Limit variables that can be set at queue time

Contributed by Sebastian ClaessonAll contributors →

Part of Maester · Azure DevOps · Pipelines · All checks

Run this check

Invoke-Maester -TestId AZDO.1015

Overview

User-defined variables should not be able to override system variables or variables not defined by the pipeline author.

Rationale: Only those variables explicitly marked as “Settable at queue time” can be set by user.

Remediation action

Enable the policy to limit variables that can be set at queue time.

1. Sign in to your organization.
2. Choose Organization settings.
3. Under the Pipelines section choose Settings.
4. In the General section, toggle on “Limit variables that can be set at queue time”.

Results: Only those variables explicitly marked as “Settable at queue time” can be set at queue time.

Related links

• Learn - Secure use of variables in a pipeline

Details

Every attribute of this check

Field	Value
Test ID	AZDO.1015
Severity	High
Suite	Maester
Product	Azure DevOps
Feature	Pipelines
Area	Engineering systems
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1677 Poisoned Pipeline Execution
Supports controls	nist-800-53-r5:SI-10
PowerShell test	Test-AzdoOrganizationLimitVariablesAtQueueTime
Services	AzureDevOps
Learn more	https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#limit-variables-that-can-be-set-at-queue-time

Source

• Test: tests/maester/azure-devops/Test.AZDO.1015.ps1
• Documentation: tests/maester/azure-devops/Test.AZDO.1015.md