# (Tenant) Restrict Personal Access Token lifespan

Restrict setting a maximum Personal Access Token (PAT) lifespan should be enabled.

Source: https://maester.dev/docs/tests/AZDO.1035

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Security policies · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1035
```

## Overview

Restrict setting a maximum Personal Access Token (PAT) lifespan **should be** enabled.

#### Prerequisites

- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.

#### Rationale

Restricting PAT lifespan by enforcing a maximum expiration reduces the risk of long-lived credentials being reused after compromise, helps meet compliance requirements, and encourages regular credential rotation.

#### Remediation action

Enable the tenant policy to enforce a maximum PAT lifespan.

1. Sign in to your organization (`https://dev.azure.com/{yourorganization}`).
2. Select Organization settings (gear icon).
3. Select Microsoft Entra, find the "Enforce maximum personal access token lifespan" policy.
4. Move the toggle to On.
5. Enter the maximum number of days and select Save.

#### Allowlist and exceptions

- Each tenant policy has its own allowlist; add Microsoft Entra users or groups to exempt them from the restriction.
- Use groups for allowlists; adding named users can create identity residency concerns.

**Existing PATs:**

Existing PATs remain valid until their configured expiration date and are not retroactively shortened by this setting.

**Results:**

When enabled, newly created or renewed PATs will have a maximum lifespan (in days) and will automatically expire after that period.

#### Related links

* [Learn - Restrict personal access token lifespan](https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-personal-access-token-lifespan)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1035 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1550.001 Application Access Token |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | [Test-AzdoRestrictPersonalAccessTokenLifespan](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1035.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-personal-access-token-lifespan](https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-personal-access-token-lifespan) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1035.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1035.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1035.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1035.md)