(Tenant) Enable automatic revocation of leaked Personal Access Tokens

Contributed by Sebastian ClaessonAll contributors →

Part of Maester · Azure DevOps · Security policies · All checks

Run this check

Invoke-Maester -TestId AZDO.1033

Overview

Automatic revocation of leaked Personal Access Tokens should be enabled.

Prerequisites

• Your organization must be linked to a Microsoft Entra tenant.
• You must be an Azure DevOps Administrator to configure tenant policies.

Rationale

Automatically revoking PATs detected as leaked minimizes the window of opportunity for unauthorized access. Disabling this policy leaves exposed tokens active even if they appear in public repositories.

Remediation action

Enable the tenant policy to revoke leaked tokens.

1. Sign in to your organization (https://dev.azure.com/{yourorganization}).
2. Select Organization settings (gear icon).
3. Select Microsoft Entra, locate the “Automatically revoke leaked personal access tokens” policy.
4. Move the toggle to On.

Results:

When enabled, Azure DevOps will automatically revoke any PATs detected as leaked or exposed. If the policy is later disabled, tokens checked into public GitHub repositories remain active.

Related links

• Learn - Automatic revocation of leaked tokens

Details

Every attribute of this check

Field	Value
Test ID	AZDO.1033
Severity	High
Suite	Maester
Product	Azure DevOps
Feature	Security policies
Area	Authentication
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1552.001 Credentials In Files, T1593.003 Code Repositories, T1550.001 Application Access Token
Supports controls	nist-800-53-r5:IA-5
PowerShell test	Test-AzdoEnableLeakedPersonalAccessTokenAutoRevocation
Services	AzureDevOps
Learn more	https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#automatic-revocation-of-leaked-tokens

Source

• Test: tests/maester/azure-devops/Test.AZDO.1033.ps1
• Documentation: tests/maester/azure-devops/Test.AZDO.1033.md