Skip to main content
{ Reporting and Compliance }

Azure DevOps Public Project Posture Audit

Reports the public projects in an Azure DevOps organization that fail its security policy, with each failing check.

What this agent does

This read-only agent audits every public project in an Azure DevOps organization against the organization's security policy. It checks each project for an approved public listing, project-scoped pipeline authorization, and guest user access. It checks each repository in the project for a reviewer policy on its default branch, a README, and a license. It then reports each project that fails, with the checks it fails.

The challenge

A public project exposes its repositories, work items, pipelines, and build logs to everyone on the internet. Projects are made public by mistake, and protections change after a project is created. A default branch loses its reviewer policy, a guest user keeps Contribute, or a pipeline keeps the organization-wide job authorization scope. Nobody checks every public project against the policy. Teams learn about these gaps only when someone finds one by chance.

The solution

The agent checks every public project against the same short policy on each run. It reports a check it cannot complete as inconclusive, never as a violation. It refuses to report when the project list is incomplete, so it never presents a partial scan as the whole organization. Provides a unified list of noncompliant public projects and the checks to fix.

Workflow

  1. 01

    List projects

    Read the organization's public projects policy, list every public project and its repositories, and stop when the list is incomplete.

  2. 02

    Check each project

    Check the approved public listing, the pipeline job authorization scope settings, and guest user access.

  3. 03

    Check each repository

    Check the default branch for a reviewer policy, and the root for a README and a license.

  4. 04

    Report

    Report each noncompliant project with its failing checks, and track the noncompliant and total counts.

Agent template 

# Azure DevOps Public Project Posture Audit

## Measurable outcomes

Every public project in the organization that fails the security policy is in the report, with each check it fails. Track the noncompliant count on every run. The count falls as owners fix their projects.

## Procedure

For a given organization, read whether the organization policy allows public projects. Report the policy as a finding when it is on and the allowlist is empty. List every public project and every repository in it. Stop and report the failure when the list is shorter than expected. Never present a partial list as the whole organization. Check each project against three rules. The project is on an allowlist of projects approved to be public. The effective pipeline settings limit the job authorization scope to the current project for both release and non-release pipelines, and protect access to repositories in YAML pipelines. No account with the Entra user type Guest is in the project's Contributors group or holds Contribute on any of its repositories. Check each repository in the project against three rules. The default branch has a minimum reviewer policy that requires at least one reviewer and does not let requestors approve their own changes. A README exists at the root. A license exists at the root. Read the effective branch policies, including the ones set across every repository in the project. A project that fails any project rule or any repository rule is noncompliant. When a setting cannot be read, report the check as inconclusive and a token scope problem, not a violation. In an organization not connected to Entra ID, report the guest check as inconclusive. I maintain the allowlist, and I add a project only after I review its public exposure.

## Requirements

It needs Azure DevOps read access to the organization's policies, projects, repositories, branch policies, pipeline settings, and project members, through a personal access token with the Project and Team (Read), Code (Read), Build (Read), and Graph (Read) scopes, and nothing more. It never changes a project, a repository, a policy, or a member.