Validate SSH Key Expiration
AZDO.1031HighAzure DevOpsSecurity policiesPreview 3.0
Part of Maester · Azure DevOps · Security policies · All checks
Invoke-Maester -TestId AZDO.1031Overview
Section titled “Overview”Validation of SSH key expiration date should be enabled.
Rationale: Expired SSH keys should not be valid for authentication towards Azure DevOps.
Remediation action
Section titled “Remediation action”Enable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies under Security.
- Switch the Validate SSH key expiration button to ON.
Results: When active, Azure DevOps enforces that keys with expired expiration dates immediately become invalid for authentication.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1031 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1552.004 Private Keys |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | Test-AzdoValidateSshKeyExpiration |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/change-application-access-policies?view=azure-devops#ssh-key-policies |