Azure DevOps OAuth apps can access resources in your organization through OAuth

Contributed by Sebastian ClaessonAll contributors →

Part of Maester · Azure DevOps · Security policies · All checks

Run this check

Invoke-Maester -TestId AZDO.1000

Overview

Third-party application access via OAuth should be disabled.

Rationale: Third-party application access should not be used for Azure DevOps.

Remediation action

Disable the policy to stop these requests and notifications.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies, locate the Third-party application access via Oauth policy and toggle it to off.

Results: With the policy disabled, third-party applications can no longer access your Azure DevOps organization via OAuth. Any application that previously relied on OAuth access will encounter authentication errors and lose access. This does not affect Microsoft Entra ID OAuth app access.

Related links

• Learn - Change application connection & security policies for your organization
• Learn - Use Azure DevOps OAuth 2.0 to create a web app

Details

Every attribute of this check

Field	Value
Test ID	AZDO.1000
Severity	High
Suite	Maester
Product	Azure DevOps
Feature	Security policies
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1528 Steal Application Access Token, T1671 Cloud Application Integration
PowerShell test	Test-AzdoThirdPartyAccessViaOauth
Services	AzureDevOps
Learn more	https://aka.ms/vstspolicyoauth

Source

• Test: tests/maester/azure-devops/Test.AZDO.1000.ps1
• Documentation: tests/maester/azure-devops/Test.AZDO.1000.md