# Request access to Azure DevOps by e-mail notifications to administrators

Request access to Azure DevOps by e-mail notifications to administrators should be disabled.

Source: https://maester.dev/docs/tests/AZDO.1008

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Users and access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1008
```

## Overview

Request access to Azure DevOps by e-mail notifications to administrators **should be** disabled.

Rationale: Access control to Azure DevOps is to be a controlled process where access is granted and tracked.

#### Remediation action:
Disable the policy to stop these requests and notifications.
1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies, locate the Request Access policy and toggle it to off.
4. Provide the URL to your internal process for gaining access. Users see this URL in the error report when they try to access the organization or a project within the organization that they don't have permission to access.

**Results:**
When users try to access a project without the required permissions, the error message includes the request access URL. This link is shown on the error page to maintain confidentiality, regardless of whether the project exists.

#### Related links

* [Azure DevOps Security - Disable your organization's Request Access policy](https://go.microsoft.com/fwlink/?linkid=2113172)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1008 |
| Severity | Low |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Users and access |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtCheckAZDO1008](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1008.ps1) |
| Services | AzureDevOps |
| Learn more | [https://go.microsoft.com/fwlink/?linkid=2113172](https://go.microsoft.com/fwlink/?linkid=2113172) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1008.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1008.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1008.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1008.md)