Disable Marketplace tasks

Contributed by Sebastian ClaessonAll contributors →

Part of Maester · Azure DevOps · Pipelines · All checks

Run this check

Invoke-Maester -TestId AZDO.1023

Overview

Disable the ability to install and run tasks from the Marketplace, which gives you greater control over the code that executes in a pipeline.

Rationale: Tasks from the marketplace should be reviewed and approved.

Remediation action

Enable the restriction to prevent marketplace tasks from executing in pipelines.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Settings under Pipelines.
4. Go to the section “Task restrictions” and turn on “Disable marketplace tasks”

Results: With this enabled, pipelines will not use tasks installed from the Marketplace. Jobs which depend on Marketplace tasks will fail.

Related links

• Learn - Prevent malicious code execution

Details

Every attribute of this check

Field	Value
Test ID	AZDO.1023
Severity	High
Suite	Maester
Product	Azure DevOps
Feature	Pipelines
Area	Engineering systems
Resource type	Tenant
User impact	Medium
Implementation cost	High
MITRE ATT&CK	T1195.001 Compromise Software Dependencies and Development Tools
Supports controls	nist-800-53-r5:CM-7, nist-800-53-r5:CM-11
PowerShell test	Test-AzdoOrganizationTaskRestrictionsDisableMarketplaceTask
Services	AzureDevOps
Learn more	https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#prevent-malicious-code-execution

Source

• Test: tests/maester/azure-devops/Test.AZDO.1023.ps1
• Documentation: tests/maester/azure-devops/Test.AZDO.1023.md