What is stored and what is deleted
Data is stored in the CaPolicyManager folder in the local application data of the current Windows user on this PC. Retrieved information is not sent to the publisher or to any third party.
| Information | Encrypted | Kept |
|---|---|---|
| Sign-in records (including time, result, applied policies, and full IP address; user names are hashed) | No | Not deleted automatically. Replaced when the same period is retrieved again. |
| User display names and user names (UPN) | Yes | While the sign-in records remain |
| User IDs and group membership | Yes | 7 days from retrieval |
| Policy definitions and named locations | Yes | By default, 5 generations and 90 days from the last retrieval. You can change this in Settings. |
| Connection settings (tenant ID and client ID) and emergency access entries | Yes | Until you change them |
| A random value (salt, used to hash user names) | Yes | No limit. Delete stored data does not remove it. |
| Application display names | No | No limit |
| Display settings and the consent record | No | Until you change them |
Access tokens are kept in memory only and are never written to a file. The user and group names, group members, and parent groups read for the emergency access search and the policy check are also kept in memory only.
Keep the emergency access setting is on by default. If you turn it off, the emergency access entries are also deleted. You can turn off saving policy definitions and named locations in Settings; turning it off deletes what was saved.
CSV, HTML, and change proposal files you export are saved where you choose and are not part of this deletion. They may contain user names and IP addresses, so manage them according to your organization's policies.
If the tenant you sign in to differs from the tenant of the stored data, the app asks for confirmation before it retrieves data. If you select Yes, the app deletes the stored data of the previous tenant (sign-in logs, user names, UPN cache, user IDs, policy definitions, emergency access settings, and application names) and then retrieves the data. You cannot restore the deleted data. The other settings and consent are kept. If you do not select Yes, the retrieval is canceled and the stored data does not change.
Last updated: 2026-11-03