# Protect access to repositories in YAML pipelines

Access to repositories in YAML pipelines should apply checks and approval before granting access.

Source: https://maester.dev/docs/tests/AZDO.1018

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Pipelines · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1018
```

## Overview

Access to repositories in YAML pipelines should apply checks and approval before granting access.

Rationale: To enhance security, consider separating your projects, using branch policies, and adding more security measures for forks. Minimize the scope of service connections and use the most secure authentication methods.

#### Remediation action

Enable the policy to apply checks and approvals.

1. Sign in to your organization.
2. Choose Organization settings.
3. Under the Pipelines section choose Settings.
4. In the General section, toggle on "Protect access to repositories in YAML pipelines".

**Results:**
Apply checks and approvals when accessing repositories from YAML pipelines. Also, generate a job access token that is scoped to repositories that are explicitly referenced in the YAML pipeline.

#### Related links

* [Learn - Restrict project, repository, and service connection access](https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#restrict-project-repository-and-service-connection-access)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1018 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1550.001 Application Access Token, T1213.003 Code Repositories |
| Supports controls | nist-800-53-r5:AC-3, nist-800-53-r5:AC-6 |
| PowerShell test | [Test-AzdoOrganizationProtectAccessToRepository](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1018.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#restrict-project-repository-and-service-connection-access](https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#restrict-project-repository-and-service-connection-access) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1018.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1018.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1018.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1018.md)