Develop a security and compliance plan →mediumMultiple ChoiceObjective-mapped

Retaining Pipeline Audit Logs for a Full Year to Satisfy SOC 2

Your organization must comply with SOC 2 requirements. You are using Azure DevOps and need to ensure that all pipeline runs are logged and that logs are retained for at least one year. Which configuration should you implement?

Quick Answer

Streaming Azure DevOps audit events to a Log Analytics workspace and setting a 365-day retention policy is what actually satisfies SOC 2 here — pipeline-level artifact and log retention settings don't cover audit events at all, so audit streaming with an explicit retention window is the piece that closes the compliance gap.

⚠ Common exam trap

Many exam-takers confuse pipeline log retention (Option A) with audit log retention, not realizing that SOC 2 compliance requires immutable audit trails of all pipeline executions, not just the output logs of a build.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable audit streaming to a Log Analytics workspace and set retention to 365 days.

SOC 2 requires audit logging and retention of pipeline execution history for at least one year. Azure DevOps audit streaming sends all audit events (including pipeline runs) to a Log Analytics workspace, where you can set a retention policy of 365 days. This satisfies both the logging and retention requirements without relying on pipeline-level retention settings that only cover build artifacts and logs, not audit events.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Increase the retention period of pipeline logs in the Azure DevOps UI.
Why it's wrong here
The maximum retention in UI is limited and may not meet one year.
✗
Configure diagnostic settings for the Azure DevOps organization.
Why it's wrong here
Diagnostic settings are for Azure resources, not Azure DevOps audit logs.
✗
Disable the option to delete pipelines.
Why it's wrong here
This prevents deletion but does not ensure log retention.
✓
Enable audit streaming to a Log Analytics workspace and set retention to 365 days.
Why this is correct
Audit streaming allows long-term retention and compliance.

Go deeper

2 more ways this is tested on AZ-400

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Your organization uses Azure DevOps with multiple teams. You are tasked with creating a security and compliance plan. The environment includes: Azure Repos for source control, Azure Pipelines for CI/CD, and Azure Artifacts for package management. Requirements: 1) All code changes to the main branch must be reviewed by at least one member of the security team. 2) Deployment to production requires approval from a manager. 3) Secrets must be stored securely and rotated every 90 days. 4) Pipeline logs must be retained for 1 year for audit purposes. You have configured branch policies requiring a minimum number of reviewers and mandatory security team review. For production deployments, you have added a manual approval gate. Secrets are stored in Azure Key Vault with automatic rotation. However, the audit team reports that pipeline logs are only retained for 30 days. You need to extend log retention to 1 year. What should you do?

hard

A.Export pipeline logs to Azure Blob Storage and set a lifecycle policy to retain for 365 days.
B.Configure diagnostic settings in Azure Monitor to stream pipeline logs to a Log Analytics workspace.
✓ C.In Azure DevOps project settings, navigate to Pipelines > Retention and releases, and set the retention policy to 365 days.
D.Enable Azure DevOps audit logs and export them to a Log Analytics workspace with a 365-day retention.

Why C: In Azure DevOps, pipeline retention policies for runs are configured at the project level under Project Settings > Pipelines > Retention and releases. Setting the retention to 365 days will keep pipeline run records and logs for one year. Option A is incorrect because exporting pipeline logs to Azure Blob Storage is not a built-in feature; pipeline logs are retained according to DevOps retention policies. Option B is incorrect because diagnostic settings in Azure Monitor stream Azure resource logs, not Azure DevOps pipeline logs. Option D is incorrect because audit logs capture events like changes to policies, not pipeline execution logs, and they have separate retention settings.

Variation 2. Your team uses Azure Pipelines and needs to comply with SOC 2 requirements. Which TWO features should you use to meet audit log requirements? (Select TWO.)

easy

A.Configure network security groups to block public access
B.Automate secret rotation for service connections
✓ C.Enable Azure DevOps audit logging
D.Create service principals for pipeline authentication
✓ E.Stream audit logs to Azure Monitor Log Analytics

Why C: Azure DevOps audit logging (Option C) captures a detailed, immutable record of events such as pipeline runs, permission changes, and access attempts, which is essential for SOC 2 audit log requirements. Streaming these logs to Azure Monitor Log Analytics (Option E) enables long-term retention, advanced querying, and alerting, satisfying the need for secure log storage and monitoring.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.

Retaining Pipeline Audit Logs for a Full Year to Satisfy SOC 2

Why each option matters

Option-by-option breakdown

Related to this question

2 more ways this is tested on AZ-400