# (Organization) Secret Protection: new repositories enrolled automatically

The GitHub Secret Protection plan should be automatically enabled on newly created Git repositories.

Source: https://maester.dev/docs/tests/AZDO.1039

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/sebastianclaesson" title="Sebastian Claesson · Original author"><img src="https://github.com/SebastianClaesson.png" alt="Sebastian Claesson" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/sebastianclaesson">Sebastian Claesson</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Azure DevOps · Repositories · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AZDO.1039
```

## Overview

The GitHub Secret Protection plan **should be** automatically enabled on newly created Git repositories.

Rationale: Secret Protection provides push protection to prevent secret leaks before they happen, secret scanning alerts to catch existing exposures, and a security overview of your organization's risk. When automatic enablement is off, every new repository starts unprotected and has to be onboarded manually, so coverage silently degrades as the organization grows.

#### Remediation action:
Enable automatic enrollment of the Secret Protection plan for new repositories.
1. Sign in to your organization.
2. Choose **Organization settings** > **Repos** > **Repositories**.
3. Toggle **Secret Protection plan** to on, then select **Begin billing** to activate the plan.
4. Optionally select **Options** to also enable push protection for the repositories that are enrolled.

**Results:**
With automatic enablement on, any Git repository created in the organization from that point on has Secret Protection enabled at creation.

This setting has no effect on repositories that already exist. They must be enrolled separately using **Enable all**, which is assessed by AZDO.1040. A passing result here does not mean the organization is covered.

This test only applies to organizations that use the separate GitHub Secret Protection and GitHub Code Security plans. Organizations on the bundled GitHub Advanced Security for Azure DevOps SKU are skipped, because automatic enablement for the bundled SKU is reported by AZDO.1026 instead.

#### Related links

* [Learn - Configure GitHub Advanced Security features](https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops#organization-level-onboarding)
* [Learn - Manage Advanced Security permissions](https://learn.microsoft.com/azure/devops/repos/security/github-advanced-security-permissions?view=azure-devops)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AZDO.1039 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Repositories |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1552.001 Credentials In Files |
| Supports controls | nist-800-53-r5:IA-5(7) |
| PowerShell test | [Test-AzdoOrganizationAutomaticEnrollmentSecretProtectionNewRepository](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1039.ps1) |
| Services | AzureDevOps |
| Learn more | [https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops#organization-level-onboarding](https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops#organization-level-onboarding) |

</details>

## Source

- Test: [`tests/maester/azure-devops/Test.AZDO.1039.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1039.ps1)
- Documentation: [`tests/maester/azure-devops/Test.AZDO.1039.md`](https://github.com/maester365/maester/blob/main/tests/maester/azure-devops/Test.AZDO.1039.md)