# Log Audit Events

Rationale: Keeping track of activities within your Azure DevOps environment is crucial for security and compliance.

Source: https://maester.dev/docs/tests/AZDO.1002

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Auditing · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1002
```

## Overview

Auditing **should be** enabled.

Rationale: Keeping track of activities within your Azure DevOps environment is crucial for security and compliance. Auditing helps you monitor and log these activities, providing transparency and accountability.

#### Remediation action

Enable the policy to stop these requests and notifications.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies under the Security header.
4. Switch the Log Audit Events button to ON.

**Results:**
Auditing is enabled for the organization. Refresh the page to see Auditing appear in the sidebar. Audit events start appearing in Auditing Logs and through any configured audit streams.

#### Related links

* [Learn - Enable and disable auditing](https://learn.microsoft.com/azure/devops/organizations/audit/azure-devops-auditing?view=azure-devops&tabs=preview-page#enable-and-disable-auditing)
* [Learn - Review audit log](https://learn.microsoft.com/azure/devops/organizations/audit/azure-devops-auditing?view=azure-devops&tabs=preview-page#review-audit-log)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1002 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Auditing |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports controls | nist-800-53-r5:AU-12, nist-800-53-r5:AU-2 |
| PowerShell test | [Test-AzdoLogAuditEvent](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1002.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/organizations/audit/azure-devops-auditing?view=azure-devops&tabs=preview-page#enable-and-disable-auditing](https://learn.microsoft.com/azure/devops/organizations/audit/azure-devops-auditing?view=azure-devops&tabs=preview-page#enable-and-disable-auditing) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1002.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1002.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1002.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1002.md)