AZDO.1006: External Users access.
| ID | AZDO.1006 |
| Severity | Medium |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Users and access |
| Security area | External access and sharing |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:AC-3 Access Enforcementnist-800-53-r5:AC-21 Information Sharing |
| MITRE ATT&CK | T1078.004 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/organizations/security/security-overview?view=azure-devops#manage-external-guest-access |
What this checks and how to fix it
Section titled “What this checks and how to fix it”External guest access to Azure DevOps should be a controlled process.
Rationale: External guest access can introduce potential security risks if not managed properly.
Remediation action
Section titled “Remediation action”Disable the “External guest access” policy to prevent external guest access if there’s no business need for it.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the External guest access policy and toggle it to off.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.