AZDO.1037 - (Organization) Restrict Personal Access Token creation.
Overview
Personal Access Token creation should be restricted at the organization level.
Rationale: Restricting PAT creation reduces the risk of long-lived credentials being used to access your Azure DevOps organization. Existing personal access tokens remain valid until expiration when the policy is enabled.
Remediation action
Enable the policy to restrict Personal Access Token creation.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the "Restrict personal access token (PAT) creation" policy and toggle it to on.
Results: With the policy enabled, users cannot create new Personal Access Tokens unless explicitly allowed through the allow list.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1037 |
| Severity | High |
| Suite | Maester |
| Product | Azure DevOps |
| Feature | Security policies |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1528 Steal Application Access Token, T1550.001 Application Access Token |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | Test-AzdoDisablePATCreation |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops |