# (Organization) Disallow extensions from accessing resources on the local network

Extensions should not be allowed to access resources on the local network.

Source: https://maester.dev/docs/tests/AZDO.1038

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Security policies · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1038
```

## Overview

Extensions **should not be** allowed to access resources on the local network.

Rationale: Allowing extensions to make requests to local network resources (loopback addresses like 127.0.0.1 or private IP ranges) increases the risk of server-side request forgery (SSRF) attacks. This policy should be disabled unless your extensions specifically require local network access.

#### Remediation action

Disable the policy to prevent extensions from accessing local network resources.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies, locate the "Allow extensions to access resources on the local network" policy and toggle it to off.

**Results:**
With the policy disabled, extensions cannot make requests to loopback addresses or private IP address ranges, reducing the risk of SSRF attacks.

#### Related links

* [Learn - Allow extensions to access resources on the local network](https://learn.microsoft.com/azure/devops/marketplace/allow-extensions-local-network?view=azure-devops)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1038 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Applications and workload identities |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1190 Exploit Public-Facing Application |
| PowerShell test | [Test-MtCheckAZDO1038](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1038.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/marketplace/allow-extensions-local-network?view=azure-devops](https://learn.microsoft.com/azure/devops/marketplace/allow-extensions-local-network?view=azure-devops) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1038.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1038.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1038.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1038.md)