1. This website uses cookies to improve service and provide a tailored user experience. By using this site, you agree to this use. See our Cookie Policy.
    Dismiss Notice

Data that the telemetry agent collects in Microsoft Office

Discussion in 'BlackHat Lounge' started by ShiningWarrior, Aug 19, 2018.

  1. ShiningWarrior

    ShiningWarrior BANNED BANNED

    Joined:
    Mar 17, 2018
    Messages:
    761
    Likes Received:
    253
    Gender:
    Male
    Summary: Learn about the data that the telemetry agent collects for Office.

    The telemetry agent collects several types of telemetry data for Office as described in this article. For example,
    • The file names of Office files that are in the Most Recently Used list.

    • The names of add-ins and solutions that interact with Office.

    • System information such as user name and computer name.
    The agent collects different kinds of information for different applications as applicable. For example, for Excel, Microsoft Outlook, PowerPoint, and Word, the agent collects data that allows you to determine:
    • Whether the document has specific metadata for a particular file, such VBA macros, data connections, or ActiveX controls.

    • Whether the document has encountered compatibility issues or critical errors while it is being used.

    • How Office files and solutions are used on a user's computer. Data of this type that is gathered by the agent is referred to as session data.
    The agent doesn't collect any of the following kinds of information:
    • The contents of files.

    • Information about files that are not in the Most Recently Used list.
    The telemetry agent collects inventory-related data, hardware and software data, and user data in Office 2016, Office 2013, Office 2010, Office 2007, and Office 2003 for the following applications:
    • Access

    • Excel

    • OneNote

    • Outlook

    • PowerPoint

    • Project

    • Publisher

    • Visio

    • Word
    For Office 2016 and Office 2013 only, the agent collects telemetry data for the following applications:
    • Excel

    • Outlook

    • PowerPoint

    • Word
    The agent collects the following data for all computers that it monitors. This data includes inventory data, user data, and hardware and software data. You can find the list of Office versions and operating systems that the agent supports in https://docs.microsoft.com/en-us/deployoffice/compat/deploy-telemetry-dashboard#agent.

    Data about recently opened Office documents and templates

    The agent collects the following data about recently opened Office documents and templates. This data is sorted by the worksheet where it appears in Telemetry Dashboard.

    Documents worksheet:
    • File name

    • File format (extension)

    • Total users

    • Number of Office
    Document details worksheet:
    • User name

    • Computer name

    • Location

    • Size (KB)

    • Author

    • Last loaded

    • Title

    • Office version
    Exceptions to data collected about recently opened Office documents and templates
    • For OneNote, Telemetry Agent collects only Notebook name and location.

    • For Outlook, Telemetry Agent doesn't collect any inventory data of document files.

    • For files that are stored in a network share or SharePoint site, the agent collects only the file name and location.

    • If the list of most recently used documents is disabled on a user's computer (by Group Policy or the user disabled it by themselves), the agent doesn't collect inventory data for document files and templates.
    Data about recently loaded add-ins and apps for Office
    The agent collects the following data about recently loaded add-ins and apps for Office. This data is sorted by the worksheet where it appears in Telemetry Dashboard.

    Solutions worksheet:
    • Solution name

    • Total users

    • Number of Office users
    Solution details worksheet:
    • User name

    • Computer name

    • Solution version

    • Architecture (CPU architectures: x86/x64/ARM)

    • Load time

    • Description

    • Size (KB)

    • Location (.dll/manifest file path)
    User data
    The agent collects the following user data. This data appears in the Agents worksheet.
    • User name

    • Level (Telemetry Agent status)

    • Computer

    • Last updated

    • Label (1-4)

    • Version of the agent
    Data about hardware and software

    The agent collects the following data about hardware and software. This data is sorted by the worksheet where it appears in Telemetry Dashboard.

    Telemetry Processor worksheet:
    • Computer name

    • Level (telemetry processor status)

    • Users

    • Computers

    • Last updated (date and time)
    Deployments worksheet:
    • Office versions

    • Number of 32-bit deployments

    • Number of 64-bit deployments

    • Number of ARM deployments
    In Office 2016 and Office 2013, the agent also collects the following telemetry data for Excel, Microsoft Outlook, PowerPoint, and Word. This data is sorted by the worksheet where it appears in Telemetry Dashboard.

    Telemetry data is collected during application run time. If the inventory data was collected by the agent, but the application hasn't started collecting telemetry data, then some data, such as Success (%) and Load time, won't be shown in the dashboard until the user opens documents or loads solutions during application run time.

    Documents worksheet:
    • Success (%)

    • Sessions

    • Critical compatibility issue or crash

    • Informative compatibility issue or load failure
    Document details worksheet:

    VBA, OLE, external data connection, ActiveX control, and assembly reference information are logged starting from the second time that the user opens the document. This information won't be collected if the user opens the document only one time.
    • Last loaded date and time

    • Has VBA? (true/false)

    • Has OLE? (true/false)

    • Has external data connection? (true/false)

    • Has assembly reference? (true/false)
    Document sessions worksheet:
    • Date and time that the critical or informative event happened
    Solutions worksheet:
    • Success (%)

    • Sessions

    • Critical compatibility issue or crash

    • Informative compatibility issue or load failure

    • Load time (time taken to load add-ins or apps for Office)
    Solution issues worksheet:
    • Event ID

    • Title

    • Explanation

    • More info

    • Users

    • Sessions
    Source: https://docs.microsoft.com/en-us/deployoffice/compat/data-that-the-telemetry-agent-collects-in-office

    My opinion: That telemetry agent thing is a pretty shi##y move by MS. They even openly wrote in their privacy matter that they share our infos with MS subsidiaries and partners and also asks us to trust them (MS) with our info that our info is in good hands.

    If they can collect those data automatically like file name, author name and bla bla bla, they can 1000% see what we write in word, excel and outlook. But they won't admit that. Why? Because if they do, those uber fans of MS will stop buying their things.

    No wonder why people use cracked apps. Technically it's always company's shi##y moves that force the people to use cracked software.

    What's your opinion on this? How many of you use legit MS Office for your work and personal purpose?