AZDO.1035 - (Tenant) Restrict Personal Access Token lifespan.
Overview
Restrict setting a maximum Personal Access Token (PAT) lifespan should be enabled.
Prerequisites
- Your organization must be linked to a Microsoft Entra tenant.
- You must be an Azure DevOps Administrator to configure tenant policies.
Rationale
Restricting PAT lifespan by enforcing a maximum expiration reduces the risk of long-lived credentials being reused after compromise, helps meet compliance requirements, and encourages regular credential rotation.
Remediation action
Enable the tenant policy to enforce a maximum PAT lifespan.
- Sign in to your organization (
https://dev.azure.com/{yourorganization}). - Select Organization settings (gear icon).
- Select Microsoft Entra, find the "Enforce maximum personal access token lifespan" policy.
- Move the toggle to On.
- Enter the maximum number of days and select Save.
Allowlist and exceptions
- Each tenant policy has its own allowlist; add Microsoft Entra users or groups to exempt them from the restriction.
- Use groups for allowlists; adding named users can create identity residency concerns.
Existing PATs:
Existing PATs remain valid until their configured expiration date and are not retroactively shortened by this setting.
Results:
When enabled, newly created or renewed PATs will have a maximum lifespan (in days) and will automatically expire after that period.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | AZDO.1035 |
| Severity | High |
| Suite | Maester |
| Category | Azure DevOps |
| PowerShell test | Test-AzdoRestrictPersonalAccessTokenLifespan |
| Services | AzureDevOps |
| Learn more | https://learn.microsoft.com/azure/devops/organizations/accounts/manage-pats-with-policies-for-administrators?view=azure-devops#restrict-personal-access-token-lifespan |
| Tags | AZDO, AZDO.1035 |
Source
- Test:
tests/Maester/AzureDevOps/Test.AZDO.1035.ps1 - Documentation:
tests/Maester/AzureDevOps/Test.AZDO.1035.md