# Azure DevOps OAuth apps can access resources in your organization through OAuth

Azure DevOps OAuth apps can access resources in your organization through OAuth. A Maester check for Azure DevOps, Security policies.

Source: https://maester.dev/docs/tests/AZDO.1000

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Security policies · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1000
```

## Overview

Third-party application access via OAuth should be disabled.

Rationale: Third-party application access should not be used for Azure DevOps.

#### Remediation action

Disable the policy to stop these requests and notifications.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies, locate the Third-party application access via Oauth policy and toggle it to off.

**Results:**
With the policy disabled, third-party applications can no longer access your Azure DevOps organization via OAuth. Any application that previously relied on OAuth access will encounter authentication errors and lose access. This does not affect Microsoft Entra ID OAuth app access.

#### Related links

* [Learn - Change application connection & security policies for your organization](https://aka.ms/vstspolicyoauth)
* [Learn - Use Azure DevOps OAuth 2.0 to create a web app](https://learn.microsoft.com/azure/devops/integrate/get-started/authentication/azure-devops-oauth?view=azure-devops)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1000 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1671 Cloud Application Integration |
| PowerShell test | [Test-AzdoThirdPartyAccessViaOauth](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1000.ps1) |
| Services | AzureDevOps |
| Learn more | [https://aka.ms/vstspolicyoauth](https://aka.ms/vstspolicyoauth) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1000.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1000.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1000.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1000.md)