AZDO.1035: (Tenant) Restrict Personal Access Token lifespan.
| ID | AZDO.1035 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Security policies |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:IA-5 Authenticator Management |
| MITRE ATT&CK | T1528, T1550.001 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-personal-access-token-lifespan |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Restrict setting a maximum Personal Access Token (PAT) lifespan should be enabled.
Prerequisites
Section titled “Prerequisites”- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.
Rationale
Section titled “Rationale”Restricting PAT lifespan by enforcing a maximum expiration reduces the risk of long-lived credentials being reused after compromise, helps meet compliance requirements, and encourages regular credential rotation.
Remediation action
Section titled “Remediation action”Enable the tenant policy to enforce a maximum PAT lifespan.
- Sign in to your organization (https://dev.azure.com/{yourorganization}).
- Select Organization settings (gear icon).
- Select Microsoft Entra, find the “Enforce maximum personal access token lifespan” policy.
- Move the toggle to On.
- Enter the maximum number of days and select Save.
Allowlist and exceptions
Section titled “Allowlist and exceptions”- Each tenant policy has its own allowlist; add Microsoft Entra users or groups to exempt them from the restriction.
- Use groups for allowlists; adding named users can create identity residency concerns.
Existing PATs:
Existing PATs remain valid until their configured expiration date and are not retroactively shortened by this setting.
Results:
When enabled, newly created or renewed PATs will have a maximum lifespan (in days) and will automatically expire after that period.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.