Identities can connect to your organization's Git repos through SSH

Contributed by Sebastian ClaessonAll contributors →

Part of Maester · Azure DevOps · Security policies · All checks

Run this check

Invoke-Maester -TestId AZDO.1001

Overview

Connecting to Azure DevOps using SSH should be disabled.

Rationale: OAuth is the preferred and most secure authentication method.

Remediation action

Disable the policy to stop these requests and notifications.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies under the Security section.
4. Locate the “SSH authentication” policy and toggle it to off.

Results: Users can no longer use SSH to connect to Azure DevOps.

Related links

• Learn - Use SSH key authentication
• Learn - Authentication with Azure Repos

Details

Every attribute of this check

Field	Value
Test ID	AZDO.1001
Severity	High
Suite	Maester
Product	Azure DevOps
Feature	Security policies
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1552.004 Private Keys, T1098.001 Additional Cloud Credentials
PowerShell test	Test-AzdoSSHAuthentication
Services	AzureDevOps
Learn more	https://aka.ms/vstspolicyssh

Source

• Test: tests/maester/azure-devops/Test.AZDO.1001.ps1
• Documentation: tests/maester/azure-devops/Test.AZDO.1001.md