Azure DevOps audit streams send events to Splunk, Azure Monitor Logs, or Azure Event Grid, bundled every half hour or less. You can have two streams per target type. A disabled stream catches up on up to seven days of missed events. Streaming lets you keep more than the built-in 90 days.
Why stream at all
The audit log keeps events for 90 days, after which they are deleted. That is too short for many review cycles and for slow moving investigations. A stream turns the audit log into a feed for a SIEM or log store, where you can alert on specific events, build views, and keep data as long as your policy says.
Targets compared
| Target | Good for | Notes from Microsoft |
|---|---|---|
| Splunk | Teams already on Splunk, cloud or on premises | Uses the HTTP Event Collector. Do not enable indexer acknowledgment on the token or no events arrive. Default port is 8088 |
| Azure Monitor Logs | Query and alerting in Azure, with Microsoft Sentinel connected | Events land in the AzureDevOpsAuditing table. Default retention is 30 days unless you raise it, which costs more |
| Azure Event Grid | Sending events anywhere inside or outside Azure | Event schema must be Event Grid Schema |
Private linked workspaces are not supported. Auditing is not available for on premises Azure DevOps Server, but an Azure DevOps Services stream can reach an on premises Splunk if you allow the inbound IP ranges.
Setting one up
- Confirm auditing is enabled and your organization is backed by Microsoft Entra ID.
- Make sure you are a Project Collection Administrator, or hold Manage audit streams and View audit log.
- Prepare the target. For Splunk, create the HTTP Event Collector token. For Azure Monitor, create a Log Analytics workspace and note its resource ID and your tenant ID. For Event Grid, create a topic and copy the endpoint and an access key.
- In Organization settings, open Auditing, then Streams, then New stream, and enter the details.
- Wait up to half an hour and check that events arrive.
Operating it
- Tokens and keys are stored securely and never shown again. Microsoft recommends rotating them regularly by getting a new one from the target and editing the stream.
- Streams can become disabled after a failure. The status beside the stream explains why, so alert on a disabled stream.
- If a stream is disabled for more than seven days, events older than seven days are not included when it is re-enabled.
- Deleting a stream is permanent, and unsent events are not delivered.
What to alert on first
Start small. Useful first alerts are permission changes on repositories and service connections, branch policy changes, deletions of repositories or pipelines, and PAT public discovery events. Remember that the log does not include sign-ins or PAT use, so combine it with Entra logs.
Try it yourself
Click through the continuous monitoring demo to see how ongoing signals are watched and surfaced. Think of the audit stream as the same idea applied to platform changes.
Click through it at your own pace, or open it full screen.
Quick check
How many streams can I create per target?
Microsoft says you can have two streams for each target type.
Does streaming include past events?
A stream carries new events. A re-enabled stream catches up on missed events for up to the previous seven days.
Safeguard continuous monitoring watches your software and dependencies for new risk, and you can try a free scan at gold.safeguard.sh/scan.
Sources
- Create audit streaming for Azure DevOps, Microsoft Learn
- Access, export, and filter audit logs, Microsoft Learn
Last reviewed: 19 October 2026.
