DOS2450

Do not use Azure Classic service connections to access an Azure subscription

DOS2450

AzureDevOps project high builtIn

Description

You should use the Azure Resource Manager service connection scoped to a resource group in your subscription. Delete the Azure Classic service connection and create a new ARM service connection to replace it. Learn more: https://learn.microsoft.com/en-us/azure/devops/organizations/security/security-best-practices#scope-service-connections https://learn.microsoft.com/en-us/azure/devops/pipelines/security/resources https://learn.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints

Recommendation

1. Navigate to Project Settings. 
2. Open the Service connections link under Pipelines. 
3. Select the Azure Classic service connection. 
4. Click on the three dots button (top right). 
5. Click on Delete. 
6. Create a new service connection of type 'Azure Resource Manager'.

Policy Rule

{
  "target": "ADOProjectServiceEndpoint",
  "if": {
    "allOf": [
      {
        "resource": "ADOProjectServiceEndpoint",
        "property": "DataAzureCloud.Environment",
        "operator": "equals",
        "value": "AzureCloud"
      },
      {
        "resource": "ADOProjectServiceEndpoint",
        "property": "Type",
        "operator": "notEquals",
        "value": "azure"
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS2440 DOS2460 »
Rule Details
  • Rule ID: DOS2450
  • Code: ADO_Project_ServiceConnection_Dont_Use_AzureClassic_Connections
  • Platform: AzureDevOps
  • Category: project
  • Severity: high
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions