# Identities can connect to your organization's Git repos through SSH

Identities can connect to your organization's Git repos through SSH. A Maester check for Azure DevOps, Security policies.

Source: https://maester.dev/docs/tests/AZDO.1001

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Security policies · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1001
```

## Overview

Connecting to Azure DevOps using SSH should be disabled.

Rationale: OAuth is the preferred and most secure authentication method.

#### Remediation action

Disable the policy to stop these requests and notifications.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies under the Security section.
4. Locate the "SSH authentication" policy and toggle it to off.

**Results:**
Users can no longer use SSH to connect to Azure DevOps.

#### Related links

* [Learn - Use SSH key authentication](https://aka.ms/vstspolicyssh)
* [Learn - Authentication with Azure Repos](https://learn.microsoft.com/azure/devops/repos/git/auth-overview?view=azure-devops&source=recommendations&tabs=Windows)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1001 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1552.004 Private Keys, T1098.001 Additional Cloud Credentials |
| PowerShell test | [Test-AzdoSSHAuthentication](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1001.ps1) |
| Services | AzureDevOps |
| Learn more | [https://aka.ms/vstspolicyssh](https://aka.ms/vstspolicyssh) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1001.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1001.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1001.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1001.md)