For a potential project, we are tasked with developing a website (API/SPA principle) which has a paramount requirement of keeping personally identifiable information (PII) about its visitors anonymous, and the data they provide encrypted at rest. The latter requirement is quite easily addressed using available libraries and best practices.
What I'm concerned with, is that I can't find any clear information about which data Microsoft is storing about the hypothetical visitors to my website. This probably depends on the specific service we would use, which will likely be Azure Kubernetes Service (AKS).
Specifically the visitors IP addresses are considered sensitive and thus should not be stored anywhere.
As the owner/operator of the application I know that I have to actively enable additional services (e.g. log analytics) in order to see this information, but does Microsoft see about my visitors? I can't imagine they are keeping no logs whatsoever of who visits their infrastructure, if only for the purpose of e.g. blacklisting abusive IP addresses (DDoS attacks, ...).
Any documentation about this would be much appreciated.
Assuming Microsoft does keep track of visitor IP addresses, what would be alternatives that don't? I'm open to alternative cloud providers, or even a 3rd party service that acts as a gateway to the Azure infrastructure, making only its IP visible to Azure, and meanwhile not logging its visitors IP addresses.