AZDO.1026: Enable automatic enrollment to Advanced Security for Azure DevOps.


ID	`AZDO.1026`
Severity	Medium
Suite	Mito
Product	Azure DevOps
Feature	Repositories
Security area	Engineering systems
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Medium
Framework controls	`nist-800-53-r5:SA-11` Developer Testing and Evaluation `nist-800-53-r5:IA-5(7)` Authenticator Management \| No Embedded Unencrypted Static Authenticators
MITRE ATT&CK	T1552.001, T1195.001, T1190
Reads from	Azure DevOps
Further reading	https://learn.microsoft.com/azure/devops/repos/security/configure-github-advanced-security-features?view=azure-devops&tabs=yaml#organization-level-onboarding

What this checks and how to fix it

GitHub advanced Security for Azure DevOps should be automatically enabled for new projects.

Rationale: Newly created projects should have Advanced Security enabled upon creation.

Organization-level onboarding

Sign in to your organization.
Go to your Organization settings for your Azure DevOps organization.
Select Repositories.
Select Enable all and see an estimate for the number of active committers for your organization appear.
Select Begin billing to activate Advanced Security for every existing repository in each project in your organization.
Select Automatically enable Advanced Security for new repositories so that any newly created projects have Advanced Security enabled upon creation.

Results: Newly created projects have Advanced Security enabled upon creation.

Mito check. Author: SebastianClaesson. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).