# Disable Marketplace tasks

Disable the ability to install and run tasks from the Marketplace, which gives you greater control over the code that executes in a pipeline.

Source: https://maester.dev/docs/tests/AZDO.1023

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Pipelines · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1023
```

## Overview

Disable the ability to install and run tasks from the Marketplace, which gives you greater control over the code that executes in a pipeline.

Rationale: Tasks from the marketplace should be reviewed and approved.

#### Remediation action

Enable the restriction to prevent marketplace tasks from executing in pipelines.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Settings under Pipelines.
4. Go to the section "Task restrictions" and turn on "Disable marketplace tasks"

**Results:**
With this enabled, pipelines will not use tasks installed from the Marketplace. Jobs which depend on Marketplace tasks will fail.

#### Related links

* [Learn - Prevent malicious code execution](https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#prevent-malicious-code-execution)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1023 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | High |
| MITRE ATT&CK | T1195.001 Compromise Software Dependencies and Development Tools |
| Supports controls | nist-800-53-r5:CM-7, nist-800-53-r5:CM-11 |
| PowerShell test | [Test-AzdoOrganizationTaskRestrictionsDisableMarketplaceTask](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1023.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#prevent-malicious-code-execution](https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#prevent-malicious-code-execution) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1023.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1023.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1023.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1023.md)