AZDO.1034 - (Tenant) Restrict creation of new Azure DevOps organizations.
Overview
Restrict creation of new Azure DevOps organizations should be enabled.
Prerequisites
- You must have the Azure DevOps Administrator role in your Microsoft Entra tenant.
Rationale
Limiting who can create organizations helps maintain governance, control, and compliance across an enterprise Azure DevOps environment.
Remediation action
Enable the tenant policy to restrict organization creation.
- Sign in to your organization (
https://dev.azure.com/{Your_Organization}). - Select Organization settings (gear icon).
- Select Microsoft Entra ID, and move the toggle to On to restrict organization creation.
Allowlist and exceptions
- After enabling the policy, add Microsoft Entra users or groups to the allowlist to permit them to create organizations.
- Use groups for allowlists to avoid identity residency concerns.
Results:
When enabled, only users on the allowlist (or Azure DevOps Administrators as permitted) can create new organizations.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1034 |
| Severity | High |
| Suite | Maester |
| Category | Azure DevOps |
| PowerShell test | Test-AzdoOrganizationCreationRestriction |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/azure-ad-tenant-policy-restrict-org-creation?view=azure-devops#turn-on-the-policy |
| Tags | AZDO, AZDO.1034 |
Source
- Test:
tests/Maester/AzureDevOps/Test.AZDO.1034.ps1 - Documentation:
tests/Maester/AzureDevOps/Test.AZDO.1034.md