AZDO.1033 - (Tenant) Enable automatic revocation of leaked Personal Access Tokens.
Overview
Automatic revocation of leaked Personal Access Tokens should be enabled.
Prerequisites
- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.
Rationale
Automatically revoking PATs detected as leaked minimizes the window of opportunity for unauthorized access. Disabling this policy leaves exposed tokens active even if they appear in public repositories.
Remediation action
Enable the tenant policy to revoke leaked tokens.
- Sign in to your organization (
https://dev.azure.com/{yourorganization}). - Select Organization settings (gear icon).
- Select Microsoft Entra, locate the "Automatically revoke leaked personal access tokens" policy.
- Move the toggle to On.
Results:
When enabled, Azure DevOps will automatically revoke any PATs detected as leaked or exposed. If the policy is later disabled, tokens checked into public GitHub repositories remain active.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1033 |
| Severity | Critical |
| Suite | Maester |
| Category | Azure DevOps |
| PowerShell test | Test-AzdoEnableLeakedPersonalAccessTokenAutoRevocation |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#automatic-revocation-of-leaked-tokens |
| Tags | AZDO, AZDO.1033 |
Source
- Test:
tests/Maester/AzureDevOps/Test.AZDO.1033.ps1 - Documentation:
tests/Maester/AzureDevOps/Test.AZDO.1033.md