# Limit variables that can be set at queue time

User-defined variables should not be able to override system variables or variables not defined by the pipeline author.

Source: https://maester.dev/docs/tests/AZDO.1015

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Pipelines · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1015
```

## Overview

User-defined variables should not be able to override system variables or variables not defined by the pipeline author.

Rationale: Only those variables explicitly marked as "Settable at queue time" can be set by user.

#### Remediation action

Enable the policy to limit variables that can be set at queue time.

1. Sign in to your organization.
2. Choose Organization settings.
3. Under the Pipelines section choose Settings.
4. In the General section, toggle on "Limit variables that can be set at queue time".

**Results:**
Only those variables explicitly marked as "Settable at queue time" can be set at queue time.

#### Related links

* [Learn - Secure use of variables in a pipeline](https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#limit-variables-that-can-be-set-at-queue-time)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1015 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1677 Poisoned Pipeline Execution |
| Supports controls | nist-800-53-r5:SI-10 |
| PowerShell test | [Test-AzdoOrganizationLimitVariablesAtQueueTime](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1015.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#limit-variables-that-can-be-set-at-queue-time](https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#limit-variables-that-can-be-set-at-queue-time) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1015.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1015.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1015.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1015.md)