AZDO.1015 - Limit variables that can be set at queue time.

Contributed by Sebastian ClaessonAll contributors →

Overview

User-defined variables should not be able to override system variables or variables not defined by the pipeline author.

Rationale: Only those variables explicitly marked as "Settable at queue time" can be set by user.

Remediation action

Enable the policy to limit variables that can be set at queue time.

1. Sign in to your organization.
2. Choose Organization settings.
3. Under the Pipelines section choose Settings.
4. In the General section, toggle on "Limit variables that can be set at queue time".

Results: Only those variables explicitly marked as "Settable at queue time" can be set at queue time.

Related links

• Learn - Secure use of variables in a pipeline

Test Metadata

Field	Value
Test ID	AZDO.1015
Severity	High
Suite	Maester
Category	Azure DevOps
PowerShell test	Test-AzdoOrganizationLimitVariablesAtQueueTime
Services	AzureDevOps
Learn more	https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#limit-variables-that-can-be-set-at-queue-time
Tags	AZDO, AZDO.1015

Source

• Test: tests/Maester/AzureDevOps/Test.AZDO.1015.ps1
• Documentation: tests/Maester/AzureDevOps/Test.AZDO.1015.md