Implement generative AI and agentic solutions 2.3 Optimize and operationalize generative AI systems
Tracing data for a production agent in Application Insights is costly, and the privacy…
Study guide skill: Set up observability by implementing tracing, token analytics, safety signals, and latency breakdowns
Question B4-029
Tracing data for a production agent in Application Insights is costly, and the privacy team is worried that prompts and tool arguments are being stored. Which two actions follow the Foundry tracing guidance? (Choose two.)
Select 2 answers.
Answer: A, E
The guidance is to enable content recording during development and debugging to see full request and response data, and to disable it in production to protect sensitive data. To manage trace costs, adjust sampling rates or retention periods for trace data in production. Keeping content recording on in production is exactly what the guidance says to avoid. Secrets, credentials, and tokens don't belong in prompts, tool arguments, or span attributes, and Log Analytics Reader is a role for viewing and querying traces, not for reducing what's stored.
Deep dive
How it works
Agent tracing stores telemetry in Azure Monitor Application Insights, which can incur costs based on data volume and retention settings. Two separate concerns, two separate levers:
Privacy: content recording. The Agent Framework tracing guidance is to enable content recording during development and debugging, to see full request and response data, and to disable it in production to protect sensitive data. In the samples, it's controlled by environment variables such as OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT. If sensitive content already appears in traces, the troubleshooting guidance is the same: disable content recording in production, and redact sensitive data before it enters telemetry.
Cost: sampling and retention. For cost management, consider adjusting sampling rates or retention periods in production. Trace retention and sampling follow your Application Insights configuration.
Related hygiene from the concepts page: don't store secrets, credentials or tokens in prompts, tool arguments or span attributes, and treat trace data as production telemetry with the same access controls and retention policies as your logs and metrics.
The other options, and when you'd use them
- Keep content recording on in production: That's exactly what the guidance says to disable in production to protect sensitive data.
- Move API keys into span attributes: Secrets, credentials and tokens don't belong in prompts, tool arguments or span attributes.
- Grant Log Analytics Reader to more users: That role lets people view and query traces. It doesn't reduce what's stored or what it costs, and widening access is the opposite of what the privacy team wants.
Exam tip
Privacy in production = content recording off. Cost = sampling and retention. Secrets never go into telemetry.
References
Last reviewed: