azure-devopsaudit-loggingazure-devops-services

How to see who deleted a project in Azure DevOps

One of projects in Azure DevOps has been deleted (actually partially - repositories, pipelines, permissions were removed, but the project still exists). I have turned on Audit Logs and found below row, that initialized the removal:

Timestamp: <i>(removed)</i>
Id: <i>(removed)</i>
CorrelationId: <i>(removed)</i>
ActivityId: <i>(removed)</i>
ActorCUID: 00000000-0000-0000-0000-000000000000
ActorUserId: 00000002-0000-8888-8000-000000000000
ActorClientId: 00000000-0000-0000-0000-000000000000
ActorUPN: Azure DevOps Service
AuthenticationMechanism: 
ScopeType: Organization
ScopeDisplayName: <i>(removed)</i>
ScopeId: <i>(removed)</i>
ProjectId: <i>(removed)</i>
ProjectName: 
IpAddress: 
UserAgent: TFS JobAgent(TfsJobAgent.exe, 19.242.35214.3)
ActionId: Project.HardDeleteQueued
Data: {"PreviousProjectName":"<i>(removed)</i>"}
Details: <i>(removed)</i> project deletion was started
Area: Project
Category: Remove
CategoryDisplayName: Remove
ActorDisplayName: Azure DevOps Service

How to discover who deleted the project? How do I know who triggered the Azure DevOps Service, which then triggered the deletion?

Thank you in advance for any hints.

Solution

  • In Azure DevOps, the Audit log not only records the operations of Organization users, but also records the operations of background services (Actor is usually displayed as Azure DevOps Service).

    From the audit log you shared, it shows the action: Project.HardDeleteQueued. Soft deletion of a project is performed by Organization users, but hard deletion is performed automatically by the background service 28 days after the soft deletion by default. So it shows that the actor is Azure DevOps Service.

    How to discover who deleted the project? How do I know who triggered the Azure DevOps Service, which then triggered the deletion?

    To discover who deleted the project, you can search for the action: Project.SoftDeleteQueued with the target project name in the Audit log(Especially the records of the 28 days before Project hard delete).

    For example:

    enter image description here

    The user who executes the project softdelete operation is the actual user who deletes the project.

    The operation that triggers the hard deletion of a project in azure devops services is automatically done after 28 days. Therefore, we cannot see the organization user who triggered it in the audit log.

    For more detailed info, you can refer to this doc: Access, export, and filter audit logs

    Audit changes occur whenever a user or service identity within the organization edits the state of an artifact.