Add warning against storing sensitive data in auditable directory objects

[egreenberg14]

Summary

Adds a warning advising customers not to store secrets or other sensitive information (passwords, credentials, access/refresh tokens, connection strings) in directory object attributes or any other auditable resource exposed by Microsoft Graph.

Why

Microsoft Graph activity logs, along with audit and sign-in logs, capture API request details (including request URIs). Any sensitive value passed in a request or stored on an auditable object can be recorded in these logs and propagate to downstream Log Analytics, Azure Storage, or SIEM destinations, where it's readable by admins. This was requested by the privacy team following an incident where a customer stored a refresh token in a user object attribute that then surfaced in the activity logs pipeline.

Change

• Adds a [!WARNING] note under What data is available in the Microsoft Graph activity logs in concepts/microsoft-graph-activity-logs-overview.md, pointing customers to Azure Key Vault as the proper secret store.

No API change; no changelog or What's New entry required.

[learn-build-service-prod]

Learn Build status updates of commit ed8fc63:

❌ Validation status: errors

Please follow instructions here which may help to resolve issue.

File	Status	Preview URL	Details
	❌Error		Details

• [Error: CannotMergeCommit] Cannot merge commit ed8fc63cf6db2752c9854a596f938b4a568e56ce in branch egreenberg/activity-logs-sensitive-data-warning of repository https://github.com/egreenberg14/microsoft-graph-docs-contrib into branch main (commit cc209b0c0af22723fb47f6fe3604048f27c2a372). Please follow this documentation: https://help.github.com/articles/resolving-a-merge-conflict-using-the-command-line/ to use git.exe to resolve you content conflicts locally and then push to remote.

For more details, please refer to the build report.

Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them.

[learn-build-service-prod]

Learn Build status updates of commit 386cbc3:

✅ Validation status: passed

File	Status	Preview URL	Details
concepts/microsoft-graph-activity-logs-overview.md	✅Succeeded

For more details, please refer to the build report.

[Danipocket]

@egreenberg14, @jenniferf-skc , please make sure you use our private repo. I'll merge this PR as an exception.

[Copilot]

Pull request overview

This PR adds security guidance to the Microsoft Graph activity logs conceptual documentation, warning customers not to store secrets or other sensitive values in directory object attributes (or other auditable Graph resources) because those values can surface in activity/audit/sign-in logging and downstream exports.

Changes:

• Added a new [!WARNING] admonition under “What data is available in the Microsoft Graph activity logs”.
• Included a recommendation to use Azure Key Vault as the appropriate place to store secrets.

[learn-build-service-prod]

Learn Build status updates of commit b103195:

✅ Validation status: passed

File	Status	Preview URL	Details
concepts/microsoft-graph-activity-logs-overview.md	✅Succeeded

For more details, please refer to the build report.

[learn-build-service-prod]

Learn Build status updates of commit 7d29280:

✅ Validation status: passed

File	Status	Preview URL	Details
concepts/microsoft-graph-activity-logs-overview.md	✅Succeeded

For more details, please refer to the build report.