AZDO.1000 - Azure DevOps OAuth apps can access resources in your organization through OAuth.
Overview
Third-party application access via OAuth should be disabled.
Rationale: Third-party application access should not be used for Azure DevOps.
Remediation action
Disable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the Third-party application access via Oauth policy and toggle it to off.
Results: With the policy disabled, third-party applications can no longer access your Azure DevOps organization via OAuth. Any application that previously relied on OAuth access will encounter authentication errors and lose access. This does not affect Microsoft Entra ID OAuth app access.
Related links
- Learn - Change application connection & security policies for your organization
- Learn - Use Azure DevOps OAuth 2.0 to create a web app
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1000 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1671 Cloud Application Integration |
| PowerShell test | Test-AzdoThirdPartyAccessViaOauth |
| Services | AzureDevOps |
| Learn more | https://aka.ms/vstspolicyoauth |