AZDO.1018: Protect access to repositories in YAML pipelines.
| ID | AZDO.1018 |
| Severity | High |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Pipelines |
| Security area | Engineering systems |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-3 Access Enforcementnist-800-53-r5:AC-6 Least Privilege |
| MITRE ATT&CK | T1550.001, T1213.003 |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/pipelines/security/overview?view=azure-devops#restrict-project-repository-and-service-connection-access |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Access to repositories in YAML pipelines should apply checks and approval before granting access.
Rationale: To enhance security, consider separating your projects, using branch policies, and adding more security measures for forks. Minimize the scope of service connections and use the most secure authentication methods.
Remediation action
Section titled “Remediation action”Enable the policy to apply checks and approvals.
- Sign in to your organization.
- Choose Organization settings.
- Under the Pipelines section choose Settings.
- In the General section, toggle on “Protect access to repositories in YAML pipelines”.
Results: Apply checks and approvals when accessing repositories from YAML pipelines. Also, generate a job access token that is scoped to repositories that are explicitly referenced in the YAML pipeline.
Related links
Section titled “Related links”Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.