Microsoft implements this Configuration Management control
Name/Id: ACF1189 / Microsoft Managed Control 1189 Category: Configuration Management Title: Configuration Change Control - Audit Ownership: Customer, Microsoft Description: The organization: Audits and reviews activities associated with configuration-controlled changes to the information system; and Requirements: The tools outlined in Part c of this control provide an auditing capability to any changes to the configuration baselines or configuration settings within the tools. Azure uses Azure DevOps as the versioning system for software code, which tracks the identity of the person who checks code out, the time of the change, and what changes are made to what files. Software and hardware changes are tracked through Azure DevOps or IcM, which also provide detailed audit records of action taken. Deployment systems including OneBranch also audit and centrally report actions taken.
Rule resource types
IF (2) Microsoft.Resources/subscriptions Microsoft.Resources/subscriptions/resourceGroups