AZDO.1027 - Disable showing Gravatar images for users outside of your enterprise.

Contributed by Sebastian ClaessonAll contributors →

Overview

Gravatar images should not be exposed for users outside your enterprise.

Rationale: Gravatar images are served by an external service (gravatar.com) and may leak email hashes or profile information. Allowing them can reveal internal usernames or identities to outside observers and increases privacy risk.

Remediation action

Disable the policy to stop these requests and notifications.

1. On your Azure DevOps organization page, select Organization settings at lower left, and then select Repositories in the left navigation.
2. On the All Repositories page, set Gravatar images to Off.

Results: With the setting disabled, user avatars use generic initials or local images only, preventing any information from being fetched from third-party servers.

Related links

• Learn - Gravatar images

Test Metadata

Field	Value
Test ID	AZDO.1027
Severity	Medium
Suite	Maester
Category	Azure DevOps
PowerShell test	Test-MtCheckAZDO1027
Services	AzureDevOps
Learn more	https://learn.microsoft.com/azure/devops/repos/git/repository-settings?view=azure-devops&tabs=browser#gravatar-images
Tags	AZDO, AZDO.1027

Source

• Test: tests/Maester/AzureDevOps/Test.AZDO.1027.ps1
• Documentation: tests/Maester/AzureDevOps/Test.AZDO.1027.md