AZDO.1008: Request access to Azure DevOps by e-mail notifications to administrators.
| ID | AZDO.1008 |
| Severity | Low |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Users and access |
| Security area | Access control |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Reads from | Azure DevOps |
| Further reading | https://go.microsoft.com/fwlink/?linkid=2113172 |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Request access to Azure DevOps by e-mail notifications to administrators should be disabled.
Rationale: Access control to Azure DevOps is to be a controlled process where access is granted and tracked.
Remediation action:
Section titled “Remediation action:”Disable the policy to stop these requests and notifications.
- Sign in to your organization.
- Choose Organization settings.
- Select Policies, locate the Request Access policy and toggle it to off.
- Provide the URL to your internal process for gaining access. Users see this URL in the error report when they try to access the organization or a project within the organization that they don’t have permission to access.
Results: When users try to access a project without the required permissions, the error message includes the request access URL. This link is shown on the error page to maintain confidentiality, regardless of whether the project exists.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.