# Validate SSH Key Expiration

Validate SSH Key Expiration. A Maester check for Azure DevOps, Security policies.

Source: https://maester.dev/docs/tests/AZDO.1031

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Security policies · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1031
```

## Overview

Validation of SSH key expiration date **should be** enabled.

Rationale: Expired SSH keys should not be valid for authentication towards Azure DevOps.

#### Remediation action

Enable the policy to stop these requests and notifications.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies under Security.
4. Switch the Validate SSH key expiration button to ON.

**Results:**
When active, Azure DevOps enforces that keys with expired expiration dates immediately become invalid for authentication.

#### Related links

* [Learn - SSH key policies](https://learn.microsoft.com/azure/devops/organizations/accounts/change-application-access-policies?view=azure-devops#ssh-key-policies)
* [Learn - My SSH key has expired, what should I do?](https://learn.microsoft.com/azure/devops/repos/git/use-ssh-keys-to-authenticate?view=azure-devops#q-my-ssh-key-has-expired-what-should-i-do)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1031 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1552.004 Private Keys |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | [Test-AzdoValidateSshKeyExpiration](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1031.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/organizations/accounts/change-application-access-policies?view=azure-devops#ssh-key-policies](https://learn.microsoft.com/azure/devops/organizations/accounts/change-application-access-policies?view=azure-devops#ssh-key-policies) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1031.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1031.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1031.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1031.md)