(Organization) Secret Protection: new repositories enrolled automatically
Part of Maester · Azure DevOps · Repositories · All checks
Invoke-Maester -TestId AZDO.1039Overview
Section titled “Overview”The GitHub Secret Protection plan should be automatically enabled on newly created Git repositories.
Rationale: Secret Protection provides push protection to prevent secret leaks before they happen, secret scanning alerts to catch existing exposures, and a security overview of your organization’s risk. When automatic enablement is off, every new repository starts unprotected and has to be onboarded manually, so coverage silently degrades as the organization grows.
Remediation action:
Section titled “Remediation action:”Enable automatic enrollment of the Secret Protection plan for new repositories.
- Sign in to your organization.
- Choose Organization settings > Repos > Repositories.
- Toggle Secret Protection plan to on, then select Begin billing to activate the plan.
- Optionally select Options to also enable push protection for the repositories that are enrolled.
Results: With automatic enablement on, any Git repository created in the organization from that point on has Secret Protection enabled at creation.
This setting has no effect on repositories that already exist. They must be enrolled separately using Enable all, which is assessed by AZDO.1040. A passing result here does not mean the organization is covered.
This test only applies to organizations that use the separate GitHub Secret Protection and GitHub Code Security plans. Organizations on the bundled GitHub Advanced Security for Azure DevOps SKU are skipped, because automatic enablement for the bundled SKU is reported by AZDO.1026 instead.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AZDO.1039 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Repositories |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1552.001 Credentials In Files |
| Supports controls | nist-800-53-r5:IA-5(7) |
| PowerShell test | Test-AzdoOrganizationAutomaticEnrollmentSecretProtectionNewRepository |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops#organization-level-onboarding |