Azure DevOps - Organization Policy - Allow Public Projects
Azure Dev Ops Allow Public Projects
Query
AzureDevOpsAuditing
| where OperationName == "OrganizationPolicy.PolicyValueUpdated"
| extend PolicyName = tostring(Data.PolicyName)
| extend PolicyValue = tostring(Data.PolicyValue)
| where PolicyValue == "ON"
| where PolicyName == "Policy.AllowAnonymousAccess"
| project TimeGenerated, ActorUPN, IpAddress, PolicyName, PolicyValue, ScopeDisplayNameAbout this query
Explanation
This KQL query is designed to monitor Azure DevOps for changes in organization policy settings, specifically focusing on when the "Allow Public Projects" option is enabled. Here's a simple breakdown of what the query does:
-
Data Source: It looks at the
AzureDevOpsAuditingtable, which logs various operations and changes within Azure DevOps. -
Filter Operation: The query filters for operations where the policy value has been updated, specifically looking for the operation named "OrganizationPolicy.PolicyValueUpdated".
-
Extract Policy Details: It extracts the policy name and value from the data, converting them to string format for easier handling.
-
Check for Public Access: The query specifically checks if the policy value is set to "ON" for the policy named "Policy.AllowAnonymousAccess". This indicates that the option to allow public projects is enabled.
-
Select Relevant Information: Finally, it projects (selects) relevant information such as the time the change was made (
TimeGenerated), the user who made the change (ActorUPN), their IP address (IpAddress), the policy name, the policy value, and the scope or context in which the change was made (ScopeDisplayName).
In summary, this query helps identify when the setting to allow public access to projects in Azure DevOps is turned on, which could be a security concern if not intended.
