AZDO.1036: (Tenant) Restrict Personal Access Token full scope.
| ID | AZDO.1036 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Security policies |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:AC-6 Least Privilege |
| MITRE ATT&CK | T1528, T1550.001 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-creation-of-full-scoped-pats-tenant-policy |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Restrict creation of full-scoped Personal Access Tokens (PATs) should be enabled.
Prerequisites
Section titled “Prerequisites”- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.
Rationale
Section titled “Rationale”Restricting full-scoped Personal Access Token (PAT) creation enforces least privilege, reduces the risk of credential exposure, and limits the blast radius if a token is compromised. It also helps meet compliance requirements and prevents accidental or malicious use of overly permissive tokens.
Remediation action
Section titled “Remediation action”Enable the tenant policy to restrict creation of full-scoped personal access tokens.
- Sign in to your organization (https://dev.azure.com/{yourorganization}).
- Select Organization settings (gear icon).
- Select Microsoft Entra, find the “Restrict creation of full-scoped personal access tokens” policy.
- Move the toggle to On.
Allowlist and exceptions
Section titled “Allowlist and exceptions”- Use Microsoft Entra groups for allowlists; adding named users can create identity residency concerns.
- Users or groups on the allowlist are exempt from the restriction and can create PATs of any scope.
Existing PATs:
Existing PATs remain valid until their configured expiration date and are not retroactively restricted.
Results:
When enabled, new personal access tokens (PATs) must have limited, defined scopes. Creation of full-scope PATs (tokens that grant all accessible scopes) will be blocked for users who are not on the allowlist.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.