin) {
   const pluginSpecific =
     plugin === "power-pages"
-      ? "   Power Pages also records the signed-in user's Entra object ID as eventInfo.aadObjectId.\n"
+      ? "   Power Pages can also record the signed-in user's Entra object ID as\n" +
+        "   eventInfo.aadObjectId when PAC exposes it.\n"
       : plugin === "model-apps"
         ? "   Model Apps excludes the signed-in user's Entra object ID.\n"
         : "";

plugins/model-apps/skills/telemetry/SKILL.md

@@ -2,7 +2,7 @@
 name: telemetry
 description: >
   Use this skill when the user wants to enable, disable, turn on or off, opt out
-  of, opt in to, or check the status of model-apps usage
+  of, opt in to, or check the status of model-apps telemetry or its usage
   data. Triggers: "disable telemetry", "turn off telemetry", "opt out of
   telemetry", "stop collecting usage data", "enable telemetry", "telemetry status".
 user-invocable: true

plugins/model-apps/skills/telemetry/telemetry-workflow.md

@@ -23,8 +23,8 @@ telemetry for this plugin. Default to `status` when no argument is given.
 - Events include skill name, plugin/PAC/agent versions, OS/Node versions, session
   and correlation IDs, and Dataverse organization and Entra tenant GUIDs when PAC
   is signed in.
-  Power Pages also includes the signed-in user's Entra object ID as
-  `eventInfo.aadObjectId`; Model Apps excludes it.
+  Power Pages can also include the signed-in user's Entra object ID as
+  `eventInfo.aadObjectId` when PAC exposes it; Model Apps excludes it.
   The local diagnostic mirror retains the same event fields even when transmission
   is off.
 - Events do not include file paths, prompts, tool inputs, site names, Dataverse

plugins/power-pages/AGENTS.md

@@ -418,7 +418,7 @@ This plugin ships 1DS telemetry for skill-run and script-run signals. The canoni
 
 - **`scripts/lib/telemetry/lib` is copied** from the repo-root `shared/telemetry/lib` — edit `shared/telemetry/lib/` first, then refresh this plugin's copy in the same change. The real files next to the copy are `ikey.json` (this plugin's config) and `resolver.js` (the resolver contract implementation). **Posture:** the committed `ikey.json` ships `disabled: false` — transmission is enabled for power-pages (the tenant-side Kusto stream + annotation for `PagesAIPluginEvent` are provisioned). Set `disabled: true` to hard-off (no POST, no local log) if you need to suppress all telemetry at the source.
 - **Region routing (Artemis geo + cloud stamp)** lives in `scripts/lib/telemetry/region/` and is wired through `scripts/lib/telemetry/resolver.js`, which implements the resolver contract (`resolve({ event, cfg, cloud, configDir })` / `isProvisioned(cfg)`). The shared dispatcher is routing-agnostic — it auto-discovers `resolver.js` by convention (sibling of `ikey.json`) and calls it; the `region/` implementation is entirely plugin-owned and never referenced by the shared library.
-- **Privacy posture:** usage telemetry is **default-on**. When PAC is signed in, events include the Dataverse organization GUID (`orgId`), Entra tenant GUID (`tenantId`), and signed-in user's Entra object ID (`eventInfo.aadObjectId`). The local diagnostic mirror retains the same fields. Events do not include file paths, prompts, tool inputs, site names, Dataverse URLs, credentials, usernames, or hostnames. There is no consent prompt in skills. Users opt out via `/power-pages:telemetry off`, which stores a per-plugin choice in `~/.power-platform-skills/config.json` (`telemetry["power-pages"] = "off"`). Opting out stops transmission only; the local diagnostic mirror is still written. Re-enable with `/power-pages:telemetry on`. Automation/CI can disable transmission by setting `POWER_PLATFORM_SKILLS_TELEMETRY_POWER_PAGES_OPTOUT=1` (or `true`); this opt-out has the **highest precedence** and overrides both a persisted `/power-pages:telemetry` choice and `/power-pages:telemetry on`.
+- **Privacy posture:** usage telemetry is **default-on**. When PAC is signed in, events include the Dataverse organization GUID (`orgId`) and Entra tenant GUID (`tenantId`). Power Pages also includes the signed-in user's Entra object ID (`eventInfo.aadObjectId`) when PAC exposes it; otherwise that field is omitted. The local diagnostic mirror retains the same fields. Events do not include file paths, prompts, tool inputs, site names, Dataverse URLs, credentials, usernames, or hostnames. There is no consent prompt in skills. Users opt out via `/power-pages:telemetry off`, which stores a per-plugin choice in `~/.power-platform-skills/config.json` (`telemetry["power-pages"] = "off"`). Opting out stops transmission only; the local diagnostic mirror is still written. Re-enable with `/power-pages:telemetry on`. Automation/CI can disable transmission by setting `POWER_PLATFORM_SKILLS_TELEMETRY_POWER_PAGES_OPTOUT=1` (or `true`); this opt-out has the **highest precedence** and overrides both a persisted `/power-pages:telemetry` choice and `/power-pages:telemetry on`.
 - **Strict allowlist:** `shared/telemetry/lib/events.js` enforces exactly the fields listed in the spec. Never add a field to a builder without first adding it to the allowlist and documenting it in the design doc.
 - **Fail closed:** telemetry code must never change a script's exit code or break a skill run. Emission is fire-and-forget via a detached dispatcher child, so the hook or script returns before the HTTPS POST completes.
 

