(Tenant) Restrict Personal Access Token full scope
Part of Maester · Azure DevOps · Security policies · All checks
Invoke-Maester -TestId AZDO.1036Overview
Section titled “Overview”Restrict creation of full-scoped Personal Access Tokens (PATs) should be enabled.
Prerequisites
Section titled “Prerequisites”- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.
Rationale
Section titled “Rationale”Restricting full-scoped Personal Access Token (PAT) creation enforces least privilege, reduces the risk of credential exposure, and limits the blast radius if a token is compromised. It also helps meet compliance requirements and prevents accidental or malicious use of overly permissive tokens.
Remediation action
Section titled “Remediation action”Enable the tenant policy to restrict creation of full-scoped personal access tokens.
- Sign in to your organization (
https://dev.azure.com/{yourorganization}). - Select Organization settings (gear icon).
- Select Microsoft Entra, find the “Restrict creation of full-scoped personal access tokens” policy.
- Move the toggle to On.
Allowlist and exceptions
Section titled “Allowlist and exceptions”- Use Microsoft Entra groups for allowlists; adding named users can create identity residency concerns.
- Users or groups on the allowlist are exempt from the restriction and can create PATs of any scope.
Existing PATs:
Existing PATs remain valid until their configured expiration date and are not retroactively restricted.
Results:
When enabled, new personal access tokens (PATs) must have limited, defined scopes. Creation of full-scope PATs (tokens that grant all accessible scopes) will be blocked for users who are not on the allowlist.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1036 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1550.001 Application Access Token |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | Test-AzdoRestrictFullScopePersonalAccessToken |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-creation-of-full-scoped-pats-tenant-policy |