AZDO.1026 - Enable automatic enrollment to Advanced Security for Azure DevOps.
Overview
GitHub advanced Security for Azure DevOps should be automatically enabled for new projects.
Rationale: Newly created projects should have Advanced Security enabled upon creation.
Remediation action
Organization-level onboarding
- Sign in to your organization.
- Go to your Organization settings for your Azure DevOps organization.
- Select Repositories.
- Select Enable all and see an estimate for the number of active committers for your organization appear.
- Select Begin billing to activate Advanced Security for every existing repository in each project in your organization.
- Select Automatically enable Advanced Security for new repositories so that any newly created projects have Advanced Security enabled upon creation.
Results: Newly created projects have Advanced Security enabled upon creation.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1026 |
| Severity | Medium |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Repositories |
| Area | Engineering systems |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1552.001 Credentials In Files, T1195.001 Compromise Software Dependencies and Development Tools, T1190 Exploit Public-Facing Application |
| Supports controls | nist-800-53-r5:SA-11, nist-800-53-r5:IA-5(7) |
| PowerShell test | Test-AzdoOrganizationAutomaticEnrollmentAdvancedSecurityNewProject |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops&tabs=yaml#organization-level-onboarding |