--- alias: operation-guide-user-data-anonymization tags: - data platform - security description: "Data Platform data shows user IDs instead of user accounts, and only users with the CmfDataSet.IdentityAccess feature see the real identities" --- # User Data Anonymization ## Overview Critical Manufacturing MES records the account of the user who creates or changes an object in the `CreatedBy` and `ModifiedBy` properties. When the MES replicates data to the **Data Platform**, it replaces each of these accounts with the ID of the user, so the data stored in the **Data Platform** does not hold them. The [[operation-guide-messtackcomponents#data-manager|Data Manager]] turns the user ID back into the identity of the user when it returns the data, but only for users with the `CmfDataSet.IdentityAccess` security feature. Users without the security feature see the user ID. This applies to all data read through the **Data Manager**: - **Data Sets** queried through OData, for example from Grafana, Power BI, or Excel. - Reports in **Analytics Views**. ## What Is Anonymized The MES anonymizes the `CreatedBy` and `ModifiedBy` values in the following data: | Data | Columns | Where the value is | |---------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|-------------------------------------------------------------------| | Entity tables in the Operational Data Store (ODS), such as `CoreDataModel_T_Material` | `CreatedBy`, `ModifiedBy` | In the column. | | Smart tables and generic tables in the ODS | `_CreatedBy`, `_ModifiedBy` | In the column. | | System tables in the ODS, such as `Security_T_User` or `Config_T_Config` | `CreatedBy`, `ModifiedBy` | Inside the `Data` column, which holds the row as a JSON document. | | `dbo_T_ServiceHistory` in the ODS | `_CreatedBy` | In the column. | | Tables built from an **IoT Event Definition** in the Canonical Data Model (CDM) | `CreatedBy` and `ModifiedBy` of the main entity, and `ModifiedBy` of each entity it references | In the property of the event. | Table: Data where user accounts are replaced by user IDs Each value takes one of the following forms: | Case | Value | |--------------------------------------------------------------------------------------------------------------|---------------------------------------| | The account belongs to a user of the MES. | The ID of the user, for example `42`. | | The account does not belong to any user, for example a removed user or a service account that is not a user. | `-1` | | There is no account. | Empty | Table: Anonymized values A value of `-1` cannot be turned back into an identity, even for users who hold the `CmfDataSet.IdentityAccess` security feature. ## What Is Not Anonymized Only `CreatedBy` and `ModifiedBy` are anonymized. Other properties that hold a user account, such as the user of a signature or the owner of an object, keep the account. If such a column must not reach the users of a **Data Set**, leave it out of the query of the **Data Set**. User data anonymization does not apply to **Employee** data. The system reports show the ID of the **Employee**, and the `CmfDataSet.IdentityAccess` security feature does not change it. ## Showing User Identities The **Data Manager** shows the identity of a user in the form `User Name (User Account)`, for example `John Smith (jsmith)`, when both of the following are true: - The field has the **User Identifier** option enabled. For more information, see [[user-guide-create-data-set]] and [[user-guide-create-iot-event-definition]]. - The user who reads the data holds the `CmfDataSet.IdentityAccess` security feature. ### Who Can See User Identities - Administrators always hold the `CmfDataSet.IdentityAccess` security feature. - When the GUI Feature Level security is inactive, every user holds it. For more information, see [[security-admin#security-levels|Security Levels]]. - Any other user holds it only through a role. To grant it, assign the feature to a role of the user. For more information, see [[user-guide-security-features#assigning-roles-to-a-feature|Assigning Roles to a Feature]]. On a new installation, no role holds the feature. A system upgraded from version 11.2.3 or later keeps the assignments made by that version, which assigned the feature to every role that existed at the time. A change to the roles of a user applies to the next query. When you assign the feature to a role, or unassign it, the change can take up to 10 minutes to apply. ### User Identifier Fields The User Identifier option is enabled by default in the following cases: - The system **Data Sets** and **IoT Event Definitions** of the MES. - The fields of ODS **Data Sets** whose name ends in `CreatedBy` or `ModifiedBy`, for the **Data Sets** that exist when you install or upgrade the MES. For any **Data Set** or **IoT Event Definition** that you create, enable the option yourself on each field that holds a user ID. ### Enterprise Data Platform and Data Silos When you operate in Enterprise Data Platform (EDP) mode, the following rules also apply: - For CDM and DWH tables, the query must include the `AppProperties_DataSilo` column. Otherwise, the **Data Manager** returns the user IDs. The ODS tables do not need it. - Rows that come from an external **Data Silo** always show the user ID. ## Changes to User Names The **Data Manager** keeps the identity of each user in memory for 24 hours. After you change the name of a user, **Data Sets** and reports can show the previous name for up to 24 hours. The stored data does not change, because the user ID stays the same. To show the new name at once, restart the **Data Manager**. To change how long the **Data Manager** keeps the identities, set the [[operation-guide-environmentvariables#datamanager_users_cache_expiration_hours|DATAMANAGER_USERS_CACHE_EXPIRATION_HOURS]] environment variable, in hours. ## Related Documentation - [[user-guide-security-features]] - describes features and how to assign them to roles. - [[user-guide-create-data-set]] - describes the **User Identifier** option of **Data Set** fields. - [[user-guide-create-iot-event-definition]] - describes the **User Identifier** option of **IoT Event Definition** properties. - [[user-guide-analytics-view-index]] - lists the reports and dashboards of **Analytics Views**. - [[operation-guide-data-set-data-access-security]] - describes which rows a **Data Set** query returns.