AZDO.1002: Log Audit Events.
| ID | AZDO.1002 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Auditing |
| Security area | Logging and detection |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:AU-12 Audit Record Generationnist-800-53-r5:AU-2 Event Logging |
| MITRE ATT&CK | T1685.002 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/organizations/audit/azure-devops-auditing?view=azure-devops&tabs=preview-page#enable-and-disable-auditing |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Auditing should be enabled.
Rationale: Keeping track of activities within your Azure DevOps environment is crucial for security and compliance. Auditing helps you monitor and log these activities, providing transparency and accountability.
Remediation action
Section titled “Remediation action”Enable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies under the Security header.
- Switch the Log Audit Events button to ON.
Results: Auditing is enabled for the organization. Refresh the page to see Auditing appear in the sidebar. Audit events start appearing in Auditing Logs and through any configured audit streams.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.