(Organization) Restrict Personal Access Token creation
AZDO.1037HighAzure DevOpsSecurity policiesPreview 3.0
Part of Maester · Azure DevOps · Security policies · All checks
Invoke-Maester -TestId AZDO.1037Overview
Section titled “Overview”Personal Access Token creation should be restricted at the organization level.
Rationale: Restricting PAT creation reduces the risk of long-lived credentials being used to access your Azure DevOps organization. Existing personal access tokens remain valid until expiration when the policy is enabled.
Remediation action
Section titled “Remediation action”Enable the policy to restrict Personal Access Token creation.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the “Restrict personal access token (PAT) creation” policy and toggle it to on.
Results: With the policy enabled, users cannot create new Personal Access Tokens unless explicitly allowed through the allow list.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1037 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1550.001 Application Access Token |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | Test-AzdoDisablePATCreation |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops |