# External Users access

External Users access. A Maester check for Azure DevOps, Users and access.

Source: https://maester.dev/docs/tests/AZDO.1006

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Users and access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1006
```

## Overview

External guest access to Azure DevOps **should be** a controlled process.

Rationale: External guest access can introduce potential security risks if not managed properly.

#### Remediation action

Disable the "External guest access" policy to prevent external guest access if there's no business need for it.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies, locate the External guest access policy and toggle it to off.

#### Related links

* [Azure DevOps Security - Manage external guest access](https://learn.microsoft.com/azure/devops/organizations/security/security-overview?view=azure-devops#manage-external-guest-access)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1006 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Users and access |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-3, nist-800-53-r5:AC-21 |
| PowerShell test | [Test-AzdoExternalGuestAccess](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1006.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/organizations/security/security-overview?view=azure-devops#manage-external-guest-access](https://learn.microsoft.com/azure/devops/organizations/security/security-overview?view=azure-devops#manage-external-guest-access) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1006.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1006.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1006.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1006.md)