plugins/power-pages/README.md

@@ -409,7 +409,7 @@ Enables, disables, or checks the status of usage telemetry. Per-user and per-plu
 - `/power-pages:telemetry status` — show the current setting
 - `/power-pages:telemetry off` — stop sending telemetry (nothing leaves your machine)
 - `/power-pages:telemetry on` — resume sending telemetry
-- When PAC is signed in, events include organization, tenant, and signed-in user Entra object IDs
+- When PAC is signed in, events include organization and tenant IDs; they can also include the signed-in user's Entra object ID when PAC exposes it
 - Automation/CI: set `POWER_PLATFORM_SKILLS_TELEMETRY_POWER_PAGES_OPTOUT=1` to disable (highest precedence — overrides any saved choice)
 
 ## Agents
@@ -525,8 +525,8 @@ This Dataverse relationship check is intended for local validation only and shou
 ## Telemetry & privacy
 
 This plugin sends usage telemetry by default to help Microsoft improve it.
-Events include skill name, plugin/PAC/agent versions, OS/Node versions, session and correlation IDs, and, when PAC is signed in, the Dataverse organization GUID, Entra tenant GUID, and signed-in user's Entra object ID.
-The Entra object ID is stored under `eventInfo.aadObjectId`.
+Events include skill name, plugin/PAC/agent versions, OS/Node versions, session and correlation IDs, and, when PAC is signed in, the Dataverse organization GUID and Entra tenant GUID.
+When PAC exposes the signed-in user's Entra object ID, Power Pages stores it under `eventInfo.aadObjectId`; otherwise that field is omitted.
 Events do not include file paths, prompts, tool inputs, site names, Dataverse URLs, credentials, usernames, or hostnames.
 
 **Turn it on or off (per-user, applies to every project):**

plugins/power-pages/scripts/lib/telemetry/lib/telemetry-config.js

@@ -10,7 +10,8 @@ const { pluginLogDir, latestSessionLog } = require("./local-log");
 function dataDisclosure(plugin) {
   const pluginSpecific =
     plugin === "power-pages"
-      ? "   Power Pages also records the signed-in user's Entra object ID as eventInfo.aadObjectId.\n"
+      ? "   Power Pages can also record the signed-in user's Entra object ID as\n" +
+        "   eventInfo.aadObjectId when PAC exposes it.\n"
       : plugin === "model-apps"
         ? "   Model Apps excludes the signed-in user's Entra object ID.\n"
         : "";

plugins/power-pages/skills/telemetry/SKILL.md

@@ -2,7 +2,7 @@
 name: telemetry
 description: >
   Use this skill when the user wants to enable, disable, turn on or off, opt out
-  of, opt in to, or check the status of power-pages usage
+  of, opt in to, or check the status of power-pages telemetry or its usage
   data. Triggers: "disable telemetry", "turn off telemetry", "opt out of
   telemetry", "stop collecting usage data", "enable telemetry", "telemetry status".
 user-invocable: true

plugins/power-pages/skills/telemetry/telemetry-workflow.md

@@ -23,8 +23,8 @@ telemetry for this plugin. Default to `status` when no argument is given.
 - Events include skill name, plugin/PAC/agent versions, OS/Node versions, session
   and correlation IDs, and Dataverse organization and Entra tenant GUIDs when PAC
   is signed in.
-  Power Pages also includes the signed-in user's Entra object ID as
-  `eventInfo.aadObjectId`; Model Apps excludes it.
+  Power Pages can also include the signed-in user's Entra object ID as
+  `eventInfo.aadObjectId` when PAC exposes it; Model Apps excludes it.
   The local diagnostic mirror retains the same event fields even when transmission
   is off.
 - Events do not include file paths, prompts, tool inputs, site names, Dataverse

shared/skills/telemetry/SKILL.template.md

@@ -2,8 +2,8 @@
 name: telemetry
 description: >
   Use this skill when the user wants to enable, disable, turn on or off, opt out
-  of, opt in to, or check the status of {{PLUGIN_NAME}} usage
-  usage data. Triggers: "disable telemetry", "turn off telemetry", "opt out of
+  of, opt in to, or check the status of {{PLUGIN_NAME}} telemetry or its usage
+  data. Triggers: "disable telemetry", "turn off telemetry", "opt out of
   telemetry", "stop collecting usage data", "enable telemetry", "telemetry status".
 user-invocable: true
 argument-hint: "on | off | status"