# Anonymous access to pipeline badges

Anonymous access to pipeline badges. A Maester check for Azure DevOps, Pipelines.

Source: https://maester.dev/docs/tests/AZDO.1014

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Pipelines · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1014
```

## Overview

Status badges in Azure DevOps **should be** disabled.

Rationale: Even in a private project, anonymous badge access is enabled by default. With anonymous badge access enabled, users outside your organization might be able to query information such as project names, branch names, job names, and build status through the badge status API.

#### Remediation action

Enable the restriction to prevent anonymous access to status badges.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Settings under Pipelines.
4. Enable the policy "Disable anonymous access to badges"

**Results:**
Users outside of your organization cannot query information regarding your project names, branch names, job names, and build statuses through the badge status API.

#### Related links

* [Learn - Status badges](https://learn.microsoft.com/azure/devops/pipelines/create-first-pipeline?view=azure-devops&tabs=net%2Cbrowser#add-a-status-badge-to-your-repository)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1014 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1593.003 Code Repositories |
| PowerShell test | [Test-AzdoOrganizationBadgesArePrivate](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1014.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/pipelines/create-first-pipeline?view=azure-devops&tabs=net%2Cbrowser#add-a-status-badge-to-your-repository](https://learn.microsoft.com/azure/devops/pipelines/create-first-pipeline?view=azure-devops&tabs=net%2Cbrowser#add-a-status-badge-to-your-repository) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1014.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1014.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1014.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1014.md)