AZDO.1033: (Tenant) Enable automatic revocation of leaked Personal Access Tokens.


ID	`AZDO.1033`
Severity	High
Suite	Mito
Product	Azure DevOps
Feature	Security policies
Security area	Authentication
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	`nist-800-53-r5:IA-5` Authenticator Management
MITRE ATT&CK	T1552.001, T1593.003, T1550.001
Reads from	Azure DevOps
Further reading	https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#automatic-revocation-of-leaked-tokens

What this checks and how to fix it

Automatic revocation of leaked Personal Access Tokens should be enabled.

Prerequisites

Your organization must be linked to a Microsoft Entra tenant.
You must be an Azure DevOps Administrator to configure tenant policies.

Rationale

Automatically revoking PATs detected as leaked minimizes the window of opportunity for unauthorized access. Disabling this policy leaves exposed tokens active even if they appear in public repositories.

Remediation action

Enable the tenant policy to revoke leaked tokens.

Sign in to your organization (https://dev.azure.com/{yourorganization}).
Select Organization settings (gear icon).
Select Microsoft Entra, locate the “Automatically revoke leaked personal access tokens” policy.
Move the toggle to On.

Results:

When enabled, Azure DevOps will automatically revoke any PATs detected as leaked or exposed. If the policy is later disabled, tokens checked into public GitHub repositories remain active.

Learn - Automatic revocation of leaked tokens

Mito check. Author: SebastianClaesson. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).