External Users access
AZDO.1006MediumAzure DevOpsUsers and accessPreview 3.0
Part of Maester · Azure DevOps · Users and access · All checks
Invoke-Maester -TestId AZDO.1006Overview
Section titled “Overview”External guest access to Azure DevOps should be a controlled process.
Rationale: External guest access can introduce potential security risks if not managed properly.
Remediation action
Section titled “Remediation action”Disable the “External guest access” policy to prevent external guest access if there’s no business need for it.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the External guest access policy and toggle it to off.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1006 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Users and access |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-3, nist-800-53-r5:AC-21 |
| PowerShell test | Test-AzdoExternalGuestAccess |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/security/security-overview?view=azure-devops#manage-external-guest-access |