Log Audit Events
AZDO.1002HighAzure DevOpsAuditingPreview 3.0
Part of Maester · Azure DevOps · Auditing · All checks
Invoke-Maester -TestId AZDO.1002Overview
Section titled “Overview”Auditing should be enabled.
Rationale: Keeping track of activities within your Azure DevOps environment is crucial for security and compliance. Auditing helps you monitor and log these activities, providing transparency and accountability.
Remediation action
Section titled “Remediation action”Enable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies under the Security header.
- Switch the Log Audit Events button to ON.
Results: Auditing is enabled for the organization. Refresh the page to see Auditing appear in the sidebar. Audit events start appearing in Auditing Logs and through any configured audit streams.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1002 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Auditing |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports controls | nist-800-53-r5:AU-12, nist-800-53-r5:AU-2 |
| PowerShell test | Test-AzdoLogAuditEvent |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/audit/azure-devops-auditing?view=azure-devops&tabs=preview-page#enable-and-disable-auditing |