The Azure DevOps audit log records organization changes such as permission changes, deleted resources, branch policy changes, and log downloads. It keeps events for 90 days. It does not track sign-ins, and it does not log PAT access. It is off by default and in public preview.
What you get
An audit event is recorded when a user or service identity changes the state of an artifact. Each row on the Auditing page shows the actor, IP address, timestamp, area, category, and a short description. Exporting to CSV or JSON adds more fields, including the authentication mechanism, a correlation ID, and the user agent.
The correlation ID helps you follow one action that produced many events. When an event ID equals its correlation ID, it is the parent event. Creating a project, for example, can produce dozens of linked events.
Requirements and defaults
| Item | Detail |
|---|---|
| Availability | Azure DevOps Services organizations backed by Microsoft Entra ID. Not for Azure DevOps Server |
| Default | Off. Turn on Log Audit Events under Organization settings, Policies |
| Retention | 90 days, then deleted. Not configurable |
| Who can view | Project Collection Administrators, or users granted View audit log |
| Status | Public preview, per Microsoft |
What it does not cover
Microsoft lists limits you should plan around.
- Microsoft Entra group membership changes are not in this log. If you manage membership through Entra groups, check the Entra audit logs.
- Sign-in events are not tracked. Use Entra sign-in logs.
- Some users are added indirectly, for example by being assigned a work item, and the audit log does not record the trigger.
- Token access events are not currently logged. The log shows when a PAT is created, updated, revoked, or expires, but not when or whether it was used, so you cannot call a PAT stale from this log alone.
How to use it well
- Turn it on now. Events from before you enable it do not exist.
- Grant View audit log to the small group who need it, since the log itself is sensitive.
- Export or stream events if you must keep more than 90 days. See audit streaming.
- Build a short list of events to review weekly: permission changes, branch policy changes, deletions, PAT public discovery events.
- Pair it with Entra sign in logs for the identity half of any investigation.
Evidence for auditors
A change log with actor and timestamp is useful evidence for questions on who can change production controls. Be accurate about what it covers. If a reviewer asks whether you can show who used a token, the answer from this log is no, and your answer should say where that data lives instead.
Try it yourself
Open the framework mapping demo to see how evidence from a platform can be lined up against a control. Then map your audit log events to the controls you report on.
Click through it at your own pace, or open it full screen.
Quick check
Is auditing on by default?
No. It is turned off by default for all Azure DevOps Services organizations and must be enabled in organization policies.
Can I extend the 90 day retention?
Not in the product. Export the events or stream them to an external tool to keep them longer.
Safeguard compliance and evidence automation can help organize control evidence from several sources. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
