Disable showing Gravatar images for users outside of your enterprise
AZDO.1027LowAzure DevOpsRepositoriesPreview 3.0
Part of Maester · Azure DevOps · Repositories · All checks
Invoke-Maester -TestId AZDO.1027Overview
Section titled “Overview”Gravatar images should not be exposed for users outside your enterprise.
Rationale: Gravatar images are served by an external service (gravatar.com) and may leak email hashes or profile information. Allowing them can reveal internal usernames or identities to outside observers and increases privacy risk.
Remediation action
Section titled “Remediation action”Disable the policy to stop these requests and notifications.
- On your Azure DevOps organization page, select Organization settings at lower left, and then select Repositories in the left navigation.
- On the All Repositories page, set Gravatar images to Off.
Results: With the setting disabled, user avatars use generic initials or local images only, preventing any information from being fetched from third-party servers.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1027 |
| Severity | Low |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Repositories |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1589.002 Email Addresses |
| PowerShell test | Test-MtCheckAZDO1027 |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/repos/git/repository-settings?view=azure-devops&tabs=browser#gravatar-images |