(Tenant) Restrict creation of new Azure DevOps organizations
AZDO.1034MediumAzure DevOpsOrganization policiesPreview 3.0
Part of Maester · Azure DevOps · Organization policies · All checks
Invoke-Maester -TestId AZDO.1034Overview
Section titled “Overview”Restrict creation of new Azure DevOps organizations should be enabled.
Prerequisites
Section titled “Prerequisites”- You must have the Azure DevOps Administrator role in your Microsoft Entra tenant.
Rationale
Section titled “Rationale”Limiting who can create organizations helps maintain governance, control, and compliance across an enterprise Azure DevOps environment.
Remediation action
Section titled “Remediation action”Enable the tenant policy to restrict organization creation.
- Sign in to your organization (
https://dev.azure.com/{Your_Organization}). - Select Organization settings (gear icon).
- Select Microsoft Entra ID, and move the toggle to On to restrict organization creation.
Allowlist and exceptions
Section titled “Allowlist and exceptions”- After enabling the policy, add Microsoft Entra users or groups to the allowlist to permit them to create organizations.
- Use groups for allowlists to avoid identity residency concerns.
Results:
When enabled, only users on the allowlist (or Azure DevOps Administrators as permitted) can create new organizations.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1034 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Organization policies |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| PowerShell test | Test-AzdoOrganizationCreationRestriction |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/azure-ad-tenant-policy-restrict-org-creation?view=azure-devops#turn-on-the-policy |