(Tenant) Restrict Personal Access Token lifespan
AZDO.1035HighAzure DevOpsSecurity policiesPreview 3.0
Part of Maester · Azure DevOps · Security policies · All checks
Invoke-Maester -TestId AZDO.1035Overview
Section titled “Overview”Restrict setting a maximum Personal Access Token (PAT) lifespan should be enabled.
Prerequisites
Section titled “Prerequisites”- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.
Rationale
Section titled “Rationale”Restricting PAT lifespan by enforcing a maximum expiration reduces the risk of long-lived credentials being reused after compromise, helps meet compliance requirements, and encourages regular credential rotation.
Remediation action
Section titled “Remediation action”Enable the tenant policy to enforce a maximum PAT lifespan.
- Sign in to your organization (
https://dev.azure.com/{yourorganization}). - Select Organization settings (gear icon).
- Select Microsoft Entra, find the “Enforce maximum personal access token lifespan” policy.
- Move the toggle to On.
- Enter the maximum number of days and select Save.
Allowlist and exceptions
Section titled “Allowlist and exceptions”- Each tenant policy has its own allowlist; add Microsoft Entra users or groups to exempt them from the restriction.
- Use groups for allowlists; adding named users can create identity residency concerns.
Existing PATs:
Existing PATs remain valid until their configured expiration date and are not retroactively shortened by this setting.
Results:
When enabled, newly created or renewed PATs will have a maximum lifespan (in days) and will automatically expire after that period.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1035 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1550.001 Application Access Token |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | Test-AzdoRestrictPersonalAccessTokenLifespan |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-personal-access-token-lifespan |