Azure DevOps Auditing
Solution: AzureDevOpsAuditing
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
| Attribute | Value |
|---|---|
| Publisher | Microsoft Corporation |
| Support Tier | Microsoft |
| Support Link | https://support.microsoft.com/ |
| Categories | domains |
| Version | 3.0.8 |
| Author | Microsoft - support@microsoft.com |
| First Published | 2022-09-20 |
| Last Updated | 2026-02-17 |
| Solution Folder | AzureDevOpsAuditing |
| Marketplace | Azure Marketplace · Popularity: 🟢 High (88%) |
The Azure DevOps Auditing solution for Microsoft Sentinel allows monitoring Azure DevOps audit events to enable detection of malicious and/or unauthorized access and modification in the repository or pipelines.
NOTE: Microsoft recommends installation of Azure DevOps Audit Logs (Preview) (via Codeless Connector Platform). This connector is build on the Codeless Connector Platform (CCP), which uses the Log Ingestion API, which replaces ingestion via the deprecated HTTP Data Collector API. CCP-based data connectors also support Data Collection Rules (DCRs) offering transformations and enrichment.
Contents
Data Connectors
This solution provides 1 data connector(s):
Tables Used
This solution uses 2 table(s):
| Table | Used By Connectors | Used By Content |
|---|---|---|
ADOAuditLogs_CL |
Azure DevOps Audit Logs (via Codeless Connector Platform) | Analytics, Hunting |
AzureDevOpsAuditing |
- | Analytics, Hunting |
Internal Tables
The following 1 table(s) are used internally by this solution's content items:
| Table | Used By Connectors | Used By Content |
|---|---|---|
SecurityAlert |
- | Analytics, Hunting |
Content Items
This solution includes 37 content item(s):
| Content Type | Count |
|---|---|
| Analytic Rules | 19 |
| Hunting Queries | 17 |
| Parsers | 1 |
Analytic Rules
Hunting Queries
Parsers
| Name | Description | Tables Used |
|---|---|---|
| ADOAuditLogs |
Release Notes
| Version | Date Modified (DD-MM-YYYY) | Change History |
|---|---|---|
| 3.0.8 | 26-01-2026 | Updated Data Connector to support dynamic Redirect URI |
| 3.0.7 | 22-01-2026 | Updated solution description by eliminating legacy streaming text |
| 3.0.6 | 19-06-2025 | Updated Data Connector instructions to include a note about User permissions. |
| 3.0.5 | 05-05-2025 | Updated Data Connector instructions. |
| 3.0.4 | 15-04-2025 | Added new CCP Connector - Azure DevOps Audit Logs. |
| 3.0.3 | 16-07-2024 | Updated the Analytic rules for missing TTP. |
| 3.0.2 | 23-01-2024 | Updated the solution to fix Analytic Rules deployment issue. |
| 3.0.1 | 27-11-2023 | Added new Entity Mappings to Analytic Rules. |
| 3.0.0 | 06-11-2023 | Modified text as there is rebranding from Azure Active Directory to Microsoft Entra ID. |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