Azure DevOps Auditing Streaming

5 posts · Jun 2019 – Apr 2022

What this trail covers

Azure DevOps Auditing now supports streaming of audit data to external systems like Splunk, Azure Monitor Logs (with Azure Sentinel integration), and Azure Event Grid. This enables real-time alerting, advanced data analysis, anomaly detection, and long-term storage beyond the default 90-day retention. The feature is available in public preview and can be configured by Project Collection Administrators or users with the 'Manage audit streams' permission.

All Microsoft trails

Apr 2022Opt-in to Auditing on Azure DevOpsThis post announces that Auditing on Azure DevOps is now an opt-in feature for organizations connected to Azure Active Directory. It details how to enable or disable the feature via Organization Settings > Policies > 'Log Audit Events'. For organizations already using Auditing, the feature remains enabled. The post also directs users to the Azure DevOps blog, release notes, and documentation for further updates and feedback.
Sep 2021Introducing Azure DevOps Audit StreamThis post introduces the Azure DevOps Audit Stream feature, currently in public preview. It explains how to stream audit data to external services like Azure Event Grid, Azure Monitor Logs, and Splunk, enabling advanced processing, alerting, anomaly detection, and longer retention than the default 90 days. The article provides a detailed walkthrough of setting up an audit stream to Azure Event Grid, including creating an Event Grid Topic, configuring Azure DevOps Stream settings, setting up a Storage Account Queue with Managed Identity, and configuring the Event Grid Subscription. It demonstrates monitoring the incoming audit stream data.
Feb 2021Billing and Token Management events now available in AuditingThis post announces the addition of two new event types to Azure DevOps auditing logs: Billing setup and management events (subscription changes, pipeline purchases, max quantity changes) and Personal Access Tokens (PATs) and SSH Keys management events (creation, update, revocation, removal). It also reiterates the availability of streaming for auditing data to external systems like Splunk, Azure Monitor Logs, and Azure Event Grid.
May 2020Streaming for Auditing is now in Public PreviewThis post announces the public preview of streaming for Azure DevOps auditing. It details the available stream targets (Splunk, Azure Monitor Logs, Azure Event Grid) and where to configure the feature within Organization Settings. It also provides links to documentation and encourages user feedback.
Feb 2020Azure DevOps Roadmap update for 2020 Q1This post announces the public preview of Azure DevOps Auditing and details the upcoming streaming feature for Q1 2020. This feature will allow logs to be sent to SIEM tools for anomaly detection, trend visualization, and more.
Advertisement
Oct 2019Azure DevOps Roadmap update for 2019 Q4This post details the Q4 2019 roadmap for Azure DevOps, with specific updates on auditing. It announces the continuation of investments in auditing for pipeline events by building streaming for auditing, enabling the sending of auditing events to SIEM tools for anomaly detection and trend visualization. It also mentions plans to support streaming connectors for Splunk, Azure Log Analytics (with Azure Sentinel integration), and Azure Event Grid. Additionally, it highlights the expansion of auditing capabilities for pipeline events (pipeline edited, run started, checks completed, approval completed, stage completed, etc.) and Azure Artifacts (permission changes, feed, upstream, and package create, update, and delete).
Jun 2019Auditing for Azure DevOps is now in Public PreviewIntroduced Auditing for Azure DevOps as a Public Preview, recording log entries for auditable events such as Git repository creations, permission changes, resource deletions, and code downloads. Each log entry includes information about who caused the event, their IP, what happened, and other relevant details. Future enhancements will include a streaming feature to send logs to SIEM tools for anomaly detection and trend visualization.