AZDO.1023 - Disable Marketplace tasks.
Overview
Disable the ability to install and run tasks from the Marketplace, which gives you greater control over the code that executes in a pipeline.
Rationale: Tasks from the marketplace should be reviewed and approved.
Remediation action
Enable the restriction to prevent marketplace tasks from executing in pipelines.
- Sign in to your organization.
- Choose Organization settings.
- Select Settings under Pipelines.
- Go to the section "Task restrictions" and turn on "Disable marketplace tasks"
Results: With this enabled, pipelines will not use tasks installed from the Marketplace. Jobs which depend on Marketplace tasks will fail.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1023 |
| Severity | High |
| Suite | Maester |
| Category | Azure DevOps |
| PowerShell test | Test-AzdoOrganizationTaskRestrictionsDisableMarketplaceTask |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#prevent-malicious-code-execution |
| Tags | AZDO, AZDO.1023 |
Source
- Test:
tests/Maester/AzureDevOps/Test.AZDO.1023.ps1 - Documentation:
tests/Maester/AzureDevOps/Test.AZDO.1023.md