AZDO.1003: Restrict public projects.
| ID | AZDO.1003 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Security policies |
| Security area | External access and sharing |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:AC-22 Publicly Accessible Contentnist-800-53-r5:AC-3 Access Enforcement |
| MITRE ATT&CK | T1213.003, T1593.003 |
| Reads from | Azure DevOps |
| Further reading | https://aka.ms/vsts-anon-access |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Public projects should be disabled.
Rationale: When you choose public visibility, anyone on the internet can view your project. With private visibility, only users you give access to can view your project.
Remediation action
Section titled “Remediation action”Disable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies under the Security section
- Locate the “Allow public projects” policy and toggle it to off.
Results: External users are not able to access your project.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.