(Tenant) Restrict creation of global Personal Access Tokens
AZDO.1032HighAzure DevOpsSecurity policiesPreview 3.0
Part of Maester · Azure DevOps · Security policies · All checks
Invoke-Maester -TestId AZDO.1032Overview
Section titled “Overview”Restrict creation of global Personal Access Tokens (PATs) should be enabled.
Prerequisites
Section titled “Prerequisites”- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.
Rationale
Section titled “Rationale”Global PATs can be used across all accessible organizations. Restricting their creation ensures tokens are confined to a single org, enforcing least privilege and reducing cross-org exposure risk.
Remediation action
Section titled “Remediation action”Enable the tenant policy to stop creation of global PATs.
- Sign in to your organization (
https://dev.azure.com/{Your_Organization}). - Select Organization settings (gear icon).
- Select Microsoft Entra, locate the “Restrict global personal access token creation” policy.
- Move the toggle to On.
Allowlist and exceptions
Section titled “Allowlist and exceptions”- Add Microsoft Entra users or groups to the allowlist to exempt them from the restriction.
- Prefer groups over individual users to avoid identity residency problems.
Existing PATs:
Existing global PATs remain valid until they expire; the policy affects only newly created tokens.
Results:
When enabled, new PATs must be associated with a single Azure DevOps organization. Users not on the allowlist cannot create global tokens.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1032 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1550.001 Application Access Token |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | Test-AzdoDisableGlobalPATCreation |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-creation-of-global-pats-tenant-policy |