# (Tenant) Enable automatic revocation of leaked Personal Access Tokens

Automatic revocation of leaked Personal Access Tokens should be enabled.

Source: https://maester.dev/docs/tests/AZDO.1033

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Security policies · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1033
```

## Overview

Automatic revocation of leaked Personal Access Tokens **should be** enabled.

#### Prerequisites

- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.

#### Rationale

Automatically revoking PATs detected as leaked minimizes the window of opportunity for unauthorized access. Disabling this policy leaves exposed tokens active even if they appear in public repositories.

#### Remediation action

Enable the tenant policy to revoke leaked tokens.

1. Sign in to your organization (`https://dev.azure.com/{yourorganization}`).
2. Select Organization settings (gear icon).
3. Select Microsoft Entra, locate the "Automatically revoke leaked personal access tokens" policy.
4. Move the toggle to On.

**Results:**

When enabled, Azure DevOps will automatically revoke any PATs detected as leaked or exposed. If the policy is later disabled, tokens checked into public GitHub repositories remain active.

#### Related links

* [Learn - Automatic revocation of leaked tokens](https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#automatic-revocation-of-leaked-tokens)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1033 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1552.001 Credentials In Files, T1593.003 Code Repositories, T1550.001 Application Access Token |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | [Test-AzdoEnableLeakedPersonalAccessTokenAutoRevocation](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1033.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#automatic-revocation-of-leaked-tokens](https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#automatic-revocation-of-leaked-tokens) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1033.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1033.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1033.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1033.md)