Allow only administrators to manage extensions in your organization. Review the users who have permission to manage extensions. Users with extension manager role can install/uninstall extensions and approve/decline extension requests. Learn more: https://learn.microsoft.com/en-us/azure/devops/marketplace/grant-permissions
1. Go to Organization Settings. 2. Select Extensions. 3. Click on the Security button. 4. Review all 'Manager' role assignments.
{
"target": "ADOSecurityRoleAssignment",
"if": {
"allOf": [
{
"resource": "ADOSecurityRoleAssignment",
"property": "ScopeResource.ResourceType",
"operator": "equals",
"value": "OrganizationExtension"
},
{
"resource": "ADOSecurityRoleAssignment",
"property": "ScopeResource.ScopeId",
"operator": "equals",
"value": "ems.manage.ui"
},
{
"resource": "ADOSecurityRoleAssignment",
"property": "Role.DisplayName",
"operator": "equals",
"value": "Manager"
},
{
"resource": "ADOSecurityRoleAssignment",
"property": "Identity.DisplayName",
"operator": "match",
"value": "(Project Collection Administrators)"
}
]
},
"then": {
"effect": "Audit"
}
}Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions