AZDO.1000 - Azure DevOps OAuth apps can access resources in your organization through OAuth.

Contributed by Sebastian ClaessonAll contributors →

Overview

Third-party application access via OAuth should be disabled.

Rationale: Third-party application access should not be used for Azure DevOps.

Remediation action

Disable the policy to stop these requests and notifications.

1. Sign in to your organization.
2. Choose Organization settings.
3. Select Policies, locate the Third-party application access via Oauth policy and toggle it to off.

Results: With the policy disabled, third-party applications can no longer access your Azure DevOps organization via OAuth. Any application that previously relied on OAuth access will encounter authentication errors and lose access. This does not affect Microsoft Entra ID OAuth app access.

Related links

• Learn - Change application connection & security policies for your organization
• Learn - Use Azure DevOps OAuth 2.0 to create a web app

Test Metadata

Field	Value
Test ID	AZDO.1000
Severity	High
Suite	Maester
Category	Azure DevOps
PowerShell test	Test-AzdoThirdPartyAccessViaOauth
Services	AzureDevOps
Learn more	https://aka.ms/vstspolicyoauth
Tags	AZDO, AZDO.1000

Source

• Test: tests/Maester/AzureDevOps/Test.AZDO.1000.ps1
• Documentation: tests/Maester/AzureDevOps/Test.AZDO.1000.md