AZDO.1000: Azure DevOps OAuth apps can access resources in your organization through OAuth.
| ID | AZDO.1000 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Security policies |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Low |
| MITRE ATT&CK | T1528, T1671 |
| Reads from | Azure DevOps |
| Further reading | https://aka.ms/vstspolicyoauth |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Third-party application access via OAuth should be disabled.
Rationale: Third-party application access should not be used for Azure DevOps.
Remediation action
Section titled “Remediation action”Disable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the Third-party application access via Oauth policy and toggle it to off.
Results: With the policy disabled, third-party applications can no longer access your Azure DevOps organization via OAuth. Any application that previously relied on OAuth access will encounter authentication errors and lose access. This does not affect Microsoft Entra ID OAuth app access.
Related links
Section titled “Related links”- Learn - Change application connection & security policies for your organization
- Learn - Use Azure DevOps OAuth 2.0 to create a web app
Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.