Azure Resource Manager service connection should restrict scope level access only to specific resource or resource group as needed. It is important to not provide subscription or management group access for the 'automatic' service principal. Learn more: https://learn.microsoft.com/en-us/azure/devops/organizations/security/security-best-practices#scope-service-connections https://learn.microsoft.com/en-us/azure/devops/pipelines/security/resources https://learn.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints
1. Navigate to Project Settings. 2. Open the Service connections link under Pipelines. 3. Select a service connection of type 'Azure Resource Manager'. 4. Click on Edit. 5. Reduce the scope to the appropiate resource group. 6. Save the changes.
{
"target": "ADOProjectServiceEndpoint",
"if": {
"allOf": [
{
"resource": "ADOProjectServiceEndpoint",
"property": "Type",
"operator": "equals",
"value": "azurerm"
},
{
"resource": "ADOProjectServiceEndpoint",
"property": "DataAzureCloud.Environment",
"operator": "equals",
"value": "AzureCloud"
},
{
"resource": "ADOProjectServiceEndpoint",
"property": "DataAzureCloud.CreationMode",
"operator": "equals",
"value": "automatic"
},
{
"resource": "ADOProjectServiceEndpoint",
"property": "HasLeastPrivilegeAccess",
"operator": "equals",
"value": true
}
]
},
"then": {
"effect": "Audit"
}
}Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions