DOS2160

Pipeline Settings - Disable anonymous access to badges

DOS2160

AzureDevOps project low builtIn

Description

Status badges are private. Anonymous users can access the status badge API for all pipelines unless this option is enabled. Learn more: https://learn.microsoft.com/en-us/azure/devops/pipelines/create-first-pipeline?#add-a-status-badge-to-your-repository

Recommendation

1. Navigate to Project Settings. 
2. Open the Settings link under Pipelines. 
3. Turn 'On' the setting 'Disable anonymous access to badges'.

Policy Rule

{
  "target": "ADOProjectPipelineGeneralSettings",
  "if": {
    "allOf": [
      {
        "resource": "ADOProjectPipelineGeneralSettings",
        "property": "StatusBadgesArePrivate",
        "operator": "equals",
        "value": true
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS2155 DOS2165 »
Rule Details
  • Rule ID: DOS2160
  • Code: ADO_Project_Pipeline_Settings_Disable_Anonymous_Access_To_Badges
  • Platform: AzureDevOps
  • Category: project
  • Severity: low
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions