Skip to content
MitoMito Docs

AZDO.1010: Audit streaming.
ID AZDO.1010
Severity High
Suite Mito
Product Azure DevOps
Feature Auditing
Security area Logging and detection
Resource type Tenant
User impact of fixing Low
Effort to fix Medium
Framework controls nist-800-53-r5:AU-6 Audit Record Review, Analysis, and Reporting
nist-800-53-r5:SI-4 System Monitoring
MITRE ATT&CK T1685.002, T1070
Reads from Azure DevOps
Further reading https://learn.microsoft.com/azure/devops/organizations/audit/auditing-streaming?view=azure-devops

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Audit logs should be retained according to your organization’s needs and protected from purging.

Rationale: Send auditing data to other Security Incident and Event Management (SIEM) tools and open new possibilities, such as the ability to trigger alerts for specific events, create views on auditing data, and perform anomaly detection. Setting up a stream also allows you to store more than 90-days of auditing data, which is the maximum amount of data that Azure DevOps keeps for your organizations.

Remediation action

Section titled “Remediation action”

Create an audit stream, which sends data to other locations for further processing.

  1. Sign in to your organization.
  2. Choose Organization settings.
  3. Select Auditing.

If you don’t see Auditing in Organization Settings, then auditing is not currently enabled for your organization. Someone in the organization owner or Project Collection Administrators (PCAs) group must enable Auditing in Organization Policies. You will then be able to see events on the Auditing page if you have the appropriate permissions.

  1. Go to the Streams tab, and then select New stream.
  2. Select the stream target that you want to configure, and then select from the following instructions to set up your stream target type.
    1. Splunk
    2. Event Grid
    3. Azure Monitor Log

Results: Audit streams represent a pipeline that flows audit events from your Azure DevOps organization to a stream target. At least every half hour, new audit events are bundled and streamed to your targets.

Section titled “Related links”

Mito check. Author: SebastianClaesson. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.