AZDO.1023: Disable Marketplace tasks.
| ID | AZDO.1023 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Pipelines |
| Security area | Engineering systems |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | High |
| Framework controls | nist-800-53-r5:CM-7 Least Functionalitynist-800-53-r5:CM-11 User-installed Software |
| MITRE ATT&CK | T1195.001 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#prevent-malicious-code-execution |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Disable the ability to install and run tasks from the Marketplace, which gives you greater control over the code that executes in a pipeline.
Rationale: Tasks from the marketplace should be reviewed and approved.
Remediation action
Section titled “Remediation action”Enable the restriction to prevent marketplace tasks from executing in pipelines.
- Sign in to your organization.
- Choose Organization settings.
- Select Settings under Pipelines.
- Go to the section “Task restrictions” and turn on “Disable marketplace tasks”
Results: With this enabled, pipelines will not use tasks installed from the Marketplace. Jobs which depend on Marketplace tasks will fail.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.