AZDO.1003 - Restrict public projects.
Overview
Public projects should be disabled.
Rationale: When you choose public visibility, anyone on the internet can view your project. With private visibility, only users you give access to can view your project.
Remediation action
Disable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies under the Security section
- Locate the "Allow public projects" policy and toggle it to off.
Results: External users are not able to access your project.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1003 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1213.003 Code Repositories, T1593.003 Code Repositories |
| Supports controls | nist-800-53-r5:AC-22, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCheckAZDO1003 |
| Services | AzureDevOps |
| Learn more | https://aka.ms/vsts-anon-access |