Two Actions That Satisfy Regulatory Audit Logging and Access Control
Your team is implementing a security and compliance plan for Azure DevOps. Which TWO actions should you take to meet regulatory requirements for audit logging and access control?
Quick Answer
Enabling the Azure DevOps audit log to capture security-relevant events, alongside configuring a Conditional Access policy requiring MFA for Azure DevOps access, are the two actions that satisfy audit logging and access control together — the audit log gives an immutable trail of who did what, and MFA raises the bar on unauthorized access.
⚠ Common exam trap
Microsoft often tests the misconception that enabling anonymous access or simplifying permissions (like granting admin roles to all users) is acceptable for compliance, when in fact these actions directly violate audit logging and access control requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure DevOps audit log to track changes to security policies and user permissions.
Enabling the Azure DevOps audit log (option B) is essential for regulatory compliance because it records changes to security policies, user permissions, and other critical events, providing an immutable trail for forensic analysis and reporting. This directly meets audit logging requirements by capturing who did what and when, which is necessary for standards like SOC 2, ISO 27001, or GDPR.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable anonymous access to project boards for external stakeholders.
Why it's wrong here
Anonymous access is a security risk.
- ✓
Enable Azure DevOps audit log to track changes to security policies and user permissions.
Why this is correct
Audit logs are essential for compliance tracking.
- ✓
Configure Azure AD Conditional Access policy to require multi-factor authentication for Azure DevOps.
Why this is correct
MFA is a standard security control.
- ✗
Grant all users Project Collection Administrator role to simplify access management.
Why it's wrong here
Excessive privileges reduce security.
- ✗
Disable auditing for the project to reduce log volume.
Why it's wrong here
Disabling auditing violates compliance requirements.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
About these practice questions
This AZ-400 question is part of Courseiva's 823-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-400
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO practices should you follow to ensure compliance with regulatory requirements (e.g., PCI DSS) when using Azure DevOps? (Choose two.)
easy- A.Manually track changes to pipelines in a spreadsheet.
- B.Allow all users to create and modify pipelines without restrictions.
- ✓ C.Enable Azure DevOps audit logging to track changes to pipelines and policies.
- D.Disable audit logging to reduce storage costs.
- ✓ E.Use branch policies to enforce code reviews and approvals for all changes.
Why C: Azure DevOps audit logging captures a detailed, immutable record of changes to pipelines, policies, and other critical resources, which is essential for demonstrating compliance with frameworks like PCI DSS that require evidence of who made what change and when. Audit logs can be exported to SIEM tools or retained for forensic analysis, satisfying the 'audit trail' requirement without manual intervention. Additionally, using branch policies enforces mandatory code reviews and approvals for changes, ensuring that all modifications go through a controlled, auditable process. Together, these practices provide both the immutable audit trail and the controlled change management required for regulatory compliance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.