Skip to content
MitoMito Docs

AZDO.1016: Limit job authorization scope to current project for non-release pipelines.
ID AZDO.1016
Severity High
Suite Mito
Product Azure DevOps
Feature Pipelines
Security area Engineering systems
Resource type Tenant
User impact of fixing Medium
Effort to fix Medium
Framework controls nist-800-53-r5:AC-6 Least Privilege
MITRE ATT&CK T1550.001, T1213.003
Reads from Azure DevOps
Further reading https://learn.microsoft.com/azure/devops/pipelines/process/access-tokens?view=azure-devops&tabs=yaml#job-authorization-scope

What this checks and how to fix it

Section titled “What this checks and how to fix it”

YAML & build pipelines should have restricted access to only those repositories that are in the same project as the pipeline.

Rationale: If the scope is not restricted at either the organization level or project level, then every job in your YAML pipeline gets a collection scoped job access token. In other words, your pipeline has access to any repository in any project of your organization. If an adversary is able to gain access to a single pipeline in a single project, they will be able to gain access to any repository in your organization. This is why it is recommended that you restrict the scope at the highest level (organization settings) in order to contain the attack to a single project.

Remediation action

Section titled “Remediation action”

Enable the policy to restrict the job authorization scope.

  1. Sign in to your organization.
  2. Choose Organization settings.
  3. Under the Pipelines section choose Settings.
  4. In the General section, toggle on “Limit job authorization scope to current project for non-release pipelines”.
Section titled “Related links”

Mito check. Author: SebastianClaesson. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.