AZDO.1032: (Tenant) Restrict creation of global Personal Access Tokens.
| ID | AZDO.1032 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Security policies |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:IA-5 Authenticator Management |
| MITRE ATT&CK | T1528, T1550.001 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-creation-of-global-pats-tenant-policy |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Restrict creation of global Personal Access Tokens (PATs) should be enabled.
Prerequisites
Section titled “Prerequisites”- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.
Rationale
Section titled “Rationale”Global PATs can be used across all accessible organizations. Restricting their creation ensures tokens are confined to a single org, enforcing least privilege and reducing cross-org exposure risk.
Remediation action
Section titled “Remediation action”Enable the tenant policy to stop creation of global PATs.
- Sign in to your organization (https://dev.azure.com/{Your_Organization}).
- Select Organization settings (gear icon).
- Select Microsoft Entra, locate the “Restrict global personal access token creation” policy.
- Move the toggle to On.
Allowlist and exceptions
Section titled “Allowlist and exceptions”- Add Microsoft Entra users or groups to the allowlist to exempt them from the restriction.
- Prefer groups over individual users to avoid identity residency problems.
Existing PATs:
Existing global PATs remain valid until they expire; the policy affects only newly created tokens.
Results:
When enabled, new PATs must be associated with a single Azure DevOps organization. Users not on the allowlist cannot create global tokens.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.