# Limit job authorization scope to current project for classic release pipelines

Release pipelines should have restricted access to only those repositories that are in the same project as the pipeline.

Source: https://maester.dev/docs/tests/AZDO.1017

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Pipelines · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1017
```

## Overview

Release pipelines should have restricted access to only those repositories that are in the same project as the pipeline.

Rationale: If the scope is not restricted at either the organization level or project level, then every job in your release pipeline gets a collection scoped job access token. In other words, your pipeline has access to any repository in any project of your organization. If an adversary is able to gain access to a single pipeline in a single project, they will be able to gain access to any repository in your organization. This is why it is recommended that you restrict the scope at the highest level (organization settings) in order to contain the attack to a single project.

#### Remediation action

Enable the policy to restrict the job authorization scope.

1. Sign in to your organization.
2. Choose Organization settings.
3. Under the Pipelines section choose Settings.
4. In the General section, toggle on "Limit job authorization scope to current project for release pipelines".

#### Related links

* [Learn - Job Authorization Scope](https://learn.microsoft.com/azure/devops/pipelines/process/access-tokens?view=azure-devops&tabs=yaml#job-authorization-scope)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1017 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1550.001 Application Access Token, T1213.003 Code Repositories |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | [Test-AzdoOrganizationLimitJobAuthorizationScopeReleasePipeline](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1017.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/pipelines/process/access-tokens?view=azure-devops&tabs=yaml#job-authorization-scope](https://learn.microsoft.com/azure/devops/pipelines/process/access-tokens?view=azure-devops&tabs=yaml#job-authorization-scope) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1017.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1017.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1017.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1017.md)