AZDO.1015: Limit variables that can be set at queue time.
| ID | AZDO.1015 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Pipelines |
| Security area | Engineering systems |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:SI-10 Information Input Validation |
| MITRE ATT&CK | T1677 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/pipelines/security/inputs?view=azure-devops#limit-variables-that-can-be-set-at-queue-time |
What this checks and how to fix it
Section titled “What this checks and how to fix it”User-defined variables should not be able to override system variables or variables not defined by the pipeline author.
Rationale: Only those variables explicitly marked as “Settable at queue time” can be set by user.
Remediation action
Section titled “Remediation action”Enable the policy to limit variables that can be set at queue time.
- Sign in to your organization.
- Choose Organization settings.
- Under the Pipelines section choose Settings.
- In the General section, toggle on “Limit variables that can be set at queue time”.
Results: Only those variables explicitly marked as “Settable at queue time” can be set at queue time.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.