AZDO.1034: (Tenant) Restrict creation of new Azure DevOps organizations.
| ID | AZDO.1034 |
| Severity | Medium |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Organization policies |
| Security area | Access control |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/organizations/accounts/azure-ad-tenant-policy-restrict-org-creation?view=azure-devops#turn-on-the-policy |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Restrict creation of new Azure DevOps organizations should be enabled.
Prerequisites
Section titled “Prerequisites”- You must have the Azure DevOps Administrator role in your Microsoft Entra tenant.
Rationale
Section titled “Rationale”Limiting who can create organizations helps maintain governance, control, and compliance across an enterprise Azure DevOps environment.
Remediation action
Section titled “Remediation action”Enable the tenant policy to restrict organization creation.
- Sign in to your organization (https://dev.azure.com/{Your_Organization}).
- Select Organization settings (gear icon).
- Select Microsoft Entra ID, and move the toggle to On to restrict organization creation.
Allowlist and exceptions
Section titled “Allowlist and exceptions”- After enabling the policy, add Microsoft Entra users or groups to the allowlist to permit them to create organizations.
- Use groups for allowlists to avoid identity residency concerns.
Results:
When enabled, only users on the allowlist (or Azure DevOps Administrators as permitted) can create new organizations.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.