DOS1070

Pipeline Settings - Disable anonymous access to badges

DOS1070

AzureDevOps organization low builtIn

Description

Status badges are private. Anonymous users can access the status badge API for all pipelines unless this option is enabled. Learn more: https://learn.microsoft.com/en-us/azure/devops/pipelines/create-first-pipeline?#add-a-status-badge-to-your-repository

Recommendation

1. Go to Organization Settings. 
2. Click on Pipelines -> Settings. 
3. Turn 'On' the setting 'Disable anonymous access to badges'.

Policy Rule

{
  "target": "ADOOrganizationPipelineSettings",
  "if": {
    "allOf": [
      {
        "resource": "ADOOrganizationPipelineSettings",
        "property": "StatusBadgesArePrivate",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS1060 DOS1075 »
Rule Details
  • Rule ID: DOS1070
  • Code: ADO_Organization_Pipeline_Settings_Disable_Anonymous_Access_To_Badges
  • Platform: AzureDevOps
  • Category: organization
  • Severity: low
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions