DOS1140

Pipeline Settings - Enforce job authorization scope to current project for release pipelines

DOS1140

AzureDevOps organization Severitycritical builtIn

Description

Limit job authorization scope to current project for release pipelines. Release pipelines can run with collection scoped access tokens unless this option is enabled. With this option enabled, you can reduce the scope of access for all release pipelines to the current project. https://learn.microsoft.com/en-us/azure/devops/pipelines/process/access-tokens#job-authorization-scope

En savoir plus

Recommandation

1. Go to Organization Settings. 
2. Click on Pipelines -> Settings. 
3. Turn 'On' the setting 'Limit job authorization scope to current project for release pipelines'.

Règle de politique

{
  "target": "ADOOrganizationPipelineSettings",
  "if": {
    "allOf": [
      {
        "resource": "ADOOrganizationPipelineSettings",
        "property": "EnforceJobAuthScopeForReleases",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS1130 DOS1150 »
Détails de la règle
  • ID de la règle: DOS1140
  • Code: ADO_Organization_Pipeline_Settings_Limit_Release_Pipeline_Scope
  • Plateforme: AzureDevOps
  • Catégorie: organization
  • Sévérité: Severitycritical
  • Type: builtIn
Règles connexes

Copyright © DevOps Shield. Tous droits réservés. Politique de confidentialité | Politique de témoins | Conditions d'utilisation