AZDO.1023 - Disable Marketplace tasks.
Overview
Disable the ability to install and run tasks from the Marketplace, which gives you greater control over the code that executes in a pipeline.
Rationale: Tasks from the marketplace should be reviewed and approved.
Remediation action
Enable the restriction to prevent marketplace tasks from executing in pipelines.
- Sign in to your organization.
- Choose Organization settings.
- Select Settings under Pipelines.
- Go to the section "Task restrictions" and turn on "Disable marketplace tasks"
Results: With this enabled, pipelines will not use tasks installed from the Marketplace. Jobs which depend on Marketplace tasks will fail.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1023 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Pipelines |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | High |
| MITRE ATT&CK | T1195.001 Compromise Software Dependencies and Development Tools |
| Supports controls | nist-800-53-r5:CM-7, nist-800-53-r5:CM-11 |
| PowerShell test | Test-AzdoOrganizationTaskRestrictionsDisableMarketplaceTask |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#prevent-malicious-code-execution |