AZDO.1037 - (Organization) Restrict Personal Access Token creation.

Contributed by Sebastian ClaessonAll contributors →

Overview

Personal Access Token creation should be restricted at the organization level.

Rationale: Restricting PAT creation reduces the risk of long-lived credentials being used to access your Azure DevOps organization. Existing personal access tokens remain valid until expiration when the policy is enabled.

Remediation action

Enable the policy to restrict Personal Access Token creation.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies, locate the "Restrict personal access token (PAT) creation" policy and toggle it to on.

Results: With the policy enabled, users cannot create new Personal Access Tokens unless explicitly allowed through the allow list.

Related links

• Learn - Manage PATs with policies for administrators

Test Metadata

Field	Value
Test ID	AZDO.1037
Severity	High
Suite	Maester
Category	Azure DevOps
PowerShell test	Test-AzdoDisablePATCreation
Services	AzureDevOps
Learn more	https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops
Tags	AZDO, AZDO.1037

Source

• Test: tests/Maester/AzureDevOps/Test.AZDO.1037.ps1
• Documentation: tests/Maester/AzureDevOps/Test.AZDO.1037.md