AZDO.1030: Project Collection Administrators.
| ID | AZDO.1030 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Users and access |
| Security area | Privileged access |
| Resource type | User |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-6(5) Least Privilege | Privileged Accounts |
| MITRE ATT&CK | T1078.004, T1098.003 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/organizations/security/about-permissions?view=azure-devops&tabs=preview-page#permissions |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Project Collection Administrator is a highly privileged role, and membership should be restricted and regularly reviewed.
Rationale: Project Collection Administrators (PCAs) have unrestricted control over the Azure DevOps organization or collection. A compromised PCA account or an overly broad roster can lead to:
- Unapproved project creation or deletion
- Policy changes that weaken security
- Uncontrolled access to code, pipelines, and artifacts
- Configuration of billing or extensions that impact cost and service availability Keeping the PCA group small and audited reduces the blast radius of insider threats and accidental misconfiguration.
Remediation action
Section titled “Remediation action”Restrict membership of the Project Collection Administrators group to only those individuals who absolutely require it. Periodically review the list and remove any stale accounts.
Implement privileged access management (PAM) or just-in-time access workflows so that high-privilege membership is temporary and audited. Use multifactor authentication and strong account hygiene for PCA accounts.
Results: A small, well-managed PCA group reduces the risk of malicious or accidental changes and makes post-incident investigation simpler.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.