CODEWITHSUNDEEP
securityazure-devopsdevops
billybob
billybob

Reputation: 2998

How to efficiently handle Personal Access Token in Azure DevOps organization?

Context:

We are using Azure DevOps and we are starting to leverage more and more PATs in our DevOps cycles and processes. We have about 30 users and each one of them creates a bunch of them under their personal account for different use cases.

Here are some scenarios where they are used: 

Basically, we are starting to loose a bit the control over:  

As an example, we have some users that create PATs to configure agents. They will give the full access to this PAT, instead of selecting the proper scopes for it. As we know, end users don't really care about security and we are aware that we need educate our developer. However, we still want to have way to control those PATs.

Questions:  

Upvotes: 6

Views: 868

Answers (1)

Laurent
Laurent

Reputation: 66

Maybe this could help you to restrict the usage of the PATs

https://devblogs.microsoft.com/devops/new-policies-to-restrict-personal-access-token-scope-and-lifespan/

Is there a way to view in the organization level all the PATs that used?

Not that I know

Is it possible to remove the possibility for a specific user to create PATs and only give that feature to the admin users?

From the article, yes it is now possible for the administrator to do so

Is it possible to revoke all the PATs on the organization level?

Yes it is, see https://learn.microsoft.com/en-us/rest/api/azure/devops/tokenadministration/token%20revocations/revoke%20authorizations?view=azure-devops-rest-5.0&preserve-view=true

Upvotes: 1

Related Questions