Organization Owner should not be an individual
AZDO.1013HighAzure DevOpsUsers and accessPreview 3.0
Part of Maester · Azure DevOps · Users and access · All checks
Invoke-Maester -TestId AZDO.1013Overview
Section titled “Overview”Azure DevOps organization owner should not be assigned to a regular user.
Rationale: Owner has full administrative control over the organization, including the ability to manage users, projects, and settings. They can also configure security policies, access levels, and billing information. Ensure that the owner is aware of their responsibilities and has the necessary permissions to effectively manage the organization.
This query will check if the owner has any of the following words as part of their name to conclude that it is not a regular user: (adm|admin|btg|svc|service)
Remediation action
Section titled “Remediation action”Ensure that the owner is not a regular user.
- Sign in to your organization.
- Choose Organization settings.
- Select Overview > Change owner.
- Select an identity from the dropdown menu, or search for an identity by entering the identity’s name, and then select Change.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1013 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Users and access |
| Area | Privileged access |
| Resource type | User |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| PowerShell test | Test-AzdoOrganizationOwner |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/change-organization-ownership?view=azure-devops |