DevOps Audit Log how can I filter/select by specific field

Marinela Boksan 1 Reputation point
2022-12-08T14:38:36.923+00:00

Hello,

I am trying to get Audit log for DevOps, most intressted when users are added/deleted as group members. How can I filter/select only that type of action/area in my request directly? I don't wanna get bunch of audit logs that i've tryied to accessed the logs.
For example I need only area as group or by actionId ( Group.UpdateGroupMembership. Add or Removed)

Thank you in advance.

Not Monitored
Not Monitored
Tag not monitored by Microsoft.
35,965 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Hamza Léon BOUKRAA 1 Reputation point
    2022-12-08T14:56:26.753+00:00

    Hello,

    You can try the specific action https://audit service.dev.azure.com/<YourOrganization/_apis/audit/Group.UpdateGroupMembership
    Or
    https://audit service.dev.azure.com/<YourOrganization/_apis/audit/Group.UpdateGroupMembership.Add
    Or
    https://audit service.dev.azure.com/<YourOrganization/_apis/audit/Group.UpdateGroupMembership.Remove

  2. Ravi Kanth Koppala 3,231 Reputation points Microsoft Employee
    2022-12-20T03:53:46.193+00:00

    @Marinela Boksan ,
    To filter the audit logs in Azure DevOps to show only the actions related to adding or deleting group members, you can use the area and actionId fields in your request.

    Here is an example of how you can use these fields in a REST API request: 

    GET https://dev.azure.com/{organization}/{project}/_apis/audit/events?api-version=6.1-preview.3  
&area=Group  
&actionId=Group.UpdateGroupMembership.Add,Group.UpdateGroupMembership.Remove

    This request will retrieve only the audit events related to the Group area and have an actionId of Group.UpdateGroupMembership.Add or Group.UpdateGroupMembership.Remove.

    You can also use the Azure DevOps web interface to filter the audit logs. To do this, go to the "Audit logs" page in the project settings, and use the filters on the page to select the Group area and the Add or Remove action.

    Keep in mind that the audit logs in Azure DevOps are retained for a limited time (90 days by default), so you may not be able to retrieve all the events you are interested in if they occurred more than 90 days ago. You can change the retention period for the audit logs in the project settings.

    ----------

    Please "Accept as Answer" and Upvote if any of the above helped so that it can help others in the community looking for remediation for similar issues.

    0 comments
  3. عبدالودود احمد محمد قطب الحجري 1 Reputation point
    2022-12-20T05:32:31.47+00:00

    service.dev.azure.com/<YourOrganization/_apis/audit/Group.UpdateGroupMembership

    0 comments