Azure DevOps

46 checks24 High15 Medium2 Low5 Info

Run theseInvoke-Maester -Product azure-devops

AZDO.1000Azure DevOps OAuth apps can access resources in your organization through OAuth.New in 3.0Security policiesAuthenticationHighMediumLowT1528, T1671—Maester AZDO.1001Identities can connect to your organization's Git repos through SSH.New in 3.0Security policiesAuthenticationHighMediumMediumT1552.004, T1098.001—Maester AZDO.1002Log Audit Events.New in 3.0AuditingLogging and detectionHighLowLowT1685.002nist-800-53-r5:AU-12, nist-800-53-r5:AU-2Maester AZDO.1003Restrict public projects.New in 3.0Security policiesExternal access and sharingHighLowLowT1213.003, T1593.003nist-800-53-r5:AC-22, nist-800-53-r5:AC-3Maester AZDO.1004Additional protections when using public package registries.New in 3.0Security policiesEngineering systemsHighLowLowT1195.001, T1204.005nist-800-53-r5:SR-3Maester AZDO.1005IP Conditional Access policy validation.New in 3.0Security policiesAccess controlHighMediumLowT1078.004, T1550.001nist-800-53-r5:AC-17Maester AZDO.1010Audit streaming.New in 3.0AuditingLogging and detectionHighLowMediumT1685.002, T1070nist-800-53-r5:AU-6, nist-800-53-r5:SI-4Maester AZDO.1013Organization Owner should not be an individual.New in 3.0Users and accessPrivileged accessHighLowLowT1078.004—Maester AZDO.1015Limit variables that can be set at queue time.New in 3.0PipelinesEngineering systemsHighLowLowT1677nist-800-53-r5:SI-10Maester AZDO.1016Limit job authorization scope to current project for non-release pipelines.New in 3.0PipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-6Maester AZDO.1017Limit job authorization scope to current project for classic release pipelines.New in 3.0PipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-6Maester AZDO.1018Protect access to repositories in YAML pipelines.New in 3.0PipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-3, nist-800-53-r5:AC-6Maester AZDO.1022Limit building pull requests from forked GitHub repositories.New in 3.0PipelinesEngineering systemsHighLowLowT1677—Maester AZDO.1023Disable Marketplace tasks.New in 3.0PipelinesEngineering systemsHighMediumHighT1195.001nist-800-53-r5:CM-7, nist-800-53-r5:CM-11Maester AZDO.1025Enable shell tasks arguments validation.New in 3.0PipelinesEngineering systemsHighLowLowT1059, T1677nist-800-53-r5:SI-10Maester AZDO.1030Project Collection Administrators.New in 3.0Users and accessPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)Maester AZDO.1031Validate SSH Key Expiration.New in 3.0Security policiesAuthenticationHighMediumLowT1552.004nist-800-53-r5:IA-5Maester AZDO.1032(Tenant) Restrict creation of global Personal Access Tokens.New in 3.0Security policiesAuthenticationHighLowLowT1528, T1550.001nist-800-53-r5:IA-5Maester AZDO.1033(Tenant) Enable automatic revocation of leaked Personal Access Tokens.New in 3.0Security policiesAuthenticationHighLowLowT1552.001, T1593.003 +1nist-800-53-r5:IA-5Maester AZDO.1035(Tenant) Restrict Personal Access Token lifespan.New in 3.0Security policiesAuthenticationHighMediumLowT1528, T1550.001nist-800-53-r5:IA-5Maester AZDO.1036(Tenant) Restrict Personal Access Token full scope.New in 3.0Security policiesAuthenticationHighLowLowT1528, T1550.001nist-800-53-r5:AC-6Maester AZDO.1037(Organization) Restrict Personal Access Token creation.New in 3.0Security policiesAuthenticationHighMediumMediumT1528, T1550.001nist-800-53-r5:IA-5Maester AZDO.1040(Organization) Secret Protection: existing repositories enrolled.New in 3.0RepositoriesEngineering systemsHighLowMediumT1552.001nist-800-53-r5:IA-5(7)Maester AZDO.1041(Organization) Secret Protection: push protection blocks secret commits.New in 3.0RepositoriesEngineering systemsHighLowLowT1552.001nist-800-53-r5:IA-5(7)Maester AZDO.1006External Users access.New in 3.0Users and accessExternal access and sharingMediumMediumLowT1078.004nist-800-53-r5:AC-3, nist-800-53-r5:AC-21Maester AZDO.1007Team and project administrator are allowed to invite new users.New in 3.0Users and accessAccess controlMediumLowLowT1136.003—Maester AZDO.1014Anonymous access to pipeline badges.New in 3.0PipelinesExternal access and sharingMediumLowLowT1593.003—Maester AZDO.1019Stage chooser.New in 3.0PipelinesEngineering systemsMediumMediumLow——Maester AZDO.1020Creation of classic build pipelines.New in 3.0PipelinesEngineering systemsMediumMediumLow——Maester AZDO.1021Creation of classic release pipelines.New in 3.0PipelinesEngineering systemsMediumMediumLow——Maester AZDO.1024Disable Node 6 tasks.New in 3.0PipelinesEngineering systemsMediumLowLow—nist-800-53-r5:SI-2Maester AZDO.1026Enable automatic enrollment to Advanced Security for Azure DevOps.New in 3.0RepositoriesEngineering systemsMediumLowMediumT1552.001, T1195.001 +1nist-800-53-r5:SA-11, nist-800-53-r5:IA-5(7)Maester AZDO.1028Disable creation of TFVC repositories.New in 3.0RepositoriesEngineering systemsMediumLowLow——Maester AZDO.1034(Tenant) Restrict creation of new Azure DevOps organizations.New in 3.0Organization policiesAccess controlMediumLowLow——Maester AZDO.1038(Organization) Disallow extensions from accessing resources on the local network.New in 3.0Security policiesApplications and workload identitiesMediumLowLowT1190—Maester AZDO.1039(Organization) Secret Protection: new repositories enrolled automatically.New in 3.0RepositoriesEngineering systemsMediumLowMediumT1552.001nist-800-53-r5:IA-5(7)Maester AZDO.1042(Organization) Code Security: new repositories enrolled automatically.New in 3.0RepositoriesEngineering systemsMediumLowMediumT1195.001, T1190nist-800-53-r5:SA-11Maester AZDO.1043(Organization) Code Security: existing repositories enrolled.New in 3.0RepositoriesEngineering systemsMediumLowMediumT1195.001, T1190nist-800-53-r5:SA-11Maester AZDO.1044(Organization) Code Security: dependency and CodeQL alerts enabled.New in 3.0RepositoriesEngineering systemsMediumLowLowT1195.001, T1190nist-800-53-r5:SA-11, nist-800-53-r5:SI-2Maester AZDO.1008Request access to Azure DevOps by e-mail notifications to administrators.New in 3.0Users and accessAccess controlLowLowLow——Maester AZDO.1027Disable showing Gravatar images for users outside of your enterprise.New in 3.0RepositoriesEngineering systemsLowLowLowT1589.002—Maester AZDO.1009Feedback Collection.New in 3.0Organization policiesEngineering systemsInfo————Maester AZDO.1011Project Resource Limits.New in 3.0Resource usage and limitsEngineering systemsInfo————Maester AZDO.1012Work Items Tags Limits.New in 3.0Resource usage and limitsEngineering systemsInfo————Maester AZDO.1029Storage Usage Limit.New in 3.0Resource usage and limitsEngineering systemsInfo————Maester AZDO.1045(Organization) Copilot code review: allowed for repositories.New in 3.0-IncludePreviewRepositoriesAI and agentsInfo————Maester