# (Tenant) Restrict Personal Access Token full scope

Restrict creation of full-scoped Personal Access Tokens (PATs) should be enabled.

Source: https://maester.dev/docs/tests/AZDO.1036

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Security policies · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1036
```

## Overview

Restrict creation of full-scoped Personal Access Tokens (PATs) **should be** enabled.

#### Prerequisites

- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.

#### Rationale

Restricting full-scoped Personal Access Token (PAT) creation enforces least
privilege, reduces the risk of credential exposure, and limits the blast radius
if a token is compromised. It also helps meet compliance requirements and
prevents accidental or malicious use of overly permissive tokens.

#### Remediation action

Enable the tenant policy to restrict creation of full-scoped personal access tokens.

1. Sign in to your organization (`https://dev.azure.com/{yourorganization}`).
2. Select Organization settings (gear icon).
3. Select Microsoft Entra, find the "Restrict creation of full-scoped personal access tokens" policy.
4. Move the toggle to On.

#### Allowlist and exceptions

- Use Microsoft Entra groups for allowlists; adding named users can create identity residency concerns.
- Users or groups on the allowlist are exempt from the restriction and can create PATs of any scope.

**Existing PATs:**

Existing PATs remain valid until their configured expiration date and are not retroactively restricted.

**Results:**

When enabled, new personal access tokens (PATs) must have limited, defined
scopes. Creation of full-scope PATs (tokens that grant all accessible scopes)
will be blocked for users who are not on the allowlist.

#### Related links

- [Learn - Restrict creation of full-scoped PATs (tenant policy)](https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-creation-of-full-scoped-pats-tenant-policy)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1036 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1550.001 Application Access Token |
| Supports controls | nist-800-53-r5:AC-6 |
| PowerShell test | [Test-AzdoRestrictFullScopePersonalAccessToken](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1036.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-creation-of-full-scoped-pats-tenant-policy](https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-creation-of-full-scoped-pats-tenant-policy) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1036.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1036.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1036.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1036.md)