AZDO.1037: (Organization) Restrict Personal Access Token creation.
| ID | AZDO.1037 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Security policies |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:IA-5 Authenticator Management |
| MITRE ATT&CK | T1528, T1550.001 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Personal Access Token creation should be restricted at the organization level.
Rationale: Restricting PAT creation reduces the risk of long-lived credentials being used to access your Azure DevOps organization. Existing personal access tokens remain valid until expiration when the policy is enabled.
Remediation action
Section titled “Remediation action”Enable the policy to restrict Personal Access Token creation.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the “Restrict personal access token (PAT) creation” policy and toggle it to on.
Results: With the policy enabled, users cannot create new Personal Access Tokens unless explicitly allowed through the allow list.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.